Community Housing ("the Company") is a non-profit making social business limited by guarantee and registered with the Regulator of Social Housing (RSH).

Where we refer to "we" or "us" in this Privacy Notice, we are referring to Community Housing (the trading name of The Community Housing Group Ltd).

Community Housing is the "data controller" of your personal identifiable information. The data controller is responsible for determining the means of collection and the use of this information.

Community Housing is registered with the ICO as follows:

Community Housing - ZB210539 ICO Notification Number

Depending on the products and services we deliver to you, the types of personally identifiable information used will vary. We will only collect personal information when we need it. When you provide your information, we will explain why we need it. We will also explain when information is optional and the impact of not providing this.

For most products and services, we need to use some or all the following items of personally identifiable information about you, occupants of your home, or your representatives:

Personal information

• Contact details - name, address, email, home and mobile telephone numbers;
• Age - date of birth, age range;
• Gender
• Identification - information to allow us to check your identity (e.g. official documents);
• Financial information - information about your financial circumstances, or where you make payment by credit/debit card;
• Photograph - information to record your identity;
• On-line computer identifiers (IP address) - information recorded when you engage with us electronically;
• National insurance numbers - information to carry out functions such as universal credit and/or personal care services;
• Next of kin - contact details.

Special Category Information

• Health - to support our housing functions and vulnerable customers;
• Ethnicity - to support our equality monitoring purposes;
• Religion - to support our equality monitoring purposes;
• Sexual Preferences or Orientation - to support our equality monitoring purposes;
• Convictions - to prevent and detect anti-social behaviour, crime, fraud, anti-money laundering and to aid in the prosecution and rehabilitation of offenders.

We may collect a reduced set of information for the other occupants of your property unless they also have a direct relationship with us (e.g. obtain services from us directly).

Supplying your personally identifiable information may be essential to enter into a contract/agreement with you or to meet some of our legal or regulatory duties. Examples of these are:

• Tenancy or leaseholder agreements;
• Delivering Care and/or Support Service;
• Processing housing or council tax benefit;
• Equality monitoring and regulatory reports.

If you choose not to supply the personal information required, then we may not be able to provide some of our housing, support or products and services.

Most of the time, the personal information we hold about you is information you have; given to us; has been gathered by us when we enter into an agreement with you to provide products and services; or gathered by us during the time we provide products and services to you.

We may also obtain information from third parties such as the local authority, your doctor (or other health professional), a previous landlord or other relevant community partner. In addition, we may also obtain information from publicly accessible sources or engage the service of market research organisations to validate, or where appropriate, enhance the information that we hold.

Examples of our means of collecting data include:

• Directly from you - in person, by email, telephone, text message, letter or form;
• By observing how you use our housing, support, products and services, or those of other members of the Group, for example from the transactions and operation of your accounts and online services;
• From other organisations such as former housing and support providers, health and social care agencies, law enforcement agencies, debt collectors, energy or utility companies, benefit agencies and/or credit reference and fraud prevention agencies;
• From other people you know and/or are linked to you - For example; a joint tenant, a relative, a person nominated to act on your behalf, your legal representative, or people who live in the same community as you (e.g. those making reports of antisocial behaviour);
• From monitoring or recording calls as part of quality and complaint monitoring. We record these calls for training and to ensure safety of our staff. We will not record any payment card details as part of our accounts and payments operations;
• From the CCTV systems for the prevention and detection of crime or to detect damage/ vandalism to our properties and to ensure the safety and security of our staff and individuals obtaining services from us.

We will share your personal information within The Community Housing Group and with others outside the Group where we need to do that to provide products and services to you, market products and services to you, meet or enforce a legal obligation or where it is fair and reasonable for us to do so.

Who we share your personal information with depends on the products and services we provide to you and the purposes we use your personal information for. For most products and services, we will share your personal information if it is in our legitimate interests to do so without seeking your consent first. This may be with:

• Our contractors to facilitate repairs, maintenance or improvement works.
• Debt and money management advisors.
• Local authority teams such as social services, environmental health and benefit agencies.
• Utility companies (and their representatives) and Council Tax Departments to ensure billing details are correct.
• Third parties providing services on our behalf. For example, a mailing company distributing our newsletter; a research company carrying out a customer satisfaction survey, or a debt collection agency pursuing former tenant arrears.
• Agencies committed to protecting public funds and/or preventing fraud in line with the National Fraud Initiative.
• Police and other relevant authorities (e.g. Department of Work & Pensions, Probation Service, HM Revenue and Customs) in relation to the prevention and detection of crime, the apprehension of offenders or the collection of tax or duty.
• Other statutory organisations e.g. social services and health authorities as necessary for exercising statutory functions.

Where the information is of a sensitive nature, for example about your health, we will generally obtain consent from you prior to sharing this information, unless we are required or permitted to share this by law.

We may also share information when required by law for example where ordered by the Court or to protect an individual from immediate harm.

The Community Housing Group will never sell your personal data to 3rd party organisations for marketing purposes.

We only use your personal information where it is permitted by the laws that protect your privacy rights.

We only use personal information where:

• We need to use the information to comply with our legal obligations;
• We need to use the information to perform a contract with you;
• We determine it is fair to use the personal information either in our interests or someone else's interests, but there is no harm to you as a result - this may include where it is in our interest to contact you about relevant products or services or collaborate with others to improve our services;
• Where we need to seek your consent - If we ask for your consent, you have the right to subsequently withdraw it. We will let you know how to do that at the time we gather your consent.

Special protection is given to certain kinds of personal information that is particularly sensitive. This is information about your health status, racial of ethnic origin, political views, religious or similar beliefs, sexual orientation, or criminal convictions and allegations. We will only use this kind of personal information where:

• We have a legal obligation to do so (e.g. to protect vulnerable people);
• It is necessary for us to so do to protect your vital interests (e.g. if you have a severe and immediate medical need);
• It is in the substantial public interest;
• It is necessary for the prevention or detection of crime;
• It is necessary for insurance purposes; or
• You have specifically given us consent to use the information.

To provide you with our services we may collect and use your information as follows:

To assess service eligibility and complete tenancy sign-ups;

To complete our assessments (e.g. affordability) and subsequently if we sign-you-up to our services we will collect detailed personal information about you and other household members, including age, gender, date of birth, ethnicity, income, National Insurance number, income and benefits details, employment status, gender identity, relationship status, any disabilities, any communication and accessibility requirements, religion, sexuality, nationality, caring responsibilities, access to financial services such as banks and credit unions, bank details, benefits, council tax, medical information, details of any unspent criminal convictions.

We have a legal duty to confirm a person(s) eligibility for housing and their right to reside in the country. We will need to obtain details of your citizenship, previous countries you have lived, and a copy of identification documents (such as passport, home office residence papers and driving license).

To help support our customers who have a vulnerability and/or receive a support or care service from us we might also need health and social care information (such as physical, social or mental health information or medication)

Some of the information requested will form the basis of our contract with you. Without this information, we will be unable to accept an application for services.

Information relating to other occupants is collected as it is in our legitimate interests to know who will be living in our premises, to ensure that accommodation offered is adequate for current and the short/medium term needs of your family, to check that household members' needs are being met and to ensure that the surrounding community will have quiet enjoyment of their homes.

To manage and administer our tenancies, leasehold agreements or care & support services;

We may use personally identifiable information to meet the conditions set out in the contract/agreement with you or to meet our legal or regulatory obligations, as follows:

Up to date contact details (telephone number and email address) so we can reach you when we need to discuss your services, e.g. payments, essential servicing, access for repairs, maintenance and improvements, to resolve or investigate complaints or housing management issues such as antisocial behaviour and to enforce the terms of your tenancy/lease.

We may ask you for supporting information about any change in circumstances or to make changes to your tenancy. For example; if you have a medical need that means your housing requirements need to be re-assessed; or if you want to change your name on our records.

We will hold records of all our contact with you, your contact with us, and any contact from third parties representing you or about you. This may include call recordings.

We will keep financial records about the money you have paid us, any amounts outstanding and our actions to recover that money. Depending on how you pay; we may hold your bank account details, or share/receive information from payment bureaus such as AllPay. Where you are in receipt of certain benefits we will receive information from and share information with relevant agencies.

We may also use your contact information to communicate with you about products or services which may help you sustain your tenancy, and news stories relating to The Community Housing Group.

Without this information, we may be unable to adequately provide your services.

To fulfil our health & safety and crime prevention obligations and to support our vulnerable people;

We process your personally identifiable and special category information for this purpose to meet our legal and regulatory obligations for health and safety and crime prevention.

We may hold information about vulnerabilities or your behaviour if we need to ensure services are tailored to meet your needs, or to look after our staff or anyone else working on our behalf.

Indicators may be placed on your record and shared with contractors and subcontractors to ensure health and safety measures are in place. We would have informed you of the reason for this indicator, when it will be applied and for how long.

E.g. a marker is applied for a tenant with a mobility restriction, to ensure that sufficient time is given for the tenant to answer the door.

We may capture your image on our CCTV systems if you visit one of our offices or residential buildings covered by this facility. Signage at each location provides details of the purpose of system.

To report or share information with agencies where it is believed you or other persons' vital interests are at risk;

We use your personally identifiable and special category information for this purpose because it is necessary to protect the vital interests of you or others and to meet our legal and regulatory obligations.

We do this where you or another person is at risk of physical, mental, sexual, harm or damage

Where you or another person needs to be protected as a vulnerable person from significant harm or serious exploitation

When you engage with our teams to obtain extra support, guidance or advice

We use your personally identifiable information for this purpose because it is our legitimate interest to ensure our tenancies are sustainable, and it is necessary to fulfil the contractual relationship formed with you when you engage with us. Where information relates to other household members, it is in our legitimate interests to ensure that we are providing the correct advice based on your exact circumstances. By choosing not provide information it may not be possible to provide the correct advice and fully benefit from the service.

Our training and employability teams within Vestia Community Trust may hold information about your education, job history and skills and experience. Or, if we support you to improve your financial circumstances our Financial Inclusion advisors may hold detailed information about your household income and expenditure.

To monitor our performance

It is in our legitimate interests to use your personally identifiable information for this purpose to understand how we are performing so we can meet our goals and objectives.

We may use your contact details to carry out market research and customer satisfaction surveys to help us to monitor our performance and to improve our services to our customers.

We undertake call recordings for training and quality monitoring purposes.

To perform statistical analysis to manage and reduce complaints, or to help us target our resources and prioritise services.

There may also be a legal obligation for us to process the information or to demonstrate to our regulators that we are fulfilling our obligations, for example equality laws.

Keeping in touch with you, understanding your needs, and inviting you to events.

To fulfil our contractual obligations, we will process your personal information to communicate with you for operational purposes using the most appropriate contact details you have given us e.g. by post, email, text message, or social media.

It is in our legitimate interests to communicate with you about products and services which relate to services you already receive from us, and to keep you up to date with news and events which meet our objectives around social inclusion and helping to build communities.

Where you have given us consent to receive marketing, you can withdraw consent and update your marketing preferences by contacting us by phone 0800 169 5454 or by visiting any of our websites.

Meeting the requirements of our regulators;

We may use your personally identifiable information to meet the legal or regulatory obligations set out for us by our regulators.

When our Tenants provide Authority to Act

We will hold the personal information of individuals who have been elected or selected to be an "Authority to Act" We hold this information to identify you, and to validate identity and the Authority to Act on behalf of our customers.

We will hold this information against the Tenant who we hold a legal relationship with, and we will review this authority to act each year.

There are some occasions or some Tenancy related matters that must be completed by the tenant themselves, and so on these occasions the authority to act will not be able to be used.

Please note that there are occasions where we will have to withdraw the use of Authority to Act, and on these occasions the individual with the authority and the customer directly will be communicated with.

Sometimes we use your personal identifiable information in automated processes to make decisions about you, for example determining your position on a housing waiting list or eligibility for a mutual exchange. We do this to help ensure decisions are made accurately, fairly and efficiently and to offer you services tailored to you. You have a right to challenge the validity of any decisions made in this way. You may also ask us not to process your information in this way.

Please contact us for more detailed information or to find out if you can object to automated decision making.

To ensure the safety and security of information you provide, it will not generally be transferred or processed outside of the UK as data protection laws may not provide the same level of protection as those in the European Economic Area.

There may be occasions where we need to process your information outside of the European Economic Area (EEA), for example where we use a third-party computer system within the USA to distribute marketing emails or complete internet-based surveys. Where we do this, any personally identifiable information will be limited, we will communicate where the information you provide will be stored, and we will take all necessary steps to ensure that your information remains as secure as possible.

The length of time we keep your personal information for depends on the services we deliver to you. We will never retain your personal identifiable information for any longer than is necessary for the purposes for which we need to use it.

Community Housing will apply appropriate technical and organisational measures to ensure your personal information is secure.

When we need to engage a contractor or third party suppliers to process your personally identifiable information, our contracts with them shall include strict controls on their security and confidentiality protocols.

To help us ensure confidentiality of your personal information we will ask you or anyone contacting on your behalf security questions to confirm your identity. We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so or where we have received a clear verbal instruction from you.

We employ strong security measures to protect your data from unauthorised access, including encryption, secure storage, and regular data audits. We are committed to meeting all legal standards and will promptly address any data security concerns.

To support Community Housing ("the Company") in delivering its Services, we may engage third party service providers to assist us with our data processing activities. When we work with these service providers in our capacity as a data controller, the third-party service provider is a data-processor for the Company.

The table identifies the data-processor, describes where they are located, and what services they provide to us. Before engaging any data-processor, we perform relevant due diligence, and do not engage a data-processor unless our quality standards are met. Our data-processors are all subject to contract terms that enforce compliance with applicable data protection laws.

The Company currently uses the following data-processors:

Our business needs may change from time to time. For example, we may stop using a data-processor to consolidate and minimise our use of data-processors. Similarly, we may add or replace a data-processor if we believe that doing so will enhance our ability to deliver our Services. We will periodically update this page to reflect additions and removals to our list of data-processors.

You have eight rights:

The right to be informed

Through our privacy notices we will informed you of who is obtaining and using your personal identifiable information, how this information will be retained, shared and secured and what lawful grounds will be used to obtain and use your personal identifiable information.

The right of access

You have a right to ask us what personal information we hold about you and to request a copy of your information. This is known as a 'subject access request' (SAR).

The best way to do this is to put your request in writing using our template form located below. When a Subject Access request is made, we will take reasonable steps to verify your identity before we can proceed so you may wish to submit a copy of your photo ID with your request to save time. This validation requirement is in place for Personal and Information security purposes.

Validation information is stored for one year; only confirmation of identity is recorded, not the method. After a year, related emails or transmissions are archived and no copies are retained in our Data Protection Compliance Systems. Access is limited to the colleagues handling your Rights Request, the DPO, and Support staff for system administration, maintenance and security.

If you are seeking to obtain specific information (e.g. about a particular matter or from a particular time period), it helps if you clarify the details of what you would like to receive in your request. Very broad requests are likely to require clarification so we can make sure we know what information you require. If someone is requesting information on your behalf they will need written confirmation from you to evidence your authority for us to release this and proof of ID (both yours and theirs).

Where you are unable to put your request in writing, you can contact the Data Protection Team to arrange for your request to be documented on your behalf. If you choose to make a verbal SAR request, please contact us via the Contact Centre and request a call back from the Data Protection Team. We aim to contact you within 5 working days and will then send you a copy of the request to verify and attach ID before we start processing your request.

In response to SARs, we will provide you with a copy of the information we hold that relates to you in an appropriate format.

Full information relating to subject access requests can be found here.

The right to rectification

You can ask us to rectify your personal data if it is inaccurate or incomplete. Please help us to keep our records accurate by keeping us informed if your details change.

The right to erasure

The right to erasure is also known as "the right to be forgotten". In some circumstances, you can ask us to delete or remove personal data where there is no compelling reason for The Community Housing Group to continue to hold it. This is not an absolute right, and we will need to consider the circumstances of any such request and balance this against our need to continue processing the data, and any legal/regulatory requirements for the data.

The right to restrict processing, and the right to object

You can object and ask us to restrict processing if you feel that the Group is using your personal identifiable information unlawfully and/or holding inaccurate, inadequate or irrelevant personal identifiable information which if used may have a detrimental impact on you and /or has an impact on your rights.

The right to data portability

For such companies as Utilities providers (e.g. Gas, Electric suppliers); you can request that information you've provided to them, such as meter readings be transferred to another company. If the situation arises where it would be helpful for you to move, copy or transfer personal data we hold about you, across different services, you may be able to ask us to do this.

Rights in relation to automated decision making and profiling

You can ask us to review any decisions that are determined by automated means, and object to our use of your personal data for profiling activities.

To make enquiries for further information about exercising any of your rights in this privacy notice, then please contact us by email at dataprotection@communityhousing.co.uk or by post at "The Data Protection Officer", 3 Foley Grove, Foley Business Park, Kidderminster, Worcs., DY11 7PT.

Your Right to raise a complaint

Community Housing prides itself in being an open, fair and transparent user of your personal data and has operated an Adequacy of Decision or Complaint process for some time. The Data Usage and Access Act 2025, required of Data Controllers to publish information on how an individual may raise a complaint.

You can raise a complaint over how and why we use your data, or our response to a Rights Request such as a Subject Access Request by contacting us below. Please detail your cause for concern, and your evidence and supporting documentation. You may find it useful to use the following form.

Our Data Protection Complaints process is not suitable for, or we are unable to assist in Housing or Service-related complaints as Community Housing has a separate and widely published complaints process. We are only able to address concerns or complaints that fall under the obligations we hold from the following Data Protection and Privacy legislation.

• The UK Data Protection Act 1988 (As processed in the past, by provisions of the un appealed provisions of the 2018 Act)
• UK Data Protection Act 2018
• The (Applied) UK General Data Protection Regulations (the UK GDPR)
• The Data Usage and Access Act 2025
• Privacy in Electronic Communications Regulations

Your complaint will be considered and reviewed, and your supporting evidence and documentation assessed against the information we hold, how and why we have processed this information, and the decision made by the Head of Service and/or the Data Protection Officer. You will receive a response to your complaint within one month. Should you remain unsatisfied with our response, you are entitled to raise a complaint with the Information Rights Regulator

Data Protection and Privacy Contact details

Community Housing Group is a Tier 1 Data Controller registered with the Information Commissioners Office (the ICO) in the UK and hold the registration number of ZB210539. You can view our ICO Data Controllers Certificate here.

We make available in for free and available at any time information that details who, why and how we process personal data on our website. You can locate our Privacy Notice here:- https://www.communityhousing.co.uk/privacy This Notice answers frequently asked questions and details who we have appointed as Data Processors.