Privacy policy

Watford Community Housing is committed to protecting the privacy of, and information security relating to, our Data Subjects. The purpose of this Policy is to outline our approach to protecting the personal data we collect, process, hold and share as a Data Controller about our Data Subjects and how we communicate this to them.

We take our customers’ privacy seriously and are committed to protecting their information through a range of measures including policies and procedures which set out our approach to data protection and information security. We implement sufficient organisational and technical control measures to protect and safeguard all personal information under our control and keep up-to-date records of our processing activities, decisions taken about our processing activities and our privacy risk assessments. 

This Privacy Policy is a key component of our wider Information Security and Governance Framework incorporating our Data Protection and ICT Policy.

Legislative

General Data Protection Regulation (2018) 

Data Protection Act 2018 (together “Data Protection Law”)

Privacy and Electronic Communications Regulations (2003)

Regulatory

Regulator of Social Housing Governance and Viability Standard (para 1.1): “Registered providers shall ensure effective governance arrangements that...comply with all relevant law.”

Scope

This Policy covers the personal information we process about our various Data Subjects (as defined at section 3.2.2 below).

Definitions

Data Controller: a company, organisation or individual who can decide why and how they will process personal data; they will decide whether to collect the data in the first place, what to collect, whom to share it with and how long to keep it.  

Data Subject: the person the personal data is about. As a Group we have relationships with various Data Subjects including our tenants, leaseholders, shared owners, private market renters, staff, Board and Board Committee members, Gateway Membership Team, contractors and suppliers.

Watford Community Housing's Group Data Protection Officer (DPO): An independent data protection expert who advises on and monitors a Data Controller’s internal compliance with UK Data Protection Law and advises them about their obligations under it including through policy review and staff training/ awareness. They may act as the central point of contact for enquiries from the controller’s Data Subjects and can be contacted through the following email address: dpo@wcht.org.uk. 

Watford Community Housing Group Board:

Is responsible for the Group’s overall compliance with data protection law, the operational responsibility for which is delegated to the Audit & Risk Committee (ARC) (at Board level) and Executive Management Team (at Executive level).

Audit and Risk Committee:

Is the Group’s collective data protection champion, responsible for monitoring the Group’s overall compliance with Data Protection Law and relevant policies. As such it will approve key data protection policies for the Group and receive regular reports on compliance from the Deputy Chief Executive.

Executive Management Team:

Is responsible for the Group’s operational compliance with Data Protection Law and shall approve the main data protection policies for the Group.

Watford Community Housing Staff, Board and Board Committee Members:

Are responsible for following and upholding with this policy in their day to day work for the Group, including in terms of responding to a request made by any of our Data Subjects to provide our privacy policy or accompanying privacy information.

Deputy Chief Executive:

Is responsible for regularly updating ARC as to the Group’s data protection compliance including any actual or potential breaches of Data Protection Law under this Policy or otherwise.

Watford Community Housing Group's Data Protection Officer:

Our DPO’s role is to ensure that our customers’ privacy is respected and enforced through appropriate training and guidance to staff and the organisation as a whole.

Watford Community Housing maintains a register of all the personal information the organisation collects, holds, shares and otherwise processes about its various Data Subjects and how this occurs in the form of a Data Asset Register.

The Data Asset Register records how Watford Community Housing collects, stores and processes Personal Data for various purposes. Further information is set out in the Data Asset Register Policy & Procedure but in the main these purposes are as follows: 

Tenants

• Tenancy records to manage and support our various tenancies including where additional support is provided;
• Rent and service charge account information;
• Repair, maintenance and property adaptation records;
• Customer feedback and satisfaction;
• Records of tenancy changes (e.g. mutual exchange, succession or an application to purchase);
• Information about specific issues affecting our tenants/their household members (e.g. anti-social behaviour, safeguarding concerns, hoarding);
• Information about actual/suspected fraud;
• CCTV footage; and
• Information about our membership.

Leaseholders and Freeholders

• Information about the sale/purchase/assignment of a lease or its extension or about the sale of a freehold;
• Information relevant to a lessee’s mortgage or remortgage application;
• Information relevant to service/repairs/other charges;
• Rent review information.
• Information in connection with managing your business lease/tenancy.

Staff

• recruitment and administration records (e.g. performance / absence management and employee relations matters);
• contractual and other benefits (such as pension) information;
• payroll records and bank account information;
• family/next of kin information;
• nationality/immigration information and criminal background;
• driving licence/qualifications and insurance information; and
• information about personal characteristics (e.g. ethnic origin).

Contractors, Suppliers and Other Third Parties

• basic contact details and any other information they may share in routine correspondence with us.

General enquiries and other information received

This section relates to any information voluntarily sent by the Data Subject and not caught by any other section within this Policy. 

Watford Community Housing will process, store, retain and share personal information, where relevant and appropriate to do so for the purposes of responding to or managing any general enquiries or other information received, volunteered or sent to us by the data subject that is or may be connected to any of our activities.

Information received under this section will be processed, stored, retained or shared in accordance with your rights and our obligations as detailed with Data Protection Laws and the general principles contained within this Policy and our Data Protection Statements and Privacy Notice.

Under Data Protection Law Watford Community Housing is required to give the organisation’s Data Subjects certain information in order to make the processing of Personal Data relating to them fair and lawful.  

We provide this information under a ‘layered approach’ to ensure that we provide the information at more than one opportunity. We therefore provide this privacy information through the following types of documents:

• a Data Protection Statement confirming who Watford Community Housing is (i.e. as Data Controller in the relationship), briefly explaining why we are collecting the Personal Data we are collecting and referring the Data Subject to the more detailed Privacy Notice applicable to them for more information;
  
  
• A Privacy Notice (previously called a ‘fair processing notice’) relevant to that Data Subject which, as stated above, explains more about how we process their Personal Data and manage their rights under Data Protection Law. Our core Privacy Notice is our comprehensive ‘Your Privacy Matters’ booklet provided to tenants and Watford Community Housing members;
  
  
• A Privacy Policy is a documented statement reflecting Watford Community Housing’s approach to Privacy and Confidentiality and states the general principles by which Watford Community Housing will process personal information. This is similar in nature to a Privacy Notice but has a different role to play. The (internal facing) Privacy Policy informs and supports all employees in the compliant processing of information to maintain privacy and confidentiality matters. The (external facing) Website Privacy Policy is a public statement reflecting how we maintain privacy and confidential matters.

In line with the requirements of the General Data Protection Regulation, Watford Community Housing has issued new Privacy Notices to its various Data Subjects at specific points of their contact with us to ensure we have made our privacy policy readily available to them.

Data Subjects’ Information Requests

Watford Community Housing recognises the rights of Data Subjects to make a request for a copy of their personal data or for it to be erased, transferred to another organisation, to stop being processed or corrected in some way. Anyone wishing to exercise their rights protected under Data Protection Laws need to write to the Data Protection Officer following section 9 below. Watford Community Housing will respond to the request in accordance with the Information Rights Policy.

Website, Cookies and IP addresses

Watford Community Housing captures certain information from its website (www.wcht.org.uk) through the use of cookies and other technology. These are used to help us to understand and improve your experience when using our website. This section explains how we use our website, what our cookies are and how we use them.

When you access our website, you will receive a notification informing you that our website uses cookies along with an option of whether to browse using cookies along with a link to our Privacy Policy. You can choose not to use cookies by not accepting the option and still access our website without enabling the cookies.

You can find more information about cookies at http://www.allaboutcookies.org/.

IP Addresses

An Internet Protocol (IP) address is a set of numbers which is automatically assigned to a visitor’s computer whenever they log on to their internet service provider or through their organisation's computer network. Their computer is identified by the IP address assigned to it during their session on the Internet.

Watford Community Housing and/or third-party companies acting on its behalf may collect IP addresses for the purposes of systems administration and to audit the use and activity of the website.

Watford Community Housing do not link a visitor’s IP address to any other personal information that may be held about them. Therefore, the visitor to the website remains anonymous to us.

Cookies

Watford Community Housing’s website uses a technology called 'cookies'. Cookies are small computer text files placed in the visitor’s computer's memory by the computer which provides or 'hosts' the website. Cookies are not spyware or a computer virus but are used to make surfing the internet easier.

Session cookies

Watford Community Housing only use Session Cookies on its website for the purpose of maintaining the site, to improve functionality and delivery of the webpage on the device that you are viewing the webpage from. They can also be used to track the total number of visits to the website for the purpose of improving the services that we offer. 

Session cookies are temporary and are erased when you close your browser. They do not store any personal information about the visitor, their computer, visit or browsing history.

Google Analytics

Watford Community Housing uses Google Analytics for our website, that also uses first party cookies, to improve the performance and user experience on our website and for our own marketing purposes to enhance the content on the site. These cookies use information in aggregate form and uses the minimum default rather than recommended settings. This is to ensure that the minimum amount of information is received by Google and an approach taken to maximise your privacy protection. 

Google stores cookie information on servers located in the United State and does not associate your IP address with any other date held by Google. 

Cookie management

Visitors to the website have the ability to accept or decline cookies. By default all cookies are disabled. By accepting the cookies, you consent to the processing of data about you by Watford Community Housing and Google Analytics for the purposes set out above.

You also have the ability to accept or decline cookies through your internet browser software and can modify these settings to accept, decline and remove cookies if you prefer. Please refer to your Internet browser’s instructions or help screen to learn more about these functions.

Other privacy matters relating to the website

Personal information is captured through the website when visitors voluntarily submit information about themselves, for instance when they submit a CV or a request for further information. This information is only used for the specific purpose for which it is submitted for.

Watford Community Housing’s website may provide links to third party websites as a service to our users. The privacy statement described in this Policy does not apply to those sites. Users should ensure they check the legal and privacy statement posted on each site they may link to.

We may occasionally update the privacy statements set out within this Policy. We encourage visitors to periodically review the statement to stay informed about how we are helping to protect the information we collect. Visitors’ continued use of the website constitutes their agreement to the privacy statement and any updates thereto.

If you feel that our handling of your Personal Data under this Policy and/or that your right to privacy has been compromised, you should contact our Data Protection Officer (DPO) care of our head office address (Watford Community Housing, Gateway House, 59 Clarendon Road, Watford WD17 1LA).

If you are not satisfied with the response from WCH or on its behalf, you have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is the:

Information Commissioner's Office - 0303 123 1113

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF