Privacy Policy

Cartrefi Conwy Cyfyngedig

How we use Personal Data

Introduction

This document explains how Cartrefi Conwy (the Association) obtains, holds, uses and discloses information about people (their personal data[1]), the steps we take to ensure that it is protected, and also describes the rights individuals have in regard to their personal data handled by Cartrefi Conwy[2].

 

The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 1998 (‘the Act’). On behalf of the Association the Company Secretary of Cartrefi Conwy is registered with the Information Commissioner as a ‘data controller’ for the purposes of the Act. As such he/she is obliged to ensure that Cartrefi Conwy handles all personal data in accordance with the Act.

 

Cartrefi Conwy takes its responsibilities under the Act very seriously and takes great care to ensure that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the Association.

1.  Why do we handle personal data?

Cartrefi Conwy obtains, holds, uses and discloses personal data for the broad purpose of enabling us to provide social housing accommodation and services which include:

  • letting, renting and leasing properties
  • administering waiting lists
  • carrying out research
  • administering housing and property grants
  • providing associated welfare services, advice and support
  • maintaining our accounts and records
  • supporting and managing our employees, agents, and contractors
  • using CCTV systems to monitor and collect visual images for the purpose of security and the prevention and detection of crime.

 

[1] ‘Personal Data’ is defined under Section 1 of the Data Protection Act 1998. In practical terms it means information handled by Cartrefi Conwy that relates to identifiable living individuals. It can include intentions and expressions of opinion about the individual. The information can be held electronically or as part of paper records, and can include CCTV footage and photographs. For ease of readers this document refers to the handling, use, holding etc of personal data – Section 1 of the Act uses the term ‘processes’ to effectively cover any usage of personal data.

 

[1] This document is designed to help satisfy the ‘Fair Processing Requirements’ as required by Schedule 1 Part 2 Paragraphs 1 to 4 of the Data Protection Act 1998 and may be regarded as a generic over-arching ‘Fair Processing Notice’ for Cartrefi Conwy. Additional more specific Fair Processing Notices may appear in other circumstances such as on forms, Association policies, email footers, or CCTV signage.

 

2.  Whose personal data do we handle?

In order to carry out the purposes described under section 1 above Cartrefi Conwy may obtain, use and disclose (see section 7 below) personal data relating to a wide variety of individuals including the following:

  • Employees including their family and other designated contacts, volunteers, agency, temporary and casual workers
  • Tenants, their carers, family and other designated contacts
  • applicants for accommodation which include their families and households
  • asylum seekers
  • board members
  • business associates
  • landlords
  • local authority employees
  • probation officers
  • social workers
  • spiritual and welfare advisers
  • consultants and professional advisers
  • survey respondents[3]
  • offenders and suspected offenders
  • complainants, enquirers and witnesses
  • suppliers and service providers, self employed contractors
  • people captured by CCTV images

3.  What types of personal data do we handle?

In order to carry out the purposes described under section 1 above Cartrefi Conwy may obtain, use and disclose (see section 7 below) personal data relating to or consisting of the following:

  • personal details
  • goods and services
  • supplier details
  • financial details
  • lifestyle and social circumstances
  • complaints
  • education and employment details
  • health, safety and security details
  • visual images, personal appearance and behaviour
  • Cartrefi Conwy will only use appropriate personal data necessary to fulfil a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.

 

[1] Cartrefi Conwy will conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals and ask them to give us their opinion of the service we are providing. We use the information given to improve our service wherever we can. Cartrefi Conwy may use another organisation to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.

 

4.  Where do we obtain personal data from?

In order to carry out the purposes described under section 1 above Cartrefi Conwy may obtain personal data from a wide variety of sources, including the following:

 

·      the data subject themselves

·      current, past or prospective employers and work colleagues

·      family, carers, associates and representatives of the person whose personal data we are processing

·      educators and examining bodies

·      suppliers and service providers

·      financial organisations

·      central government

·      survey and research organisations

·      other housing associations or trusts

·      trade unions and associations

·      health authorities

·      enquirers and complainants

·      security organisations

·     health and social welfare organisations

·     professional advisers and consultants

·     probation services

·     charities and voluntary organisations

·     the police and other law enforcement agencies

·     courts and tribunals

·     professional bodies

·     employment and recruitment agencies

·     credit reference agencies

·     debt collection agencies

·     landlords

·     its own CCTV systems,

·     correspondence

 

5.  How do we handle personal data?

In order to achieve the purposes described under section 1 Cartrefi Conwy will handle personal data in accordance with the Act. In particular we will ensure that personal data is handled fairly and lawfully with appropriate justification. We will strive to ensure that any personal data used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and non-excessiveness, is kept as up to date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. We will also respect individuals’ rights under the Act (see section 8 below).

6.  How do we ensure the security of personal data?

Cartrefi Conwy takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Act relating to security.

 

We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

7.  Who do we disclose personal data to?

In order to carry out the purposes described under section 1 above Cartrefi Conwy may disclose personal data to a wide variety of recipients, including those from whom personal data is obtained (as listed above). This may include disclosures to other Housing Associations, Care and Health providers, Utility companies (such as gas, electricity and water suppliers) the Fire service, the Police and other law enforcement agencies, partner agencies, carers and care agencies working in support of users or prospective users of our services, and to bodies or individuals working on our behalf such as IT contractors or survey organisations.

 

We may also disclose to other bodies or individuals where necessary to prevent abuse or harm to individuals.

 

Disclosures of personal data will be made on a case by case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place.

 

Some of the bodies or individuals to which we may disclose personal data may be situated outside of the European Union some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal data to such territories, we will take proper steps to ensure that it is adequately protected as required by the Act.

 

Cartrefi Conwy will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Child Support Agency, the National Fraud Initiative, the Home Office and to the Courts.

 

Cartrefi Conwy may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.

 

8.  What are the rights of the individuals whose personal data is handled by Cartrefi Conwy?

Individuals have various rights enshrined in the Act:

Subject Access

The most commonly exercised right is that used by individuals to obtain a copy, subject to exemptions, of their personal data processed by Cartrefi Conwy.

Details of the application process, known as ‘Subject Access’ can be obtained by contacting Cartrefi Conwy’s Company Secretary (see section 11 below).

Right to prevent processing likely to cause damage or distress

Under Section 10 of the Act an individual is entitled, in limited circumstances, to write to Cartrefi Conwy requiring that we do not handle their personal data in a manner that was causing or would be likely to cause unwarranted substantial damage or substantial distress to themselves or another person.

 

Requests under Section 10 must

  • describe the personal data involved;
  • describe the handling to which the individual objects;
  • state that the handling was causing or would be likely to cause substantial damage or substantial distress to him/her or another;
  • describe the damage or distress;
  • state that the damage or distress was/would unwarranted;
  • and give reasons why the handling was causing/would cause such distress and was/would be unwarranted.

 

All requests of this nature should be sent in writing to the Company Secretary (see section 11 below).

 

The Act includes certain provisions which may mean in a particular case Cartrefi Conwy can continue to handle the personal data as intended despite the objection.

Right to Prevent Processing for the Purposes of Direct Marketing

Under Section 11 of the Act and subject to certain exemptions, an individual has the right to request in writing that Cartrefi Conwy stops within a reasonable time, or does not start, using their personal data for direct marketing purposes. This includes the communication by any means (e.g. mail, email, telephone, door-to-door canvassing) of any advertising or marketing material directed at particular individuals. Any requests under Section 11 may be sent to the Company Secretary (see section 11 below).

Rights in relation to automated decision-taking

Under Section 12 of the Act and subject to certain exemptions, an individual has the right to require that Cartrefi Conwy ensures that no decision that would significantly affect them is taken by Cartrefi Conwy or on its behalf purely using automated decision-making software. The right has to be exercised in writing. If there is a human element involved in the decision-making the right does not apply. Requests under Section 12 may be sent to the Company Secretary (see section 11 below).

Right to take action for compensation if the individual suffers damage by any contravention of the Act by data controllers

Under Section 13 of the Act any individual who believes they have suffered damage and/or distress as a result of any contravention of the requirements of the Act may be entitled to compensation from Cartrefi Conwy where the Association is unable to prove that it had taken such care as was reasonable in all the circumstances to comply with the relevant requirement. Any claim for compensation arising from this provision may be sent to;

The Company Secretary,

Cartrefi Conwy,

Morfa Gele, North Wales Business Park, Cae Eithin, Abergele LL22 8LJ

Right to take action to rectify, block, erase or destroy inaccurate data

Under Section 14 of the Act an individual has the right to seek a court order for the rectification, blocking, erasure or destruction of their inaccurate personal data handled by Cartrefi Conwy. The right cannot be exercised directly to Cartrefi Conwy.

Right to request the Information Commissioner to assess a data controller’s processing

Under Section 42 of the Act any person can request the Information Commissioner to make an assessment if they believe that they are/have been adversely affected by the handling of personal data by Cartrefi Conwy. Such requests should be made direct to the Information Commissioner whose contact details can be found below.

 

Generally if individuals have any concerns regarding the way their personal data is handled by Cartrefi Conwy or the quality (accuracy, relevance, non-excessiveness etc.) of their personal data they are encouraged to raise them with the Company Secretary (see section 10 below).

 

The Information Commissioner is the independent regulator responsible for enforcing the Act and can provide useful information about the Act’s requirements.

The Information Commissioner’s Office (ICO) in Cardiff provides a local point of contact for members of the public and organisations based in Wales.

 

The Information Commissioner’s Office may be contacted using the following:

Information Commissioner’s Office – Wales 2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH Telephone: 029 2067 8400    Fax: 029 2067 8399                Email: wales@ico.org.uk

or alternatively, The Information Commissioner’s Office,

Wycliffe House, Wilmslow, Cheshire, SK9 5AF

Telephone: 01625 545700     Website: www.ico.gov.uk

9.              How long does Cartrefi Conwy retain personal data?

Cartrefi Conwy keeps personal data as long as is necessary for the particular purpose or purposes for which it is held. Personal information which is placed on the Housing Management system and other records containing personal data relating more generally to the activities of Cartrefi Conwy is retained, reviewed and deleted in accordance with agreed retention periods, which may be varied from time to time relevant to the needs of the business.

10.  Monitoring

Cartrefi Conwy may monitor or record and retain telephone calls, texts, emails and other electronic communications to and from the Association in order to assist the purposes described under section 1 above, and deter, prevent and detect inappropriate behaviour.

 

Cartrefi Conwy does not place a pre-recorded ‘fair processing notice’ on all telephone lines because of the inconvenience that may be caused through the delay in response to the call.

11. Cookies

Cookies are small data files which are stored on a user’s computer or mobile phone by a website and stored on the hard drive of the user’s device. They are helpful because they help to make a website work and often allow the website owners to direct specific content to the user.

On our website, users can manage and/or delete cookies as they wish, however, some cookies are required by the website to function correctly and therefore, not allowing them may prevent the performance and layout of the site. Information about how to do this is provided in the section How to manage cookies.

  1. ABOUT COOKIES

A cookie is a small amount of data (which often includes a unique identifier) that is sent to a user’s computer or mobile phone from a website and is stored on the hard drive of a device. Each website can send its own cookies to your browser if your browser’s preferences allow it. Many websites do this whenever a user visits their website in order to report on website traffic and frequency of individual’s navigation. Your browser only permits a website to access the cookies it has already sent to you, not the cookies sent to you by other websites.

  1. HOW CARTREFI CONWY USES COOKIES

Cookies on the Cartrefi Conwy website are used in a number of ways. Information on those used can be seen in the list below.

  1. ANALYTICS

Cartrefi Conwy uses Google analytics to collect information about how people use our site. This helps us make sure our website meets users’ needs and to find out how we can improve.

Analytics cookies store information about what pages people visit, how long they are on the site, how they got there and what they click on. Information supplied by cookies helps Cartrefi Conwy to analyse the profile of visitors and provide them with a better experience.

Analytics cookies do not collect or store users’ personal information (for example, names or addresses), so this information cannot be used to identify individuals.

  1. STORING YOUR USABILITY AND ACCESSIBILITY SETTINGS

Our website provides settings that allow you to resize text or view different colour options.

If you switch them on, we store the settings in a cookie, so that they apply to each page you look at.

  1. THIRD-PARTY COOKIES

Third-party cookies are not set directly by Cartrefi Conwy, but by third-party service or functionality providers.

Cartrefi Conwy uses Google Analytics who set cookies on the Cartrefi Conwy website in order to deliver the services that they are providing (for example, website analytics).

Cartrefi Conwy also uses Issuu for the Together newsletter and they collect cookies to deliver the services that they are providing for example, publication statistics.

Cartrefi Conwy does not control the dissemination of these cookies. For more information about the cookies used by these suppliers, including how to opt-out, view their individual privacy policies listed below.

  1. GOOGLE ANALYTICS

stores the information collected by the cookie on servers in the United States. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. How to reject or delete this cookiehttp://www.google.com/intl/en/privacypolicy.html

  1. ISSUU – ACCESSING THE TOGETHER NEWSLETTER

may use cookies or Flash objects to count the number of unique computers accessing their website. You can set your browser to refuse cookies from the Issuu Service if you choose. When you access Issuu, they may automatically record certain information from your system by using different types of tracking technology. This “automatically collected” information may include IP Address, a unique device or user ID, version of software installed, system type, the content and pages that you access on the Issuu Service, and the dates and times that you visit the Issuu Service. How to reject or delete these cookies http://issuu.com/about/privacy

12.  Contact Us

Any individual with concerns over the way Cartrefi Conwy handles their personal data may contact the Company Secretary as below:

The Company Secretary, Cartrefi Conwy, Morfa Gele, North Wales Business Park, Cae Eithin, Abergele LL22 8LJ

Tel: 0300 124 0040

[1] ‘Personal Data’ is defined under Section 1 of the Data Protection Act 1998. In practical terms it means information handled by Cartrefi Conwy that relates to identifiable living individuals. It can include intentions and expressions of opinion about the individual. The information can be held electronically or as part of paper records, and can include CCTV footage and photographs. For ease of readers this document refers to the handling, use, holding etc of personal data – Section 1 of the Act uses the term ‘processes’ to effectively cover any usage of personal data.

 

[2] This document is designed to help satisfy the ‘Fair Processing Requirements’ as required by Schedule 1 Part 2 Paragraphs 1 to 4 of the Data Protection Act 1998 and may be regarded as a generic over-arching ‘Fair Processing Notice’ for Cartrefi Conwy. Additional more specific Fair Processing Notices may appear in other circumstances such as on forms, Association policies, email footers, or CCTV signage.

 

[3] Cartrefi Conwy will conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals and ask them to give us their opinion of the service we are providing. We use the information given to improve our service wherever we can. Cartrefi Conwy may use another organisation to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.