Fair Processing Notice

Data Protection Officer

The Data Protection Officer for Derby Homes is Taranjit Lalria and he can be contacted at the following address: [email protected]

You can also contact the data protection officer at:

Data Protection Officer
Derby Homes Limited
839 London Road
Derby
DE24 8UZ

Information Commissioners Office (ICO)

For more information regarding data protection issues you may wish to contact the Information Commissioners Office (ICO) at [email protected]

You can also contact the Information Commissioners Office at:

Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

For more information about the ICO visit: www.ico.org.uk

Derby Homes is the data controller for information it collects from residents, employees and contractors of Derby Homes, and is the joint data controller for information collected on behalf of Derby City Council. This means that we have to look after all the personal information we collect and use and make sure that it is done so proportionately, correctly and safely. We are listed on the Information Commissioner’s Office (“ICO”) register of data controllers with registration number Z6727964.

If you require general information about the General Data Protection Regulation, the Data Protection Act 2018 and any other relevant legislation, Information is available on the Information Commissioners website at: www.ico.org.uk

Derby Homes collect information from you via a variety of sources, including when you apply for one of our properties, services, jobs or contracts, complete one of our forms, when you call, write, e-mail or meet with us or respond to a survey. We operate a CCTV system in certain locations for the detection and deterrence of crime, which operates continuously and recordings are held for up to one month.

From time to time we may operate CCTV/sound recording and / or use photography to capture evidence of breach of tenancy, alleged anti-social behaviour or crime. We may also take photographs at our events, at our properties and in our communities to use for general marketing and publicity.

We may receive information about you from third parties including:

• Councils or Government bodies
• Police, welfare or support organisations, dealing with you including information provided by NHS or Adult Social Care professionals
• Councillors, MPs or other representatives acting on your behalf/instruction.
• Family members, Next of Kin or others with power of Attorney.
• Other Housing Providers
• Referring partners
• Contractors

This list is not exhaustive.

Personal data is information relating to an identifiable living individual. Whenever personal data is processed, collected, recorded, stored or disposed of it must be done within the terms of the data protection legislation.

Is some of my information 'special'?

Yes. Some personal information needs more protection due to its sensitive nature. Information that relates to a particular characteristic such as:

• Racial or ethnic origin
• Political opinions
• Religious beliefs or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (for example finger print evidence)
• Sexual life
• Criminal record
• Prosecutions
• Medical data
• Criminal convictions and offences.

At Derby Homes we ensure that any special data that we collect has extra protections in place to ensure that it is looked after safely and securely.

For more detailed information about what is personal data please see the Information Commissioner’s at: www.ico.org.uk

The information we require from tenant(s) and other customers includes:

• Full name (and proof of your identity / photo ID)
• Date of birth
• National Insurance number
• Contact details (e.g. phone(s), e-mail, correspondence address)
• Details of next of kin and / or anyone authorised to act on your behalf if applicable
• Basic details (name and date of birth) of all household residents
• Proof of housing eligibility, any interest or equity in other property
• Military service and dates of you or relevant relative
• Other personal information that will vary on a case by case basis to help us to provide you with support or resolve breach of tenancy, alleged anti-social behaviour or fraud
• incomes and outgoings
• bank details
• Address, including previous and forwarding addresses
• Employment details

Employees and contractors may be asked for some of the same information where relevant to the circumstances, plus;

• Proof of ability to work in the UK
• P45 where applicable
• References

The information we may collect from you includes disabilities or vulnerabilities, which we use to tailor our service to better meet your particular circumstances and needs. We may use this information for safeguarding of staff, residents or contractors.

If you do not provide this information then we may not be able to provide all our services to you, and if a tenant or prospective tenant, ultimately you may not be able to hold a tenancy with us. We will also be told about payments you make to us and we may receive information from others about you, e.g. in the event of complaints or alleged breaches of your tenancy.

Technical computer information

This is information about the computer/smart phone/tablet used to access a website, platform or portal. This information is usually collected through cookies and can include the IP address, operating system and browser; if accessing through a smart phone this can also include the phones unique ID.

Derby Homes collects, holds and uses personal data to allow it to provide services to the residents of Derby Homes, Derby City Council and external landlords. These services include, amongst others, providing, managing and maintaining homes, collecting rent, providing advice to residents and processing applications for homes. The performance of a Tenancy Agreement is usually the legal basis for processing tenants’ information. The performance of a contract is the usual legal basis for processing information relating to employees and contractors.

We will process personal data for the following purposes:

• For the purpose for which you provided the information. e.g. processing information given on an application form for the purpose of processing your application, and to monitor Derby Homes in responding to your request
• To allow Derby Homes to be able to communicate and provide services appropriate to your needs, e.g. informing relevant Housing Office about your bespoke needs and requirements to support your residency or employment
• To ensure that Derby Homes meets its legal requirements, including obligations imposed under the Health and Safety Act
• Where necessary for Derby Homes Law Enforcement functions, e.g. gas safety checks etc, where Derby Homes is legally obliged to undertake such processing
• Where the processing is necessary for Derby Homes to comply with its legal obligations, e.g. the prevention and/or detection of crime
• To process financial transactions including rent payments and benefits involving Derby Homes or where Derby Homes is acting on behalf of other government bodies, e.g. Department for Works and Pensions
• Where necessary to protect individuals from harm or injury
• Managing your account charges and payments, including arrears
• Ensuring tenancy (or contract) conditions are complied with, such as dealing with anti-social behaviour or fraud
• Plan, develop and improve our products and services
• Assess your suitability for a job vacancy or to assess your suitability to become a Board member
• Allow you to participate in volunteering activity with us
• To fulfil our obligations under a contract of employment and any associated Derby Homes/Derby City Council employment policies.

Derby Homes conducts surveys regularly and periodically relating to our services in order to gauge satisfaction and make improvements based on feedback.

We may monitor and record communications with you (such as telephone conversations and emails) for the purposes of quality assurance, staff training, fraud prevention and dispute resolution.

Derby Homes will only use information where otherwise permitted under the General Data Protection Regulation and the Data Protection Act 2018, e.g.

• Disclosure to comply with legal obligations.
• Derby Homes may also use your personal data, after it has been anonymised, to allow the statistical analysis of data to allow Derby Homes to effective target and plan the provision of services.

Equalities information

Derby Homes may use information about your ethnic background, first language, gender, sexual orientation and age ('equalities data') for the purposes of compiling statistical data about the population of the residents and the take up of Derby Homes by various groups, both to assist in complying with the equality legislation and to assist Derby Homes in the effective planning and provision of future services.

Such statistical data or statistical analysis will not allow the identification of any specific individual nor will it have any impact on any individual’s entitlement to Derby Homes’ services and facilities.

Such equalities data may also be used to allow Derby Homes to provide sufficient assistance where required, e.g. to provide translation services or access facilities.

Much of the data we use relates to our properties and their maintenance and repair. We do not consider property information used in conjunction with the property address to be your personal information. For example, the age of the kitchen, results from a building survey, planning to replace windows or a repair to a tap. We are usually happy to provide you with answers to questions you may have about the property you are living in and work done to it. As soon as your name, contact details or other personal information is used in conjunction with property information, such as to complete a property repair visit, then this is treated as personal information.

The law allows us to use your personal information in lots of different ways.

There are lots of legal reasons why we need to collect and use your personal information. Sometimes it is required by law and its use is necessary to deliver a service. It will include carrying out our regulatory, licensing and enforcement roles and providing a wide range of Derby Homes’ services.

Personal data we hold about you will be processed for one or more of the following reasons:

• the processing is necessary in order for us to comply with our obligations under a contract between you and us, or because you have asked us to take specific steps before entering into a contract with you;
• the processing is necessary for us to comply with a legal obligation;
• the processing is necessary for our legitimate interests (or the legitimate interests of a third party) unless your interests in data privacy and security override our legitimate interests.
• you have consented to the processing for the specific purposes described in this notice;

Sometimes we will need your consent to process the personal information. If you have provided consent this can be removed at any time. If you want to remove that consent please contact the data protection officer at: [email protected] and tell us which service you are using so that your request can be dealt with. This only applies where information is not necessary for the performance of our functions as indicated above – that is where the information is given voluntarily.

Information on young people aged 13 or under

If you are aged 13 or under, we ask that you get your parent/guardian’s permission before you provide us with your personal information.

Derby Homes needs to communicate with tenants, employees and contractors, this will usually be in writing (including e-mail and SMS), telephone or verbally during meetings. Our tenants receive our newsletter with information about what is going on within the organisation. We are required by our regulator to keep our tenants informed and to offer opportunities for involvement. We will only discuss or communicate your tenancy with those named on the agreement or those authorised (temporarily or permanently) by you. You can authorise someone temporarily verbally over the phone or permanently in writing. Please request an Authority to Act form from your local housing office if you would like to make a request for someone to act on your behalf. 

To ensure that we maintain high standards, we will:

• Recognise that any personal data handled by Derby Homes is held on behalf of that person and that we ensure we respect that responsibility
• Adopt and maintain high standards in respect of the handling and use of that personal data
• Only collect, hold and use personal data where it is necessary and proportionate to do so
• Securely delete any personal data when no longer needed
• Keep your personal data secure and safe
• Not unnecessarily and without good reason, infringe the privacy of the residents, contractors or employees of Derby Homes
• Consider and address the privacy risks first when planning to use or hold personal information in new ways, such as when introducing new systems
• Be open with individuals about how we use their information and who we give it to
• Make it easy for individuals to access and correct their personal information
• Ensure that there are effective safeguards and systems in place to make sure personal information is kept securely and does not fall into the wrong hands
• Provide training to staff that handle personal information and treat it as a disciplinary matter if they misuse or don’t look after personal information properly
• Put appropriate financial and human resources into looking after personal information to make sure we can live up to our promises
• Have a robust data strategy in place to protect against any disasters but also malware such as ransom ware
• Regularly check that we are living up to our promises and report on how we are doing
• Ensure that our processors adhere to their obligations with regards to data protection legislation

Derby Homes may disclose personal data to third parties, but only where it is necessary, either to comply with a legal obligation, or where permitted under the General Data Protection Regulation and the Data Protection Act 2018 e.g. where the disclosure is necessary for the purposes of the prevention and/or detection of crime, or where it is necessary to allow a third party working for or on behalf of Derby Homes.

Derby Homes will strive to ensure that any personal data in its care will be kept safe and that where your information is disclosed to a third party, Derby Homes will seek to ensure that the third party has sufficient systems and procedures in place to prevent the loss of personal data.

Derby Homes may need to share personal information with government departments and agencies, with our regulator and auditors, with Local Authorities, utility companies or with other organisations and agencies, including the Police, where we are legally allowed to do so.

Derby Homes may disclose employee data with H M Revenue & Customs, Disclosure and Barring Service, Department of Work and Pensions, Pensions Administrators (Derbyshire Pension Fund for Local Government Pension Scheme, voluntary payroll deductions, Employee Benefits Provider, external auditors, Payroll/HR software providers, external organisation linked to TUPE legislation, absence reporting partner (this list is not exhaustive).  This is for the purposes allowed by law as well as provision of information to pension administrators and other third parties payroll deduction where you are a member. This would include sharing relevant information with external training providers supporting your personal development or apprenticeship.

We have an obligation to protect public funds from misuse and fraud. As a result of this we are obliged to transfer some information to the Cabinet Office as part of the National Fraud Initiative. The data held will be used for cross-system and cross company comparison for the prevention and detection of fraud.

Under the Homelessness Reduction Act 2017 the Ministry of Housing, Communities and Local Government (DCLG) are overhauling the way it collects data from local authorities on statutory homeless. We will share information at Homelessness Case Level.

We have a Data Protection Policy (which can be downloaded on the right hand side of this page) which explains how we look after your personal information. We also have lots of practical measures to protect your information such as:

• Limiting access on systems to only those staff that need to access the information.
• Providing training for staff to make them aware of how to handle your data safely and in accordance with the data protection legislation.
• Having a clear desk policy and guidance about keeping sensitive data in locked places with limited access.
• Having policies and guidance for staff who take special data out of the building and working at home guidance for all staff to follow.
• Encryption of sensitive electronic communications such as e-mails as well as encryption of disks and memory sticks. Encryption is a means of ensuring that data can only be accessed by authorised users. This means that the information is hidden and cannot be read without a password.
• Regular testing of our IT equipment and keeping up to date with regular security updates.

We only keep personal data as long as it is necessary to do so. Sometimes there is a legal reason why we must keep the data for a certain period.

Information relating to a tenancy will be kept for as long as the agreement is active or where money is owed on the account, and for a period not exceeding six years afterwards. The basic history of who held a tenancy at which property and when will be held in perpetuity.‌

You can ask for access to the information we hold on you

This is known as a Subject Access Request (SAR).

Under the Data Protection Act 2018, you are legally entitled to request access to any records held by Derby Homes about yourself. Derby Homes will seek to comply with your request but there may be some situations where it will not be able to do this in full, e.g. where information held was given in confidence or when a professional thinks that it could cause serious harm to you or another’s physical or mental wellbeing if the information was given to you. Also, if we think that giving you the information may stop us from preventing a crime.

You can ask to change information that you think is inaccurate

If you receive a copy of your information and you find that any information is inaccurate you have the right to ask us to correct the information. We may not always be able to change or remove the information but we will correct factual inaccuracies and add supplemental comments. In some cases we may also record your comments to show that you disagree with information held about you. Whilst Derby Homes tries to ensure that any personal data it holds about you is correct, there may be situations where the information it holds is no longer accurate. If this is the case, please contact the department holding the information so that any errors can be investigated and corrected. You can also make an application to the Information Governance Team to ask for any inaccurate information to be rectified or if you think your information is incomplete you can ask for a supplementary statement to be added to give an accurate picture.

Right to be forgotten - your right to ask for your information to be deleted

You have the right to ask for information to be erased although this is not an absolute right. If your data is no longer necessary for the purpose for which it is collected you can ask for it to be erased. Again, where possible, Derby Homes will seek to comply with your request but there may be some situations where it will not be able to do this, e.g. where Derby Homes is required to hold or process information to comply with a legal requirement.

Where your personal information has been shared with others we will do what we can to make sure they also comply with your request for erasing the information.

A right in certain circumstances to request restriction of processing

You also have the right to ask Derby Homes to limit processing in certain circumstances for example where you have contested the accuracy of information held that is about you or if Derby Homes no longer needs the information although again, there are some exceptions. For example we may need to hold or use your information because we are required to do so by law. If this request is approved this may cause delays or prevent us from delivering a service to you.

Right to object to processing of data in certain circumstances

You have the right in some circumstances to object to Derby Homes processing your personal data in relation to any Derby Homes service. Where possible, Derby Homes will seek to comply with your request but there may be some situations where it will not be able to do this, e.g. where Derby Homes is required to hold or process information to comply with a legal requirement, or where deletion of this information may cause delays or hinder Derby Homes ability to provide services to you. The right to object only applies in limited circumstances.

Right in certain circumstances to request portability of your data to another provider

You also have the right in certain circumstances to get a copy of your information in an electronic form and re-use it with other service providers. This right only applies to information processed by automated means or information obtained by consent from you. It’s likely that data portability will not apply to most of our services. 

Rights in connection with automated decision making, including profiling

Where a computer makes decisions about you (which is known as automated decision making) you can ask that these decisions are explained to you.

This means that you can question decisions made about you by a computer, unless its required for any contract that you have entered into, required by law, or you have given your agreement to this form of processing.

You also have the right to object if you are being profiled. This means that decisions are made about you based on certain things in your personal information. 

You have the right to complain

You have the right to complain about any matter relating to our services, including how we use your personal data.

If you wish to complain about our use of your personal data you should complain to our Information Governance Officer in the first instance. You may also complain to the UK Information Commissioner’s Office (ICO).

Transferring information oversees

Where data is shared within the UK, or the European Union (EU), the third party will be required to comply with and safeguard the data under the terms of the Data Protection Legislation.

Your personal information will only be transferred to countries, outside of the EU, whose data protection laws have been assessed as adequate by the European Commission, or where adequate safeguards, such as the EU-US Privacy Shield, are in place.

Our digital helper, Ali, is available on pages across the Derby Homes website and on the phone to provide support to our customers. They allow you to ask us questions relating to Derby Homes services and receive a response in real time.

We use a third party service provider, ICS AI, to assist us. By using our digital helper, ICS AI will automatically collect the following (anonymised) information from you: IP address, operating system, browser type and geographical location. You can read how ICS AI will use this information in their privacy policy on the ICS.AI website.

Derby Homes will hold the data from each anonymised conversation for twelve months. On completion of your conversation, you may be asked to complete a short survey. All answers for the survey are anonymised as well. Conversations and survey results may be used for quality monitoring and service improvement purposes.