Privacy

Identity and contact details of Controller

Southern Housing is a Housing Association and is a controller of personal information for the purposes of the UK-General Data Protection Regulation (‘UK-GDPR’)^[1] and Data Protection Act 2018.  Our contact details for data protection purposes are as follows:

Data Protection Officer
Southern Housing
Fleet House
59-61 Clerkenwell Road
Farringdon
London
EC1M 5LA

Email: data.protection@southernhousing.org.uk

Southern Housing is registered with the Information Commissioners Office as a Data Controller registration number ZB498286.  

Under the UK-GDPR Southern Housing has a legal duty to protect any information we collect from you or have about you from other sources.

The UK-GDPR has a set of rules and guidelines we must follow when handling your information.  These are referred to as Data Protection Principles.

How we use and store your personal information

This privacy notice tells you what to expect when Southern Housing collects and stores personal and sensitive information. It tells you the purposes for which we will process your personal information and the legal basis for the processing (‘processing’ includes us keeping your personal information). 

How we collect your information

We collect most of our information directly from you, including when you apply for one of our properties or services, complete one of our forms, when you write, email or meet with us, or respond to a survey. We may also process information that you post on social media about us if it relates to a situation that we need to be aware of and/or take action on.

Most information we hold will be collected from you directly, however we may from time to time collect information from third parties such GPs, social workers, members of your family, courts, police, social services, mental health teams, neighbours, members of the public, employers, the National Anti-Fraud Network and other agencies.

What information do we collect?

The personal information we collect will depend on our relationship with you and the services we are providing.  We will only collect the information necessary to fulfil our obligations to you and in accordance with the legal bases set out below.

For residents we will collect detailed personal information about you and other household members, including contact details, age, sex, date of birth, ethnicity, income, National Insurance number, income and benefits details, employment status, gender identity, relationship status, any disabilities, any communication and accessibility requirements, religion, sexuality, nationality, caring responsibilities, access to financial services such as banks and credit unions, bank details, benefits, council tax, medical information, details of any unspent criminal convictions.

Why do we collect personal information?

Residents or occupants of our homes

During your tenancy we will collect and process information about you and members of your household.

We do this to:

• Assist in letting a home or property to you. (lawful basis: contractual)
• Manage your tenancy agreement and the Southern Home Property it relates to (lawful basis: contractual)
• Provide property maintenance services, billing and collection of rent (lawful basis: contractual)
• Help prevent fraud (lawful basis: legal obligation)
• Conduct a yearly gas safety check (lawful basis: contractual)
• Manage complaints, instances of anti-social behaviour and safeguarding issues (lawful basis: contractual, legal obligation)
• Conduct statutory safety checks (lawful basis: legal obligation)
• Monitor, identify and deliver support for special needs to you or any member of your household including financial advice and wellbeing support (lawful basis: contractual, consent)
• Facilitate tenancy transfers (lawful basis: contractual)
• Process insurance claims, and council enquiries (lawful basis: legal obligation, contractual)
• Provide and assist in mutual exchanges (lawful basis: contractual)
• Consult with you about service improvements (lawful basis: legitimate interest)
• Share information with other agencies where we have your agreement or another legal basis (lawful basis: legal obligation, contractual or consent)
• Conduct transactional surveys, research or analysis in order to monitor and improve our services, for example repairs and maintenance, complaints, lettings, anti-social behaviour issues and training (lawful basis: legitimate interest)
• Monitor anonymised Equality and Diversity statistics (lawful basis: legitimate interest)
• Provide information about our performance and services through newsletters (lawful basis: legitimate interest)
• Provide information about additional services we offer, including opportunities to participate in meetings, training and events (lawful basis: consent).

Unless we advise you otherwise, we’ll only collect and process personal information to carry out these functions.

Personal information is stored on our computer systems.  It is held securely and we have security measures in place to protect it.  

Students and Keyworkers

During your occupancy of our student and keyworker accommodation we will collect and process information about you.

We do this to:

• Manage your residence and the Southern Housing property it relates to (lawful basis: contractual)
• Monitor compliance with the terms of your licence agreement (lawful basis: contractual, legal)
• Share information with other agencies where we have your agreement or another legal basis (lawful basis: contractual, legal)
• Conduct transactional surveys in order to monitor and improve our services, for example repairs and maintenance, complaints and anti-social behaviour issues (lawful basis: legal, legitimate interest)
• Monitor Equality and Diversity (lawful basis: legitimate interest)
• Provide information about our performance and services through newsletters (lawful basis: legitimate interest)
• Comply with our safeguarding duties (lawful basis: legal)

Unless we advise you otherwise, we’ll only collect and process personal information to carry out these functions.

Personal information is stored on our computer systems in line with our retention periods. It is held securely and we have security measures in place to protect it.  

Leaseholders, Outright and Shared Owners

During the provision of our services to you we will collect and process information about you and members of your household.

We do this to:

• Assist you in looking for private sales and shared ownership properties (lawful basis: contractual obligation)
• Manage and uphold our contract with you and comply with our legal obligations (lawful basis: contractual obligation)
• Manage your tenancy and/or lease including the collection of rent, management of rent arrears and service charge, validate your right to rent, assess whether the home is affordable for you and to respond to any queries or problems which you may have (lawful basis: contractual obligation)
• Manage and respond to repairs (lawful basis: contractual obligation)
• Help protect and safeguard you (lawful basis: contractual obligation/vital interest)
• Provide consultation on estimated cost of works for statutory purposes (lawful basis: contractual obligation)
• Verify customer satisfaction through surveys following work carried out on repairs and emergency response repairs (lawful basis: legitimate interest)
• Carry out work on defect repairs and inspections (lawful basis: contractual obligation)
• Conduct a stock condition survey (lawful basis: legal obligation)
• Manage your service charge and rent arrears (lawful basis: contractual obligation)
• Conduct a yearly gas safety check (lawful basis: legal obligation)
• Perform a lease extension (lawful basis: contractual obligation)
• Manage your staircasing requests if made (lawful basis: contractual obligation)
• Facilitate the resale of a property (lawful basis: contractual obligation)

Supported Residents

During the provision of our services to you we will collect and process information about you and members of your household.

We do this to:

• Provide care, support and assistance to customers and residents (lawful basis: contractual obligation/vital interest)
• Help them maintain their home and independence (lawful basis: legal obligation)
• Meet our regulatory and contractual requirements (lawful basis: contractual obligation/legal obligation)

Unless we advise you otherwise, we’ll only collect and process personal information to carry out these functions.

Personal information is stored on our computer systems and / or a tenancy file in line with our retention periods. It is held securely and we have security measures in place to protect it.  

Private rental customers

During the provision of our services to you we will collect and process information about you and members of your household.

We do this to:

• Assist you to find and/or rent a private property (Lawful Basis: Contractual)
• Manage your tenancy including the collection of rent, deposits and managing rent arrears. (Lawful Basis: Contractual)
• Validate your right to rent, assess the affordability of the property and your suitability to rent from us. (Lawful Basis: Contractual)
• Create or renew contracts and/or agreements. (Lawful Basis: Contractual)
• Conduct rent reviews (Lawful Basis: Contractual)
• Conduct property inspections including inventory checks and to arrange for maintenance and repairs work to be completed. (Lawful Basis: Contractual)
  
  

Community Investment/Social Impact

During the provision of our services to you we will collect and process information about you.

We do this to:

• Help you improve your financial situation and/or find work. (Lawful Basis: Legitimate Interest)
• Provide you with any required support and to manage your support cases.(Lawful Basis: Contractual, Legal Obligation depending on scenario)
• Provide hall management (Lawful Basis: Contractual)
• Allow for volunteer sign up and volunteer exiting. (Lawful Basis: Contractual)
• Assist in providing work placement opportunities. (Lawful Basis: Contractual)
• Make you aware of any useful opportunities in your area such as sessions on employment advice. (Lawful Basis: Legitimate Interest)

 

Contractors, Suppliers, Partners or Agents

We will collect relevant information from you in accordance with our contracts or information sharing agreements.  This may include names and qualification information relating to your employees.  The purpose is to enable you to provide services to our residents on behalf of Southern Housing.

Information will be held centrally by our Procurement Team on our computer system and by the relevant team/department in line with our retention periods.  It is held securely and we have security measures in place to protect it.

Board Members and Resident Governance Members

Throughout your appointment as a Board and/or Committee member we will collect and process personal information about you.  We do this to:

• Contact you in relation to your role as a Board or Committee Member (lawful basis: legitimate interest, contractual)
• Monitor compliance with the terms of your Agreement for Services, Terms of Appointment (lawful basis: legitimate interest, legal obligation)
• Deliver tailored training and support (lawful basis: legitimate interest)
• Provide information to third parties for legal and regulatory purposes e.g. Financial Conduct Authority, Regulator for Social Housing, Companies House and lenders (lawful basis: legal obligation)
• Monitor Equality and Diversity (the information provided is anonymised and used only for statistical monitoring purposes which help us make improvements)

Information is held centrally by our Governance Team on our computer system and relevant contact information is held by individual teams in line with our retention periods.  It is held securely and we have security measures in place to protect it.

Applicants and Employees

We have a separate Privacy Notice for applicants and employees containing further information.  These Notices will be provided to you at the start of the recruitment process and when you sign your employment contract.  Please contact data.protection@southernhousing.org.uk for a copy of these notices. 

Children

We may process information relating to children in our households where it has been provided to us during our relationship with you. In such cases, we process that information based on our legitimate interests and to fulfil our legal and regulatory obligations.

Special category data

"Special categories" of particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation or trade union membership, require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in one or more of the following circumstances:

• In limited circumstances, with your explicit written consent
• Where we need to carry out our legal obligations e.g. to safeguard your and others’ wellbeing and safety in our accommodation
• Where there are reasons of substantial public interest (with a basis in law)
• Where it is needed in relation to legal claims
• Where it is needed to protect your vital interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public (e.g. if you are unwell and we need to inform a third party so that they may provide you with treatment).

We do not need your consent if we use special categories of your personal information in accordance with our appropriate policy document. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data, but we are not required to obtain consent for all special category data we process. If we do ask for consent, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

Information about criminal convictions

We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy.

We may hold information about criminal convictions or alleged criminal offences.

We will only collect information about criminal convictions and alleged criminal offences if it is appropriate given the nature of the offence, your contract with us and where we are legally able to do so. We will use information about criminal convictions and offences in the following ways:

• To assess whether it is appropriate for us to provide you or continue to provide you with accommodation.
• To report incidents to third parties such as a University, law enforcement or other agencies.

We are allowed to use your personal information in this way where it is in the substantial public interest. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

How we manage your personal information

We process your personal information in accordance with the principles of UK-GDPR and Data Protection Act 2018. 

We will treat your personal information fairly and lawfully and we will ensure that information is:

• Processed for limited purposes;
• Kept up-to-date, accurate, relevant and not excessive;
• Not kept longer than is necessary;
• Kept secure.

Data integrity and security

We take our data protection responsibilities seriously and want to keep you informed about how we use your data. As such:

• Southern Housing maintains policies and procedures to ensure information is secure when stored and used internally, or when sharing data with a third party, including our information security policy, data breach procedure, and procurement and contracting procedures.
• Personal data is only shared with other organisations or agencies under appropriate contractual arrangements, or with an individual’s consent, unless there are exceptional circumstances.
• Southern Housing requires third parties to have adequate organisational and technological security measures in place to ensure data integrity and confidentiality.
• Southern Housing regularly trains all employees in their responsibilities in relation to data protection and security of data, to ensure high levels of awareness and understanding amongst employees.
• Southern Housing verifies the identity of all customers and their designated representatives when they contact us.
• We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so.  
• Southern Housing has a clear procedure to follow if a data breach is suspected or occurs, which ensures the appropriate steps to notify the ICO, inform the data subject and work to manage the consequences of any breach take place in a timely way.
• Wherever possible we use anonymised data (where you can no longer be identified as an individual). In this instance, the data no longer falls within the scope of UK GDPR (2021) and the DPA (2018)

• Southern Housing servers and our databases are protected by industry standard security technology, such as network address translation and password protection.

We strive to maintain the reliability, accuracy, completeness and currency of personal data in our databases and to protect the privacy and security of our databases.

We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate. 

Who might we share your personal information with?

Normally, only Southern Housing employees will be able to see and process your personal information. However, there will be times when we will need to share personal information with third parties for the purposes as outlined or where we are legally required to do so, for example:

• Utility Companies
• Local Authorities
• Social Services
• Debt Collection Agencies
• Benefit Agencies
• Repairs Contractors and Sub-Contractors
• Health Care Providers (e.g. Occupational Therapists, GP Services)
• Previous Landlords
• Emergency Services
• Estate Agents (e.g. Rightmove, HomeSwapper),
• Employment Check Services, Insurance and Claims Control Companies Data
• Storage Warehouses (e.g. Restore, Iron Mountain)
• Information Technology Support Services (e.g Microsoft)
• Out of hours service

 

And any other company or organisation who you would reasonably expect us to

share information with. 

When sharing personal information, we will comply with all aspects of the UK-GDPR.  We do not rely on consent to share your personal data, including special category data unless we specifically ask for it.

We share information:

• To allow us to tailor our services to you
• For detecting possible fraud (e.g. as part of the National Fraud Initiative)
• To deal with rent arrears (e.g. tracing and/or debt collection agencies)
• To deal with unpaid bills, e.g. utility or council tax bills - we may need to pass on your forwarding address
• To help us communicate with you (e.g. we sometimes use external printers, translators etc.)
• To safeguard your health and wellbeing and that of others in our accommodation and our employees
• To assist the Police in solving crime and investigating anti-social behaviour.
• Where required to do so, by law or any Government body.

If your accommodation is linked to your study at a particular school, college or university we may share your personal data, including special category data with that organisation. For example, if we need to establish whether you are enrolled on a course or where a university has safeguarding concerns and they ask us to help.  We would do this in line with our Safeguarding Policy.

As part of the government's reform of welfare benefits, they've introduced new regulations on information sharing.  This means we can now share limited information about our residents and their properties with local authorities.  For example name, address, age and number of bedrooms per property.  

Southern Housing contracts external companies to manage certain areas of our business, to fulfil our obligations as a landlord.  We share limited personal information of our residents with external contractors.  Such as name, address and telephone number.  

Examples include:

• Repairs and maintenance contractors
• Out of hours call centre service
• Health and safety and compliance checks (e.g. gas and electric servicing, lifts, asbestos, legionella).

We’ll only share the minimum information necessary for the contractor to carry out their services on behalf of Southern Housing.  If you have any concerns about a company operating on behalf of Southern Housing, or information that’s been shared with an external company, please contact us using the details below.

We’ll never sell personal information to a third party.
 
How long do we keep information?

We have a document retention schedule which sets out how long we keep different types of information. We follow legal requirements and best practice.

Please contact us if you’d like a copy of the schedule.

Fraud detection

We may use data disclosed to us for the purpose of preventing and detecting fraud. 

Any personal data disclosed may be used for the purpose of preventing and detecting fraud.  This includes information provided on the Southern Housing website, on the online resident portal area, or in any other way provided to us online or not.

The data collected may be used for the purpose of data matching and for further investigations.  This involves comparing the data we hold on you with that held by third parties solely for the purpose of detecting and preventing fraud.  We might also use your data to further investigate fraud that we think might have been committed. 

This involves checking with various third parties, such as the Land Registry, banks, schools and utility companies.  

Use of CCTV

Southern Housing uses CCTV across our offices and developments and some of our vehicles have dashboard cameras which may capture footage of pedestrians and other vehicles while in use. 

We use CCTV for the following purposes:

• Prevent or detect crime
  • Identify and prosecute offenders
  • Prevent and tackle anti-social behaviour
  • Protect our employees
  • Protect our homes, offices, and assets
  • Improve personal safety and reduce the fear of crime.

There are signs in place to inform you where cameras are in use. Data is held in accordance with our Retention Schedule. Further information can be found in our CCTV Policy. 

Our legal basis for processing personal data captured on CCTV is: 

• that it is necessary to meet a legal obligation
• that it is necessary to perform tasks in the public interest
• that it is necessary to meet a contractual obligation
• that we have a legitimate interest in processing this information

Occasionally our cameras may capture special category personal data.  Our basis for processing special category personal data is: 

• there is a substantial public interest in processing this information, for the purposes of detecting and preventing crime

You can exercise your individual rights under the GDPR in relation to CCTV, including making a Subject Access Request for a copy of your personal data.  Please see the ‘your rights under the UK-GDPR’ section below. 

We will provide copies of CCTV recordings to third parties (e.g. Police and Insurance Companies) where we have an appropriate lawful basis to do so.

Your rights under the UK-GDPR

You have a number of rights under the UK-GDPR:

Access to personal information

Under the UK-GDPR, you have a right to ask us what personal information we hold about you, and to request a copy of your information.  This is known as a ‘subject access request’ (SAR). 

To make a Subject Access Request please email us at data.protection@southernhousing.org.uk or phone us on 0800 121 60 60.

We encourage individuals to use our Subject Access Request form which provides further information to help you to submit your request.  We may also request two forms of identification to verify your identity.

We will respond to your request with all the information we’re legally required to provide within the legal timescales.

Your right to certain information may be restricted. For example, information relating to a third person or information relating to a police investigation.

Rectification

If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting  customer services at 0800 121 60 60.

Erasure (‘right to be forgotten’)

You have the right to ask us to delete personal information we hold about you.  You can do this where:

• The information is no longer necessary in relation to the purpose for which we originally collected/processed it
• You withdraw consent
• You object to the processing and there is no overriding legitimate interest for us continuing the processing
• We unlawfully processed the information
• The personal information has to be erased in order to comply with a legal obligation

We can refuse to erase your personal information where the personal information is processed for the following reasons:

• To exercise the right of freedom of expression and information;
• To enable functions designed to protect the public to be achieved e.g. government or regulatory functions
• To comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
• For public health purposes in the public interest;
• Archiving purposes in the public interest, scientific research historical research or statistical purposes;
• The exercise or defence of legal claims; or
• Where we have an overriding legitimate interest for continuing with the processing

Restriction on processing

You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

• You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
• You challenge whether we have a legitimate interest in using the information
• If the processing is a breach of the UK-GDPR or otherwise unlawful
• If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

Objection to processing

You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

Withdrawal of consent

If the basis on which we are using your personal information is your consent.  We will seek your consent to contact you for non-essential services.  Examples of this include marketing information about our services, community development activities or employment support.  You have the right to withdraw your consent to us processing your information at any time. We must stop using the information. We can refuse if we can rely on another reason to process the information such as our contractual obligations or legitimate interests.  

Right to data portability

Residents can request a copy of their data in a .csv / excel file from the Data Protection Team if:

• The legal basis for processing the data is consent or performance of a contract
• AND the processing is carried out using automated means

We may:

• ask for two forms of identification  
• a description of the data requested

If we’re able to provide the data we will provide the information within one calendar month.  We will send the file via email and we will ask the resident to confirm their email address and the password to access the file.

We will not accept incoming data portability files from residents or other housing associations at this time. It’s a requirement of the UK-GDPR that the data we hold is accurate and up-to-date. To ensure the data meets our requirements and is not in breach of the UK-GDPR we will obtain data directly from residents in line with our internal sign-up procedures.

Automated Decision Making including Profiling

On occasion, we profile residents’ data to enable us to tailor the support we provide, specifically to assess the likelihood of residents falling into rent arrears or send targeted communication campaigns. 

Southern Housing utilises a piece of Software called RentSense in order to help us prioritise customers in need of support with arrears. RentSense is a piece of algorithmic prioritisation software provided by Mobysoft, a UK based software designer.

Southern Housing sends data to Mobysoft for processing by RentSense, and as such the Southern Housing is the Data Controller, and Mobysoft the Data Processor.

While RentSense will help us create profiles for those in need of support, we do not believe that these profiles, or the use of RentSense, will have a legal or significantly similar effect on you as a customer.

Southern Housing will not undertake profiling or automated processing that has a legal or significant effect on individuals.  If you have any concerns about the way Southern Housing is using your data please contact us using the details below.

Transferring information outside the EU

We may transfer limited personal and special category information outside of the European Economic Area (EEA), including the US, as part of contractual arrangements with third party suppliers, in order to fulfil our legal basis for processing as set out above. We will ensure we have an appropriate transfer mechanism in place in accordance with guidance from the ICO.

Visitors to our website and site usage information

We collect the following information from visitors to our website and our online resident portal:

1. Details collected through forms, including web chat, filled in when you contact us online 
2. Surveys and polls about the website
3. Site usage information from session cookies and log files.

Microsoft may collect Personal Data from individuals visiting Southern Housing websites and offer appropriate opt-out choices as required by Data Protection Law. Microsoft collects or receives Personal Data from you to provide Microsoft Advertising. Microsoft Privacy Statements can be viewed here:  https://privacy.microsoft.com/en-us/privacystatement.

You can read more about how we use cookies and log files . 

Links to other websites

This privacy notice doesn’t cover links within our website to other websites.  We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice

We keep our privacy notice under regular review.  We’ll update if we undertake any new or amended processing. This privacy notice was last updated on 17 April 2024.

Subsidiary organisations

Southern Housing has subsidiary organisations who are also registered as Data Controllers with the Information Commissioners Office.  To view a full list expand the appropriate blue boxes below:

Subsidiary Companies

AmicusHorizon Ltd
Crystal Palace Housing Association 
Fresh Visions People Limited
Hewitt Homes
Middlesex First
Southern Home Ownership
Southern Space Ltd
The Fellowship Houses Trust
Triathlon Homes LLP
Trustees of the Southern Housing Group Pension Plan

Further Information

This privacy notice does not provide detail on all aspects of Southern Housing’s collection and use of personal information.  We’re happy to provide any further information or explanation needed.  

Please contact us using the information below.

How to contact us

If you want to get in touch, you can do so online or on the phone - click here to find out how you can contact us.

Write to us at:

Data Protection Officer
Southern Housing
Fleet House
59-61 Clerkenwell Road
Farringdon
London
EC1M 5LA

Complaints

Southern Housing tries to meet the highest standards when collecting and using personal information. We take any complaints we receive seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading, inaccurate or inappropriate.

If you remain unhappy with our response you’ve the right to complain to the Information Commissioners Office by writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

 

[1] By this we mean the Regulation as supplemented and amended by the Data Protection Act 2018.