Data Controller/s: Cheltenham Borough Council is the Controller and Cheltenham Borough Homes Ltd is the Processor of the personal data collected and managed for Council tenancies and housing and homelessness applications.

Cheltenham Borough Homes Ltd is the Controller of personal data collected and managed for CBH tenancies, recruitment and employees.

Cheltenham Borough Homes Ltd Address: Oakley Resource Centre, Clyde Crescent, Cheltenham GL52 5QJ
Cheltenham Borough Council’s address is Municipal Offices, Promenade, Cheltenham GL50 9SA www.cheltenham .gov.uk

We welcome any queries you may have about how we use your personal data, or any information we hold about you. Please contact us at the address above or email us at: businesssupport@cbh.org

We collect personal data about:

Customers – this includes:

• current, former and potential tenants, including their family, household members and other people associated with them
• leaseholders and leasehold property occupants
• shared owners
• general public, including those people who access housing advice and those who access our services for the wider community

Employees – this includes current, former and potential colleagues, as well as Board Members, apprentices and volunteers.

Other service users – Anyone who makes a complaint or enquiry, visitors to our website and offices, or who may attend a community event that is open to the public or who may rent a garage.

For our customers and other service users we may collect:

• photographic ID, name, date of birth, telephone number, address, email address, gender, dependants, marital status, National Insurance number and certain sensitive personal data such as diversity information and information about your physical and mental health, or which relates to your financial circumstances and criminal history
• we may also hold names and dates of birth, photographic ID and information about other members of your household or intended household members. We may hold some contact details for a third party where you have provided them as a method of communication with you
• we hold details on your previous housing circumstances and the previous housing circumstances of any joint applicants on your application
• we record information about your needs and requirements to ensure our services are accessible so that we take account of any support needs in our dealings with you, and to improve our communications with you
• we record information to assist us in delivering our housing services which can include reports of antisocial behaviour; complaints; or changes in circumstances

For employees (including contractors or temporary workers) we collect:

• your name address, date of birth, email address, phone numbers, your photograph, gender, marital status, dependants and next of kin and their contact details,
• medical or health information including whether or not you have a disability, information used for equal opportunities monitoring including sexual orientation, religion or belief and ethnic origin
• references, education and employment history, information relating to criminal records, documentation relating to your right to work in the UK, driving licence; bank details and tax codes; national insurance number;
• employment history with CBH including pay grades, pension details, terms and conditions of employment, letters of concern, formal warnings and other documentation with regard to any disciplinary proceedings
• performance information including measurements against targets, formal warnings and related documentation with regard to capability procedures, appraisal forms and training details, web activity
• absence records, including annual leave, flexi time, family leave, sickness absence etc

We may not be able to provide full services and support without this information.

We collect personal data in a number of ways, including, but not limited to:

• when someone applies for a home, directly through our Housing Options Team or through the local choice-based lettings scheme (currently HomeseekerPlus)
  • when you apply to become a tenant we request and retain any references necessary to assess your application. This may include (but is not limited to), information from other housing providers, the Police, the Probation Service, support services, Social Services, and health services where appropriate
• when someone presents themselves as homeless or requires housing advice, either directly through our Housing Options Team or via the Housing Assistance Referral Portal
• when providing people who are not tenants of CBH-managed homes with benefit and money advice
• when someone signs a tenancy agreement
• through on-going contact with people or other agencies to manage tenancies or leases, including anti-social behaviour, and provide services and support
  • this may include, but is not limited to: the individual/s concerned, family, acquaintances and members of the public, partner agencies such as emergency services, social services, local authorities and other housing providers
• when we collect rent and service charges
• when you access CBH services on-line, via a tenant portal for example
• when helping people to find employment or training opportunities
• when providing people with benefit and money advice
• when we seek your opinions about CBH and our services
• if you make a complaint
• through the collection of equality and diversity information
• when you end or exchange a tenancy
• when someone applies for the right to purchase, or requests increased ownership of a property
• when provided by leaseholders and occupiers of leasehold properties, where relevant
• when CBH-managed garages are rented
• during the prevention and detection of crime and fraud

As an employer CBH collects personal data in a number of ways, including, but not limited to:

• when carrying out recruitment and processing job applications
• when someone signs a contract of employment, following which we will compile a file relating to their employment
• during ongoing management of, and support in, role
• during use of IT systems and applications
• pay, pension and benefits processes
• disciplinary procedures
• security and health and safety checks
• when we seek employee opinions

Via our website

• anonymous statistical information is collected by cookies. These are small text files that are placed on your machine to help the site provide a better user experience. Please see the ‘cookies’ page on our website for more information
• if you request a call back or information from us via an email, online form, or register your interest in a service we will use your information to fulfil that request

Through CCTV

• Some of the properties we manage have CCTV in external public areas to prevent and detect crime and promote public safety by helping to identify and prosecute criminal offenders. Where cameras are in use signs are publicly displayed in the vicinity.

We collect and use personal data about prospective, current and former customers’, plus members of their household and other relevant contacts to provide/manage:

• housing allocations, advice (including advice on benefits and money) and homelessness services to ensure that you are eligible for social housing and that any accommodation you may be offered will be suitable for you or your family needs
• property and tenancy/leasehold services and support, including:
  • rent and service charges, both current and former tenants
  • responsive repairs and property maintenance services, for example to gain access to the property to enable us or our contractors to maintain the property
  • benefits and money advice
  • tenancy support services
  • investigating antisocial behaviour disputes
  • investigating complaints
  • education, employment, training advice and opportunities
  • benefit and money advice
• quality assurance and training
• you with information about CBH performance, activities and opportunities (e.g. newsletters and other mailings plus emails)
• you with opportunities to participate in services/activities that meet your needs
• services that are shaped to meet your needs and provide equality of opportunity
• rental of garages
• statistical returns to government departments
• engaging with customers to check the quality of services, help with development of additional services and adapt existing services to operate more effectively
• comply with legal, regulatory and professional obligations
• prevention and detection of crime and fraud
• compliance with health and safety and security regulations .

We may collect other service users’ personal data to:

• provide services or events that are relevant to broader communities
• seek feedback about services
• manage rental of garages

We collect and use prospective, current and previous employees’ personal data to:

• process job applications
• process pay, pension and benefits
• manage annual leave and sickness absence
• manage and support colleagues in their roles
• comply with health and safety and security regulations
• provide employer references to third parties when requested

For processing personal data to be legal CBH must identify a ‘lawful basis for processing’, set out in UK data protection legislation. Where we process more sensitive personal data (‘special category’, criminal offence or children’s data) extra conditions are required to be met.

Whenever CBH collects personal data we will notify you why, how we will use it and our legal basis for processing (for example to perform a contract with you, or if it is with your consent).

The legal bases under which we process personal data will be one or more of the following:

1. we have your consent to do so
2. it is necessary for the performance of a contract; for example, this tenancy agreement
3. it is necessary for compliance with a legal obligation
4. we need to protect someone’s life
5. to carry out public functions and powers that are set out in law or to perform a specific task in the public interest that is set out in law
6. when there is a legitimate interest

Where we process special category personal data, which includes; health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership or genetic and biometric data we also meet one of the following conditions:

1. you have given explicit consent
2. processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
3. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
4. processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim
5. processing relates to personal data which are manifestly made public by the data subject
6. processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
7. processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject

Where we process criminal offence data we meet at least one of the lawful bases and have either legal authority for the processing. Where we do need to collect information relating to criminal offences we do so providing appropriate safeguards for the people to whom the data relates. We do not maintain a comprehensive register of criminal convictions.

Children need particular protection when we are collecting and processing their personal data because they may be less aware of the risks involved. Where we process children’s personal data we consider the need to protect them from the outset, and design approach and processes with this in mind. We must meet at least one lawful basis and should consent be the most appropriate this is only applicable for children aged 13 or over, below this age requires consent from the person/s with parental responsibility. Children have the same rights as adults over their personal data.

More detailed information on the lawful bases and these three areas of more sensitive personal data can be found on the ICO’s website.

Your personal data will be kept secure and confidential.

We may sometimes need to share information with contractors who may deliver services on our behalf or other third parties, agencies or organisations to help support you. This may occur when we believe that it is in your or the public’s interest to do so, or is required by law or where it is necessary to do so for the prevention and detection of crime, including fraud. It may also be necessary to provide statistical data to government departments. Where this is necessary, we are required to comply with data protection legislation.

Examples of organisations we may share your information with, where appropriate, are:

• Cheltenham Borough Council (including Council Tax, Housing Benefits or electoral services for example) or other Local Authorities
• Central government departments including the Department for Work and Pensions for example and the Ministry of Housing Communities and Local Government (MHCLG)
• Housing Ombudsman
• Social services
• Police forces
• Fire Service
• Probation Service
• Utilities companies
• Courts and Court Bailiffs
• Other landlords
• Job Centres
• Contractors, suppliers and service providers
• Support agencies
• Health services
• Credit reference agencies
• Survey and research organisations
• Internal and external auditors
• Gloucestershire Counter Fraud Unit
• Health and social welfare organisations
• Companies providing legal advice to CBH
• HMRC
• Immigration Control
• Payroll and pensions departments
• Employment and recruitment agencies
• Trade unions

Where we share personal data it is always carried out securely and with clear guidelines as to what is being shared, why, with whom, and for how long.

We are committed to ensuring that your information is kept safe and secure. We have a protected IT infrastructure, which restricts access to systems and personal data by using effective password management. Measures are also in place to mitigate the likelihood of cyber attacks being successful.

Should it be accessed using mobile devices, these are encrypted and are capable of being wiped clean of all data remotely. Where we need to transfer personal data we will do this via a secure transfer or using an encrypted removable storage device.

Personal data is held within the European Economic Area (EEA) where we store and process this information on our IT systems. Where it is necessary to transfer personal data outside the EEA, this is done in compliance with data protection legislation.

We also have a number of physical security measures in place, such as secure office access, office security and confidential destruction of all waste paper. For more information please contact us

We carry out regular training and awareness-raising with all colleagues to highlight the need to keep personal data safe.

We keep your information in line with statutory periods of retention, or where we have a legitimate business need and dispose of any personal data securely.

Information relating to homelessness or housing applications will be kept for up to 3 years following a decision being made or a successful application. Information relating to either that has been withdrawn or removed will be kept for up to 6months. After this it will be securely destroyed.

Information relating to benefit and money advice will be kept for up to one year before it is securely destroyed.

We keep personal data relating to tenancies for the duration of the tenancy and a limited amount of information for up to 6 years after that. We may keep certain data for longer than this, for example should there be any debts owed.

We keep employees’ personal data for the duration of their employment and up to 6 years following the ending of that employment. We may keep certain data for longer than this, for example should there be any ongoing disputes.

Where an application for employment has been unsuccessful and not shortlisted for interview we will securely dispose of that information after 6 months. Where an applicant has reached interview but has been unsuccessful we will securely dispose of that information after 1 year.

Further details about how long we keep data is set out in our retention schedules.

Data Protection law includes rights for individuals

Right to be informed
This means that we are obliged to provide you with clear and transparent information about how we use your personal data when we collect it. This Privacy Notice explains how we use the personal data we collect; and explains how you can contact us if you have any questions or concerns about how your personal data is being used.

Right of access and how to access your personal data 
You have the right to request access to the personal data that we hold about you so that you can be aware of and verify the lawfulness of the processing. You can request copies of personal data we hold about you by making a ‘subject access request’. This is free and we must provide that data at the latest within one month of receipt of your request. (extendable to two months where the request is complex)

You can write to us or email us with your request, or download the  CBH SAR Application Form, for your convenience which you can post or email back to us. We may require proof of your identity and address – we will let you know this when we receive your request.

Please be aware that we may need to edit or remove some information if it relates to other people, as we must protect the privacy rights of all individuals. If you have any queries about accessing your personal data please contact us using the details above.

Your right to rectification
You are entitled to have your personal data rectified if it is inaccurate or incomplete. We will investigate and respond ASAP and at the latest within one month (extendable to two months where the request is complex)

The right to erasure (‘the right to be forgotten’)
You have the right to request the deletion or removal of personal data where there is no compelling reason which allows us to continue using it. Individuals can make a request for erasure verbally or in writing and we have one month to respond to a request.

The right is not absolute and only applies in certain circumstances. The specific circumstances under which you can request the deletion of your data are listed on the ICO website.

The right to restrict processing
In certain limited circumstances you have the right to request the restriction or suppression of your personal data. You can make a request for restriction verbally or in writing. While the processing is restricted, we are permitted to store your personal data, but not to use it.

This is not an absolute right and only applies in certain circumstances. The circumstances under which we would be required to cease processing are listed on the ICO website.

The right to data portability
Where we are processing your personal data with your consent or for a contract, you have the right to obtain and reuse your personal data for your own purposes across different services. This means that, where requested, and where applicable, we must provide you with your personal data in a ‘machine readable’ way which enables you and other organisations to use the personal data you provided to us for that purpose.

The circumstances under which the right to data portability applies are listed on the ICO website. This is free of charge and we must respond to requests within one month (extendable by two months where the request is complex)

The right to object

You have the right to object to:

• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
• direct marketing (including profiling); and
• processing for purposes of scientific/historical research and statistics.

The circumstances under which we must cease processing when an objection is made are listed on the ICO website. Where an objection is made to direct marketing, we must cease processing as soon as we receive the objection.

Your right to withdraw consent
Where we are processing your personal data with your consent, you have the right to withdraw your consent for processing your personal data at any time. Where there is no other lawful basis which permits us to continue using your personal data, then your personal data will be removed from our records and systems.

Please note that some of the personal data that we process about you will be necessary to perform a contract with you or may be necessary to comply with a legal obligation. In these circumstances we may not be able to cease the processing, for example, if you wish us to assess your housing application then we will require certain information from you, or to provide you with a tenancy and associated services such as repairs.

You may still notify us of your wish to withdraw your consent and we will consider each request on a case by case basis.

In all instances please write to: Cheltenham Borough Homes Ltd, Business Support team, Hester’s Way Community Resource Centre, Cassin Drive, Cheltenham, GL51 7SU or email: businesssupport@cbh.org

Rights in relation to automated decision making and profiling
This right provides you with safeguards against:

• ‘automated individual decision-making’ (making a decision solely by automated means without any human involvement); and
• profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

CBH does not currently carry out automated decision making without human intervention. Further details about this type of activity can be found on the ICO website.

If you have a concern about the way in which we are handling your personal data then please contact us. In the first instance please write to: Cheltenham Borough Homes Ltd, Business Support team, Hester’s Way Community Resource Centre, Cassin Drive, Cheltenham, GL51 7SU or email businesssupport@cbh.org

We will take your concern seriously and work with you to try to resolve it.

If you are not satisfied with our response you can raise the matter with the Information Commissioner’s Office (ICO) via their website or call their helpline on 0303 123 1113.

This privacy notice will be updated to reflect changes either to the way in which we operate or changes to the data protection legislation. To make sure that you keep up to date, we suggest that you revisit this notice from time to time.