Who are we?
Irwell Valley Homes is the trading name for Irwell Valley Housing Association Ltd which is a charitable ‘Community Benefit Society’ registered under the Co-operative and Community Benefit Societies Act 2014, our registered number is 20684R. We are also a registered provider of social housing with the Regulator of Social Housing, our RP number is L0061.
Our registered address is:
Irwell Valley Homes, The Soapworks, Colgate Lane, Salford, M5 3LZ.
Our contact details are:
Tel: 0300 561 1111
We collect and use personal data about individuals (‘data subjects’) which means we must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) as the ‘controller’. All data protection queries should be directed to our Information Governance Team via the above details or firstname.lastname@example.org
What personal data do we collect?
We will collect personal data primarily about our customers and colleagues, but we will also collect data about others who we interact with through the course of our activities. The normal types of personal data we collect about our customers are:
- Date of birth
- Proof of identity e.g. photo ID
- National Insurance number
- Contact details, including telephone, email or contact address
- Details of anyone authorised to act on their behalf if applicable
- Personal details of all household residents
- Banking or payment card details if they make payments to us
- Benefit and Council Tax information
- Proof of housing eligibility
- Private landlord references
- Mortgage lender details
- Credit rating
- Criminal convictions data
- Health data
- Social services data
The normal types of personal data we collect about our colleagues are:
- Date of birth
- Contact details
- Proof of identity e.g. photo ID
- Previous work history
- Interview notes
- Criminal convictions / records checks
- Pension details
- Discipline, grievance and dismissal details
- Annual leave and other non-sickness days off
- Training, courses and conferences details
- Employment contract
- Salary and tax details
- Sickness leave details
- Injury at work details
- Occupational health and medical assessments
- Colleague performance appraisals / review details
- Equality and diversity data e.g. protected characteristics under equality legislation
- Parental arrangements e.g. adoption issues
- Eligibility to work details
- Essential car use details
- Colleagues details necessary for uniform purchases
The normal types of personal data we collect about other individuals include:
- CCTV footage of them when they are on our property
- Details we log if they are a visitor e.g. name, company and time of attendance
- Contact details of individuals from partner agencies
How do we collect personal data?
We collect personal data in a variety of ways such as through:
- Filling in forms provided by us e.g. at tenancy sign-up
- Our website e.g. registering to use our customer portal
- Our social media accounts e.g. our Facebook page
- Our ongoing contact with the individuals themselves
- Our ongoing contact with partner agencies
- People associated with individuals such as family, friends and neighbours
- CCTV cameras we have at certain properties.to record events in public areas
- Call recording on some inbound phonecalls
Why do we collect personal data?
We collect personal data for the purposes of providing social housing and the activities which support that aim.
We process personal data about our customers for the following purposes:
- Enable us to provide them with accommodation and to communicate with them
- Provide social and other types of housing
- Provide home ownership products
- Undertake property and grounds maintenance and repairs
- Manage their housing, tenancy/lease and accounts as their landlord or provider of another service to them
- Ensure that we meet all our legal and statutory duties such as those which apply under the Equality Act, Fire safety etc and those owed to our regulators
- Promote equal opportunities and fair treatment for all our customers
- Provide information (e.g. about products and services) they request from us
- Help with the prevention / detection of crime and the apprehension / prosecution of offenders
- Prevent and detect fraud, bribery and money laundering
- Promote safety and the quiet enjoyment of our neighbourhoods and communities in our capacity as social housing providers
- Engage with customers and make improvements to our products and services
- Improve services by gathering your feedback in automated surveys
- To protect individuals from harm as part of our safeguarding and other obligations
- Provide them with welfare services including advice and appropriate support
- Provide support for elderly and vulnerable customers
- Keep in touch with customers, understand their needs and preferences and invite them to relevant events
- Carry out research and to provide information to help improve our services
We process personal data about our colleagues for the following purposes:
- Recruitment and selection
- Facilitating a pension scheme
- Discipline, grievance and dismissal procedures
- Providing training and access to courses / conferences
- Administering payroll
- Performance appraisals
- Occupational health assessments
- Criminal records checks
- Monitoring at work
- Health and safety
- We process personal data about other individuals which we interact with through the course of our activities in order to help facilitate our activities / purposes.
What is our legal basis?
The GDPR and DPA require us to be able to cite specific conditions within those laws to justify our collection and use of personal data. The conditions (lawful basis) we can rely upon are as follows - the processing is necessary:
- For the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
- For compliance with a legal obligation to which the controller is subject
- In order to protect the vital interests of the data subject or of another natural person
- For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- For the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Our legitimate interests are that we are pursuing lawful objectives which are charitable in nature and perform a social good i.e. the provision of affordable housing to those who need it most. We also work with partner agencies in the public and third sector who also have legitimate interests depending on their area of work e.g. the NHS, Local Councils and charities such as Shelter.
If none of the above conditions apply, we can ask for the data subject’s consent (which can be withdrawn at any point).
However, the GDPR and DPA state that we must be able to cite additional conditions if we process personal data relating to any of the following so called ‘special categories’:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic and biometric data
- Health data
- Sex life details
- Sexual orientation
We do process personal data which falls within the special categories and the additional conditions we can rely upon are:
- The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment, social security and social protection law.
- The processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
- The processing relates to personal data which are manifestly made public by the data subject.
- The processing is necessary for the establishment, exercise or defence of legal claims.
- The processing is necessary for reasons of substantial public interest.
- The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
- The processing is necessary for reasons of public interest in the area of public health.
- The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
If none of the above conditions apply, we can ask for the data subject’s explicit consent (which can be withdrawn at any point).
In certain situations, we may be required to process criminal conviction data which requires us to be able to cite further conditions similar to the special categories – the conditions we can rely upon are:
- The vital interests of data subjects or another individual.
- Processing by a not for profit body (subject to safeguards).
- The establishment, exercise or defence of legal claims.
- Functions provided for by law.
- If none of the above conditions apply, we can ask for the data subject’s consent (which can be withdrawn at any point).
Will we share personal data?
All our data subject’s personal data will be kept secure and confidential. Our colleagues have restricted access to personal data on a “need to know” basis.
We may share personal data with:
- Contractors who carry out work / deliver services on our behalf (this will be governed by legally enforceable contracts)
- Local councils
- Social Services
- The Police
- Other social landlords
In particular, please be aware:
Current or forwarding addresses may be shared with utility companies and Council Tax offices to ensure billing details are correct.
- If a customer defaults on any tenancy / licence conditions or obligations of a similar nature, their personal data may be provided to authorised debt recovery agencies or parties acting in a similar capacity, to enable them to recover the debt. This may affect future applications for tenancies, credit and insurance.
- We may discuss a customer’s financial situation, rent payments (including any arrears) and any claims made for welfare benefits with an external debt advice agency, welfare rights advisor, the housing benefit department or the local council housing advice and homeless prevention team to make sure that benefits are paid correctly.
- We may pass data about a customer’s rent payment record to credit reference agencies. This will enable them to assist other organisations to assess the customer’s financial standing if they apply for products and services.
- We may pass a customer’s contact details to a third party to conduct surveys and research on our behalf which allow us to gather feedback and improve the services we offer you. The third party will be bound to strict terms and conditions outlined by us and will not share their data with other organisations. Should they choose not to participate in the surveys the third party will securely destroy their data.
- We may share a customer’s National Insurance number to verify their Universal Credit application and manage these payments and to prevent and investigate tenancy and right to buy applications fraud.
How long will we hold personal data?
We hold personal data in accordance with the National Housing Federation’s guidelines on data retention which can be obtained here.
How do we keep personal data safe?
The security of data subjects’ personal data is of the utmost importance to us. We operate a robust and thorough process for assessing, managing and protecting new and existing systems which ensures that they are up to date and secure against the ever-changing threat landscape.
Personal data is stored and managed within a variety of IT software systems which are maintained to achieve a high level of security and confidentiality. We hold information in IT systems which may be copied for testing, backup, archiving and disaster recovery purposes.
Our colleagues complete mandatory information security and data protection training at the start of their employment, and annually thereafter to reinforce responsibilities and requirements set out in our data protection and information security policies. Only colleagues and other authorised individuals who require access to personal data will be able to access it.
Please note that we use cloud computing service providers which may involve the transfer of personal data outside the European Economic Area (EEA). However we only use companies who have adequate safeguards in place e.g. they have signed up to the ‘Privacy Shield’ process.