Privacy Statement

Who are we?

We are a registered social landlord based in the Neath Port Talbot area. We provide social housing, intermediate properties for rent and a range of services to help people manage their homes.

Introduction

Your privacy is important to us. This privacy notice explains what personal information we collect about you, how we store it, how we use it, how we keep it safe and who we share it with.

We want you to be fully informed about your rights, and how we use your information.

We hope the following sections will answer any questions you have but if not, please do get in touch with us.

Why do we process your personal information?

We need to collect, process, store and share personal information about you and other household members (when you provide information about household members, we assume that you do so with their full knowledge and consent) in order to operate as a registered provider of social housing and provide you with the best possible experience.

When do we collect your personal information?

From the first moment you contact us, we are collecting information about you. Sometimes you provide us with information, sometimes information about you is collected from other sources and sometimes we collate the information you have provided, and information collected from other sources to build a profile to enable us to provide more tailored services. We may also share information with other sources, where we have a lawful basis to do so.

Information you give us

• When you apply for a property with us
• When you access our services
• When you fill out a survey
• When you contact us with a query
• When you fill out a form
• When you provide information on the website or customer portal
• When you visit our offices, we capture your image on CCTV
• When you contact us on social media
• When you attend an event and have a photograph take

Information others give us about you or others in your household

• The local Council including Social Services, Council Tax, Housing Options, Housing Benefit, Neath Port Talbot Adult’s and Children’s Single Point of Contact Team (SPOC) and the Environmental Health department.
• With Multi Agency Public Protection Arrangement (MAPPA)
• With Multi Agency Risk Assessment Conferences (MARAC)
• With the Probation Service (HMCCS)
• The Department of Works & Pensions (DWP)
• The police
• Support agencies such as The Citizens Advice Bureau, The Wallich, Platform, Team Around the Family
• Your previous landlords
• Credit reference companies
• Banks and other financial organisations
• Your employer
• Medical professionals
• Local Councillors, Assembly Members and MPs

For more information on parties who may provide us with your information, please see the section on Sharing your Information below.

What we collect

We will only ask for personal information that we need to deliver our services to you. In some cases, you can refuse to provide your personal information if you think it is unreasonable for us to request it. However, you should note that this may impact on the service we provide to you.

Legal basis

Data protection legislation sets out a number of different reasons why we may collect and process your personal information, including:

Consent - In some situations, we can collect and process your information with your consent. For example, if you want us to discuss your tenancy/application/leasehold with a member of your family or another representative we will need your consent.

Performance of a contract - In some cases, we will process your personal information in relation to a contract.

For example, we may need to share your information with contractors for them to undertake repairs to the property on our behalf.

Legal obligation - If the law requires us to, we may need to collect and process your information.

For example, when you start a tenancy with us, we let the council tax department, gas supplier, electricity supplier and Welsh Water know you’ve moved in and give them your contact details.

Legitimate interest - Sometimes we process your personal information as it is in the interest of the business to do so. When we do this, we will always consider your interests.

For example, when we ask for your medical information, it is in our legitimate interest to ensure we offer you services that meet your needs.

How we manage your personal information

We process your personal information in accordance with the principles within the relevant data protection legislation currently the UK Data Protection Act 2018.

We will treat your personal information fairly and lawfully and we will ensure that information is:

• Processed for limited purposes.
• Kept up-to-date, accurate, relevant, and limited to what is necessary.
• Not kept longer than is necessary.
• Kept secure. Access to personal information is restricted to authorised individuals who require the information for us to provide you a service.
• We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate.

How we protect your information

We know how much information security matters to you. With this in mind we will

treat your information with the utmost care and take all appropriate steps to protect it.

We secure access to all transactional areas of our websites using secure technology and appropriate access controls.

We regularly monitor our system for possible viruses and attacks, and we carry out penetration testing to identify ways to further strengthen security.

We use cookies on our website. To find out more information click here.

To help us to ensure confidentiality of your personal information we may ask you security questions to confirm your identity when you contact us. We will not discuss your personal information with anyone other than you, unless you have given us prior authorisation to do so, or the law permits us to.

How long will we keep your information?

Whenever we collect or process your personal information, we’ll only keep it for as long as is necessary for the purpose for which it was collected.

At the end of that retention period, your information will either be deleted completely or anonymised, so that it can be used in a non-identifiable way for statistical analysis and business planning.

Sharing your personal information

Normally, only Tai Tarian staff will be able to see and process your personal information. However, there may be times when we will share relevant information with others for the purposes listed below or where the law requires to do so. When sharing personal information, we will comply with all aspects of data protection legislation.

Sensitive information about health, sexual life, race, religion and criminal activity for example is subject to particularly stringent security and confidentiality measures.

Where necessary or required, we may share information as follows:

• To comply with the law (e.g. the police, Inland Revenue, Council Tax Registration, Social Security Fraud Act) or a Court Order
• With Multi Agency Public Protection Arrangement (MAPPA)
• With Multi Agency Risk Assessment Conferences (MARAC)
• With the Probation Service (HMCCS)
• Support agencies such as the Citizens Advice Bureau, The Wallich, Platform and Team Around the Family
• With other landlords or social housing providers if you move home, we are required to provide a tenancy reference on your behalf
• The local Council including Social Services, Council Tax, Housing Options, Housing Benefit, Neath Port Talbot Adult’s and Children’s Single Point of Contact Team (SPOC) and the Environmental Health Department.
• Where there is a clear health or safety risk to an individual or members of the public,
• Where there is evidence of fraud against Tai Tarian, other irregular behaviour or a matter Tai Tarian is investigating
• With credit reference agencies to obtain a financial rating to ensure we are offering you a property which you can afford
• With Experian so that your rental payments count towards your financial history or for any of the above reasons
• In connection with court proceedings or statutory action to enforce compliance with tenancy conditions (e.g., applications for possession or for payment of Housing Benefit/Universal Credit direct)
• Credit Reference companies
• Where Tai Tarian has entered into a formal protocol with the police or a local authority department
• With contractors or other agents providing services on Tai Tarian’s behalf; this includes gas, electricity, water companies and any other contractors we appoint who may need to work on or in one of our properties
• With debt collection agencies in respect of unpaid utility bills or unpaid rent and recharges
• With insurance providers to assist them with administering policies and claims
• Providing information anonymously for bona fide statistical or research purposes, provided it is not possible to identify the individuals to whom the information relates
• Information required by the Welsh government or other statutory body when monitoring Tai Tarian’s activities in its capacity as the regulator of housing association The above list is not exhaustive.
• Local Councillors, Assembly Members and MPs (consent will only be requested when any sharing of sensitive data is necessary)
• DWP
• With third party cloud hosting and IT infrastructure suppliers who provide the systems that we store and process your data in.

Please note that in many of the relationships outlined here we will also receive information about you from the parties above.

When we share your personal information, we:

• provide the information needed.
• ensure your personal information is used for the exact purposes we state in our contract with them.
• We work closely with them to ensure that your privacy rights are respected and protected at all time
• if we stop using their services, any of your information held by them will either be deleted or rendered anonymou

Where may your information be processed?

Personal data stored by Tai Tarian is generally located within the UK. We use third-party service providers, for example, those that provide and host our IT systems, which may be located outside of the UK. Where this is the case, we put in place contractual arrangements to safeguard the data in line with the requirements of the UK GDPR.

Where data is transferred outside of the UK, we will make sure that transfers are only made where there are appropriate safeguards are in place. If personal information is transferred outside of the UK, we will take steps to ensure that your privacy rights continue to be protected.

What are your rights?

Under data protection legislation you have a number of rights in relation to your personal information:

The right to access the personal information we hold on you

You have a right to ask us what personal information we hold about you, and to request a copy of your information, free of charge. This is known as a subject access request.

We have one calendar month within which to provide you with the information you’ve asked for or tell you why if we cannot provide the information.

The right to ask for your personal information to be corrected if you think it is wrong.

You have the right to ask us to correct your personal information if you believe it is wrong.

We have one calendar month to deal with your request or let you know why if we can’t deal with your request.

The right to erasure (right to be forgotten)

You have the right to ask us to delete personal information we hold about you. You can do this where:

• the information is no longer necessary in relation to the purpose for which we originally collected/processed it
• where you withdraw consent
• you object to the processing and there is no overriding legitimate interest for us continuing the processing
• we unlawfully processed the information
• the personal information has to be erased in order to comply with a legal obligation

We can refuse to comply with a request for erasure where the personal information is processed for the following reasons:

• to exercise the right of freedom of expression and information
• to comply with a legal obligation for the performance of a public interest task or exercise of official authority
• for public health purposes in the public interest
• archiving purposes in the public interest, scientific research historical research or statistical purposes or the exercise or defence of legal claims

The right to restrict us processing your personal information

When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

• You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
• You challenge whether we have a legitimate interest in using the information
• If the processing is a breach of the data protection legislation or otherwise unlawful
• If we no longer need the personal information but you need the information to establish, exercise or defend a legal claim. If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

The right to object to processing

You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights, or the processing is necessary for us or someone else to bring or defend legal claims.

The right to withdraw consent

Whenever you have given us your consent to use your personal information, you have the right to change your mind at any time and withdraw that consent.

If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we rely on another reason to process the information such as our legitimate interests.

The right to data portability

The right to data portability allows you to obtain and reuse your personal information for your own purposes across different services. It allows you to move, copy or transfer personal information easily from one IT environment to another in a safe and secure way. The right only applies to personal information you have provided to us where the reason we are relying on to use the information is either your consent or for the performance of a contract. It also only applies when processing is carried out by us using automated means.

The right to object to automated decision making and profiling

You have the right to object to us making a decision about you which is made by automated means only. We must let you know if we do this.

Contact us

Data Protection Lead
Tai Tarian Ltd
Ty Gwyn
Brunel Way
Baglan Energy Park
Neath
SA11 2FP

Telephone 01639 506086 or email corporateservices@taitarian.co.uk

Contacting the regulator

If you feel that your personal information has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal information, you have the right to make a complaint to the Information Commissioner’s Office.

You can contact them by:

Calling 0303 123 1113

Write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Online www.ico.org.uk/concerns

Changes to this privacy notice

It is likely that we will need to update this privacy notice over time. If there are any significant changes we will notify you in writing, or you’re welcome to check back at any time for the latest version.