We are the data controller, and we are registered with the Information Commissioner’s Office (ICO) (Registration Number: Z5515259).

We are an exempt charitable housing association.  

We are incorporated under the Industrial and Provident Societies Act 1965 (Registration number IP16791R) and under the Housing and Regeneration Act 2008 (Number L0055).  

Housing 21 is also a registered society under the Co-operative and Community Benefit Societies Act 2014.

Our postal address is:

Housing 21 
Tricorn House 
51-53 Hagley Road
Birmingham 
B16 8TP

Our Data Protection Officer is Sonia Hawley.

If you have any questions about the administration of your personal information, please contact the Data Protection Officer:

• on 0300 790 1325
• by sending an email 
• or at the postal address:

Data Protection Officer (DPO)
Housing 21
Tricorn House
51-53 Hagley Road
Birmingham
B16 8TP

This privacy notice tells you what to expect when Housing 21 collects your personal information. 

It is important that you read this notice, together with any other privacy notice(s) we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information, such as:

• Employee Privacy Notice
• Resident Privacy Notice
• Artificial Intelligence Privacy Notice 

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You have been through the application and/or recruitment process. 
• You have signed up to a tenancy agreement.
• You have signed a contract of employment.
• You have made a complaint or enquiry to us.
• You have made an information request to us.
• You wish to attend, or have attended, an event.
• You visit our website and consent to our use of cookies.
• You have agreed to a DBS check.
• You have applied for support funds such as the Helping Hands Fund
• You have sought guidance / supporting applications for additional benefits for non-means tested benefits
• You have provided your bank details for direct debit purposes (e.g. rent payment0

We may also receive personal information indirectly, in the following scenarios:

• Your personal information is contained in reports of breaches of data protection law (‘breach reports’) given to us by individuals or organisations.
• A complainant refers to you in their complaint correspondence.
•  From an individual submitting a data subject access request.
• Whistleblowers include information about you in their reporting to us.
• We have collated evidence which contains personal information as part of an investigation.
• From public authorities, regulators, or law enforcement bodies.
• Where you have made your contact information available on our website, intranet or social media accounts.
• An employee of ours gives your contact details as an emergency contact or a referee.
• A resident of ours gives your contact details as Next of Kin.
• You are confirmed as a Power of Attorney for one of our residents. 

If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal information. 

Housing 21 complies with the UK General Data Protection Regulation (GDPR) 2018 and the Data Protection Act 2018 (DPA18) in relation to the personal information that you provide us and ensures that it is not misused. The DPA18 together with the UKGDPR defines a set of rights we need to make you aware of.  The rights available to you depend upon our reason for processing your information: 

Your right of access

Housing 21 recognises its responsibility for protecting the privacy of your personal information. You have a legal right to see the personal information we hold about you; this is called a subject access request and by law we have 30 calendar days to respond to you.  

We will seek to comply with your request however there may be some circumstances where it may not be possible to comply with your request fully, i.e., we may refuse or charge for requests that are manifestly unfounded or excessive. If your request is refused, we will write to you within 30 calendar days to advise you why, you will then have the right to complain to the supervisory authority and to seek a judicial remedy. 

If you wish to submit a subject access request, please contact the Data Protection Officer (DPO) 

Your right to rectification

You have the right to have inaccurate and incomplete information about you rectified and completed.

Your right to erasure (right to be forgotten)

You have the right to have the information we hold on you deleted where the use of that information would no longer meet the requirements of the UK General Data Protection Regulation or the Data Protection Act 2018.  Once the request is made, the information must be deleted within 1 month.

Where the information in question has been made public or transferred to a third party, we must also take reasonable steps to inform those third parties about the request for deletion including any links to, or copies of that personal information.  

The above does not apply when it is necessary to keep the information in relation to legal proceedings, to comply with a statutory obligation, or to perform tasks in the public interest.

Your right to object to processing

In certain circumstances, you have the right to object to your personal information being processed.  Depending on the legal basis for processing, this may either be an absolute right (i.e., direct communications), or may be subject to us being able to demonstrate compelling legitimate grounds which would override your own interests, or where the information is needed for the purpose of legal claims.

Your right to the restriction or processing

You have the right to request that information is no longer processed (other than it being stored) in particular circumstances, such as when we are dealing with the correction of any inaccurate information; the processing is unlawful, but you object to its erasure; or the information is no longer needed but you require the information to be kept for the purposes of a legal claim.

Your right to data portability

When processing your personal information to fulfil a contract to which you are a party, you have the right to request electronically held personal information to enable easy transfer to another organisation. Where it is technically feasible you may request that the information be transferred directly between organisations. Once the request is made, the information should be provided to you within 1 month (30 calendar days).

Where we are relying on consent to process your personal data, you have the right to withdraw consent at any time, so long as, the information is not part of a statutory or contractual requirement/obligation.

However, this will not affect the lawfulness of any processing carried out before you withdrew your consent.  We would like you to be aware that this may affect the quality of service we can provide to you. For example, we need to know the composition of your family so that we can allocate a suitably sized property to you. 

You have the right to object to direct communications from us, this may include post repair surveys, tenant satisfaction questionnaires, tenant profiling. To withdraw consent at any time, please contact the Data Protection Officer

We will not share your information with any third parties for the purposes of direct marketing.

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us.

They will hold it securely and retain it for the period we instruct. When it is necessary for us to transfer your personal information outside of the UK this will only be done in accordance with the UK GDPR. 

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.  We do not allow our third-party providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions as part of a contractual obligation. 

In some circumstances we may need to share information without your consent to comply with any legal obligation or to fulfil the purposes for which it was submitted.  For example, to process Housing Benefit payments and to liaise with your respective local authority to manage your rent service charges.    

Personal data may be contained within documents uploaded onto AI Tools used by Housing 21. Where this is the case, we are the data controller, and our approved AI supplier/contractor is the data processor. We have carried out the appropriate due diligence with each supplier/contractor (‘Processor’) to ensure that your personal data is protected, when processed with the use of the AI Tools, in accordance with the UK GDPR and our various information governance data protection and IT security policies.

None of your personal data will be used solely by the AI technology provider to improve their AI products. For full details please refer to our Artificial Intelligence (AI) Privacy Notice .

We work to high standards when it comes to processing your personal information.

If you have queries or concerns, please email us or you can call us at 0303 123 1622 or in writing to:

Freepost RTJE-LEHY-SGLJ
Housing 21 Complaints
Tricorn House
51-53 Hagley Road
Birmingham B16 8TP

and we will respond.

For data protection-related complaints please send us an email

If you remain dissatisfied, you can make a complaint to the Information Commissioner’s (ICO) Office if you think there is a problem with the way in which Housing 21 are handling your information.  

To contact the ICO, please call 0303 123 1113 or visit their website. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

The personal information you provide us with will be retained only for as long as necessary to fulfil the purposes for which it was collected or as required by law.

We do not share personal information with third parties except as necessary to carry out our business or as required by law or other legal processes, and we never sell your personal information or pass it to marketing companies. Personal information collected by us may be transferred to other wholly owned subsidiary companies where it is necessary to meet the purpose for which it was submitted. 

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances: 

1. Where we need to perform the contract, we have entered into with you. 
2. Where we need to comply with a legal obligation. 
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 

We may also use your personal information in the following situations, which are likely to be rare: 

1. Where we need to protect your interests (or someone else’s interests). 
2. Where it is needed in the public interest or for official purposes.

The information we hold on our records concerns our relationship with you. For example: 

• We hold names, addresses, email addresses, dates of birth, photographic ID, and information about your previous housing circumstances to assess housing applications and help prevent tenancy fraud.
• We hold contact details for you, such as postal address, telephone number and email address, so we can communicate with you by your preferred means, and keep you informed about services we offer which may be useful to you. 
• We record information about your needs, including care this is considered sensitive personal data, (for example if you have a carer or social worker; if you need adaptations in your home; if you need large print or translated text) to ensure that we take account of any support needs in our dealings with you, and to improve our communications with you. 
• We record information to enable us to provide housing management services. For example, we record reports of anti-social behaviour; complaints; change in circumstances and information about housing options (e.g. if you have a medical need which means you need to move).
• We keep financial records about the amount of money you have paid us; any amount(s) outstanding and action taken to recover money you owe. 
• We may hold information about you if you are engaged with our additional guidance and support services. For example, in connection with access to training and employment we may hold information about your job history and skills and experience, or if we support you to improve your financial circumstances, we may hold information about your household income and expenditure. 
• We may capture your image on our CCTV systems if you visit a property, office or court which is covered by this facility. Any CCTV recordings will be held in accordance with our document retention policy before being erased. 
• We record the findings of surveys and other research to help us improve our service to customers. The information you provide will be anonymous unless you agree that we can use your details. 
• Where applicable, we will use the personal data you have provided us to help us to support your Local Authority to administer and manage your Housing Benefit.
• We may also conduct voluntary, surveys to monitor our equality and diversity profile ‘equality profiling data’, to ensure our services are delivered in a fair and equitable way and to better understand the demographics of our residents and employees to ensure they are representative of the communities we work in.

We hold robust records of most of the contact we have with you, or about you, and we process this information so we can deliver services to you, generally, the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you).  However, we may also hold information provided by third parties where this is relevant to your housing circumstances e.g. from social workers and health professionals (such as doctors, carers, and occupational therapists). 

We will only ask for personal information that is appropriate to enable us to deliver services to you.  In some cases you can refuse to provide your details if you deem a request to be inappropriate. 

However, it is important to note that where you refuse to provide information, in the performance of your tenancy agreement with us, it may impact upon our ability to provide certain services to you.

We need all the categories of information listed in this notice, primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below:

• Making a decision about your tenancy agreement/contract of employment 
• Dealing with legal disputes involving you, or other residents, employees, workers, and contractors, including accidents at work
• Complying with health and safety obligations 
• For the prevention and detection of fraud and apprehension and prosecution of offenders
• Managing your rent including, where applicable, liaising with your respective local authority to administer and manager your Housing Benefit. 

Some of the above grounds for processing your personal information may overlap and there may be several grounds which justify our use of your personal information.

We strive to provide you with choices regarding certain personal data uses, particularly around communications and advertising.  We have established the following personal data control mechanisms:

• Within Property Sales and Lettings – we process data using consent (where necessary), legitimate interests or a contractual obligation as a legal basis to process your data in the following instances:
  
  • Online Enquiry Forms
  • General Sales Enquiries via email or telephone
  • Corporate Enquiries via email or telephone
  • Enquiries in writing
  • Enquiries via the telephone
• Within the Communications Team – we process data using consent (where necessary), legitimate interests or a contractual obligation as a legal basis to process your data in the following instances:
  • Conference participants
  • Resident information
  • Survey participation (such as the Tenant Satisfaction Survey)
     

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you, but only where you have opted into this service, such as the Helping Hands Fund or Employee Benefits. This is how we decide which products, services and offers may be relevant for you.
 
You will receive communications from us if you have requested information from us only, or have received services from us and, in each case; we will only share this information with you where you have consented to receiving that communication. This also applies when you have expressed an interest in one of our properties and consented to Housing 21 keeping you on a waiting list and/or sharing details of similar properties which may of interest to you. 

We will never share your personal data with a third party outside of Housing 21 without your express opt-in consent.

You can ask us or our approved third party service providers to stop sending you communications at any time by contacting the Communications Team  or the Data Protection Officer (DPO)  
 
Where you opt out of receiving these messages, this will not apply to personal data provided to us as a result of a service or other transactions, such as signing up to a tenancy agreement or contract of employment.

We have a Document Retention Policy and Procedure and Retention Schedule in place, which outlines how long we keep different types of information for.

This is underpinned by legislative and regulatory compliance requirements.  This policy is formally reviewed every two years and is based around good practice guidance issued by the National Housing Federation and any regulatory or legislative updates.

We collect various types of information from visitors to our websites. 

We do not pass on any personal information you have given us to any other site, the system will record information if volunteered to us by you, for example on the online forms. This will be treated as confidential. 

Our website contains links to other websites of other organisations. This privacy notice applies only to our site. If you move to another site that collects information, we encourage you to read the privacy notices on the other websites you visit.

Our website uses cookies to track visitors via Google Analytics. Cookies that are necessary for functionality, security and accessibility are set and are not deleted. For more information about the cookies we use, please see Housing 21 - Cookie policy.  

Housing 21 website is hosted and supported by vetted third party Spindogs.

Housing 21 website search and decision notice search is powered by Spindogs. Search queries and results are logged anonymously to help us improve our website and search functionality. No identifiable personal information is collected by us or Spindogs.

All necessary security controls are in place to intercept, analyse and restrict malicious intent or traffic such as (but not limited to): Network addresses, IP addresses, or any other web-based identifier.

We host our website within Microsoft Azure in the UK and keep associated information for 12 months or no longer than is necessary.

We use Spindogs to develop and support our website and digital services. They may have access to the personal data you share with us via our website, but only where this is necessary for them to provide us with this support.

The purpose for implementing the above is to maintain and monitor the performance of our website and to constantly look to improve the site and the services it offers to our users. The lawful basis we rely on to process your personal data is either Article 6(1)(a) of the UK GDPR, for example when we require your consent for the optional cookies we use, or Article 6(1)(f) which allows us to process personal data when it’s necessary for our legitimate interests. For example in order to maintain the integrity of our IT systems and the continuity of our business.

As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

We meet visitors at our head office, including:

• external training providers;
• job applicants;
• suppliers and trades people;
• stakeholders; and
• organisations we may be interviewing about their processing or entering into a contract.

If your visit is planned, we will send your name and visit information to reception before your visit, so that we can prepare a visitor badge for your arrival.

If you arrive without an appointment, you will also be given a visitor badge and required to sign in and confirm who you are visiting.

You must wear a pass throughout your visit. If a personalised badge is issued it will be destroyed when you leave the premises.

We ask all visitors to sign in and out at reception and confirm who they are meeting. This is for verification purposes only.

Closed-circuit television (CCTV) operates within our office space for security purposes. The information is viewable by us on a live feed and auto wiped every 30-90 days. We do not retain this information unless necessary for a legal obligation. 

The purpose for processing this information is for security and safety reasons. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests. 

We have Wi-Fi on site for the use of visitors. We can provide you with the address and password.
We record the device address and will automatically allocate you an IP address whilst on site. We also log traffic information in the form of sites visited duration and date sent/received.
We do not ask you to agree to terms, just to the fact that we have no responsibility or control over your use of the internet while you are on site, and we don’t ask you to provide any of your information to get this service.

The purpose for processing this information is to provide you with access to the internet whilst visiting our site. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests. We use a data processor.

We may record audio and video of training sessions delivered by external training providers for distribution to employees not in attendance. We do not do this without the prior agreement of the training provider and no recordings are shared outside of Housing 21. 

We may ask visitors to our schemes to show some form of ID, but this will not be recorded anywhere and is purely for ID verification.

Any CCTV used inside, or outside Tricorn House (unless occupied by Housing 21) is not operated by us, so we are not the controller. It will be under the control of the relevant building landlord.

We have visitors at our schemes, including:

• residents friends and family;
• carers;
• external training providers;
• job applicants;
•  suppliers and trades people;
• stakeholders; and
• organisations we may be interviewing about their processing or entering into a contract 

Closed-circuit television (CCTV) operates within some of our schemes for security purposes. Where this is the case clear signage is displayed. The information is viewable by us on a live feed and auto wiped every 30-90 days. We do not retain this information unless necessary for a legal obligation. 

The purpose for processing this information is for security and safety reasons. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests. 

We may ask visitors to sign in and out at reception and confirm who they are meeting. This is for verification purposes only. 

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose which is compatible with the original purpose.
 
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do this.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law, such as for the prevention and detection of fraud and/or the apprehension and prosecution of offenders. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

It is important that the personal data we hold about you is accurate and current.  Please keep us informed if your personal data changes during your relationship with us.

We keep our privacy notice under regular annual review and will place any updates on our website; you will be notified of any major changes to this notice.