At South Lakes Housing (SLH) we take great care to fulfil our responsibilities under the Data Protection Act 2018 and UK General Data Protection Regulation (GDPR).
This Privacy Notice applies to customer data and explains what personal data we collect, how we use, store and share it; and the lawful basis upon which it is processed. It explains the rights you have as a data subject in respect to your personal data and how to contact us.
References to “we,” “our” or “us” in this Privacy Notice are to SLH. Our Registered Address is Bridge Mills Business Centre, Stramongate, Kendal, Cumbria, LA9 4BD. Our contact number is 0300 303 8540.
This Privacy Notice applies to customers of SLH and of Lune Valley Rural Housing Association (LVRHA). For customers of SLH, SLH is the data controller for personal data covered within the scope of this notice.
For customers of LVRHA, a management services contract exists between LVRHA (FCA registration number 26654R) and SLH. SLH acts as a ‘Managing Agent’ for LVRHA. LVRHA is the data controller and SLH is the data processor for personal data covered within the scope of this notice. LVRHA’s Registered Office is Bridge Mills Business Centre, Stramongate, Kendal, Cumbria, LA9 4BD.
We process personal data from numerous sources to run our business activities. We maintain a register of data processing activities and perform periodic reviews of our data processing to ensure it conforms to our expectations. We only collect personal data necessary for us to perform our business operations effectively.
We process the following personal data:
•Your name, any other names you may have had, title and pronouns
•Date of birth
•Gender
•Nationality and information about your right to rent
•Contact details, including telephone numbers, e-mail address, current and previous addresses
•The details of other household members
•The details of nominated persons who can speak on your behalf, including name, contact telephone numbers and address
•Communication preferences
•Your username and password for ‘My Account’ services
•Profile photo for your account with us
•National Insurance Number
•Income and financial circumstances
•Bank account
•Payments made to us
•Repairs made by us on your home
•When you have contacted us
•A record of your compliance with your tenancy, potentially including information on your behaviour from partner agencies such as local authorities, policing bodies, and other housing providers
•Recordings of telephone calls made to and from the organisation
•Surveys you have completed
•Information about how you use our website and other services
•Surveillance such as CCTV footage and noise nuisance recordings
We may process Special Category Personal data about you, including:
•Race/ethnicity
•Religious beliefs
•Sexual orientation
•Sex life
•Information about your health
We may also process information about criminal convictions and offenses.
We may collect information in an exceptional situation (e.g. severe weather, local incident) to keep you and your household safe. To help manage a situation we will collect information recommended by:
•Government or government bodies/agencies
•Health professionals
•The Information Commissioner’s Office
•Other relevant organisations, depending on the situation
This list is not exhaustive. We process information so we can deliver services as a landlord/ managing agent. We will only process personal data that is appropriate to enable us to deliver these services.
Most of the personal data we process is provided to us directly by you for one of the following reasons:
•An application via Cumbria Choice Based Lettings
•To enter into a Tenancy/Leasehold/Shared Ownership agreement
•To enquire about or access services including repairs, housing management services, Right to Buy/Acquire or Mutual Exchange
•To register to “My Account”
•Tenant Involvement activities
•Resident Census
•Website forms
•Application forms
•Telephone calls
•Customer surveys
•Emails and letters
•Social media
We may also collect personal data via:
•The monitoring of our offices, buildings and neighbourhoods (CCTV)
•Website statistics/Cookies
•Other smart technology that may be installed in your home to enable the pro-active prevention and detection of damp and mould by monitoring humidity, temperature and CO2 levels
We may also collect personal data via third parties including:
•Suppliers/contractors who perform services on our behalf
•Those who provide information relevant to your housing circumstances (e.g. social workers and health professionals)
•Local authorities/ government agencies
•Police and other sources for the purpose of the prevention of crime, anti-money laundering or anti-fraud
•Partner organisations we work with such as Lune Valley Rural Housing Association and Broadacres Housing Association Limited
The table below sets out the type of personal data we collect, the purpose of collecting this data and the lawful basis for doing so:
| Purpose | Personal Data | Lawful Basis |
| To register you as a new customer | Identity and contact data | Contract (processing necessary to enter into a contract) |
| To deliver services to you including rent collection; meeting our obligations to you under UK law and our tenancy agreement with you; tenancy enforcement | Identity, contact, financial, transactional and behavioural personal data | Legal Obligation; Performance of a Contract; Legitimate Interest |
| To manage our relationship with you, collect information we are required to submit to the Regulator of Social Housing or improve our service offer. This includes carrying out customer surveys. | Identity, contact and profile data | Performance of a contract; Legal Obligation; Legitimate Interest |
| To administer and protect our business and our websites, electronic applications or similar electronic tools | Identity, contact and technical data | Legal obligation; Legitimate Interest (for running our business, provision of administration & IT services, network security) |
| To use data analytics to improve our website, customer relationships and experience. | Technical and usage data | Necessary for our legitimate interests (to keep our website updated and relevant, to develop our business and to inform our communications strategy) |
| To analyse customer data to enable performance reporting and enhance delivery of our services. This may include the use of AI tools but will not include automated decision making | Identity, transactional and behavioural data | Legitimate Interest (to enhance customer experience, performance monitoring and service development) |
| To make suggestions and recommendations to you about services which may be of interest to you | Identity, contact, technical, usage and profile data | Necessary for our legitimate interest (to develop our services and enhance customer experience) |
| CCTV footage | Identity data | Legitimate interest; Public Interest and Legal Obligation |
| Take photographs for use on our website, social media, or in other external communications | Identity data | Consent (you can withdraw your consent at any time) |
| Prevent crime, protect people and detect fraud | Identity data, behavioural data, transactional data | Legal Obligation |
Where the lawful basis for processing is the performance of a contract with you, if you do not provide relevant personal data, we will not be able to fulfil our contractual obligation(s) to you and this may have a detrimental impact on you.
We may process the following special categories of personal data (this list is not exhaustive)
| Special Category of Personal Data | Lawful Basis for processing | Example |
| Racial or ethnic origin | Explicit Consent (Article 9(a)); Manifestly made public by the data subject (Article 9(2)(e)); Legal claims and judicial acts (Article 9(2)(f)); Substantial public interest conditions (Article 9(2)(g)) | Monitoring for the purposes of equality, diversity and inclusion |
| Religious beliefs | Explicit Consent (Article 9(a)); Manifestly made public by the data subject (Article 9(2)(e)); Legal claims and judicial acts (Article 9(2)(f)) | Monitoring for the purposes of equality, diversity and inclusion |
| Health | Employment, social security and social protection law (Article 9(2)(b)); Manifestly made public by the data subject (Article 9(2)(e)); Explicit Consent (Article 9(a)); Legal claims and judicial acts (Article 9(2)(f)) | To ensure services can be delivered with reasonable adjustments to assist customers as required |
| Sex life | Substantial public interest conditions (Article 9(2)(g)); Legal claims and judicial acts (Article 9(2)(f)) | Duty to make a safeguarding referral if a person’s sexual activity endangered a child or vulnerable adult |
| Sexual orientation | Explicit Consent (Article 9(a)); Manifestly made public by the data subject (Article 9(2)(e)); Legal claims and judicial acts (Article 9(2)(f)) | Monitoring for the purposes of equality, diversity and inclusion |
Personal data relating to criminal offences and convictions is processed on the lawful basis of legal obligation, contract or public task in line with one of the conditions outlined within Schedule 1 of the Data Protection Act 2018. Common conditions relied upon include preventing fraud, safeguarding of children and individuals at risk, employment, social security and social protection.
We share personal data with our trusted third party contractors who need the information to complete work for us, this may include:
SLH holds a number of data processing agreements where we share information regularly with organisations; this ensures that data shared is processed in accordance with the law.
Examples of organisations we share information with include but is not limited to:
There are other circumstances where we may also be required to share information, for example to meet our legal obligations, in connection with legal proceedings or to protect the vital interests of an individual. Personal data is always shared securely and in accordance with our Data Protection and Privacy Policy.
SLH uses data processors including Survey Monkey, Google Analytics and Microsoft who transfer personal data outside the UK. In any circumstances where personal data is transferred internationally, we will make sure transfers are compliant with the UK GDPR and are covered by Adequacy Regulations or another appropriate safeguard.
We will keep your information for as long as we need it for the purpose for which it was collected and/or to comply with our legal obligations. This means that we may need to keep it after you stop using our services. We follow the National Housing Federation Data Retention Schedule and operate in line with our own Document Management Policy.
Under the UK GDPR you have the following rights concerning your data:
Your right to be informed
You have the right to be informed about:
Why we collect your information
Right of Access
You have the right to obtain confirmation from SLH as to whether personal data concerning you is being processed and, where that is the case, access to that data.
Right to Rectification
You have the right to oblige SLH to rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.
Right to Erasure
You have the right (under certain circumstances, but not all) to oblige SLH to erase personal data concerning you.
Right to Restriction of Processing
You have the right (under certain circumstances, but not all) to oblige SLH to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.
Right to Data Portability
You have the right (under certain circumstances, but not all) to oblige SLH to provide you with the personal data about you which you have provided to SLH in a structured, commonly used and machine-readable format. You also have a right to oblige SLH to transmit those data to another controller.
Right to Withdraw Consent
If the lawful basis for processing is consent, you have the right to withdraw that consent.
Right to Object to Direct Marketing
SLH does not use your data for direct marketing purposes so this right does not apply.
Rights in relation to automated decision making and profiling
SLH does not perform any automated decision-making based on personal data that produces legal effects or similarly affects you.
Your right to lodge a complaint with a supervisory authority
If you wish to exercise any of your rights concerning your personal data, you should contact SLH’s Data Protection Officer at the address shown in the ‘Contact Us’ section of this notice.
If you are not satisfied with the response you receive, you have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
(t) 0303 123 1113
While this privacy notice sets out a general summary of your legal rights in respect of personal data, this is a very complex area of law. More information about your legal rights can be found on the Information Commissioner’s website at https://ico.org.uk/for-the-public/
To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details set out in the ‘Contact us’ section of this notice.
SLH will review this notice on an annual basis or more frequently if warranted by changes in legislation or operations.
Where required by law, we will seek your consent to changes in the way we use your personal information.
In the event of any query or complaint in connection with the information we hold about you, the contact details for our Data Protection Officer are:
John Mansergh, Director of Business Improvement.
Bridge Mills Business Centre
Stramongate
Kendal
LA9 4BD
Phone Number: 0300 303 8540
