Privacy Notice for Customers and Residents

East Midlands Housing Group Limited (‘emh Group’) is a registered co-operative and community benefit society with registration number 30476R and operates as a non-asset owning parent company, with two largely ring fenced functional divisions: emh Housing and Regeneration Limited, trading under the name ‘emh’, which is a Registered Provider regulated by the Regulator of Social Housing (registration number 4775) and emh Care & Support Limited, whose regulated activities fall within the remit of the Care Quality Commission. Midlands Rural Housing & Village Development Association Limited and Sharpes Garden Services Limited, are non-registered providers which are also entities within emh Group.

For the purposes of this privacy notice, when we say "emh", "we", "us" or "our", we are referring to East Midlands Housing Group Limited, its subsidiaries and its group entities. For a list of the entities within the emh Group, please see: meet the emh group Board | emh group - emh group.

This privacy notice may be supplemented by any number of privacy notices, and in which case, we strongly advise you to read this privacy notice alongside any supplemental privacy notice emh Group produces, these include:

• Privacy Notice for Care & Support
• Privacy Notice for Customers of Midlands Rural Housing
• Privacy Notice for Anti-Social Behaviour Reporting
• Privacy Notice for Involved Residents

We promise:

• To keep your data safe and secure
• Treat any data concerns you may have as a priority.

This privacy notice aims to give you information about how we collect and process your personal information throughout your custom and/or tenancy with us. It makes you aware of how and why your personal information will be used, namely for the purposes of the performance of our contract with you as our customer, and how long it will usually be retained for. It provides you with certain information that must be provided under the retained EU Law version of the General Data Protection Regulation (EU) 2016/679 (‘the UK GDPR’), the Data Protection Act 2018 and any subsequent legislation or regulatory requirements in force from time to time, or any successor legislation.

This notice primarily covers how we use information relating to our customers and residents. It makes you aware of how and why your personal information will be used, and how long we will usually keep your personal information for. In these cases, we will be the “data controller” for the purposes of UK data protection law.

We may only use information relating to criminal convictions where the law allows us to do so. This is usually where that processing is necessary to carry out our obligations and provided we do so in line with our Data Protection Policy and Special Category Data Policy.

We envisage that we will in some cases process information about criminal convictions in connection with providing services to you. For example, to ensure that we house you appropriately and that specialised support services are offered to you, where required.

We have in place appropriate safeguards which we are required by law to maintain when processing such data.

We need all the categories of information in the list above (see What information we collect about you? above) primarily to allow us to perform our contract with you and to enable us to comply with our legal obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The situations in which we will process your personal information are listed below:

• To register you as a customer.
• To communicate with you about your tenancy.
• To assist us with selling your property.
• To administer our waiting lists.
• To administer housing and property grants.
• To perform our contract or service to you.
• To manage our relationship with you, including notifying you about changes to our contract or services or asking you to provide us with feedback.
• To administer and protect the organisation.
• To protect the organisation from tenancy fraud.
• To comply with any legal or regulatory obligation.
• To maintain our accounts and records.
• To support and manage our employees, agents and contractors.
• As part of our marketing and promotional activities (if you agree).

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We do not use automated decision making or profiling however there may be occasions where inadvertently we identify special category information about you.

For example, your ethnicity, religion, sexual orientation or disability may be evident from:

• Photographs
• Video footage or other recordings
• Face to face meetings
• Declaration of Interests
• Social media

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Generally, we do not rely on consent as a legal basis for  processing your personal information other than in  relation to sending direct  marketing communications to  you via email or text message.  You have the right  to withdraw consent to such  marketing at any time.

Personal information we have on you is used to make sure the services we offer continue to be the most appropriate for you.

We will use your information to manage our relationship with you, for example keeping our records up to date and to enable us to assist in the coordination of support services.

We will also use your information to carry out the contractual obligations we have to our customers for example arranging repairs, planned maintenance, surveys and inspections to the properties.

We will not normally share your information with anyone else. However, there are certain circumstances where we will be required to share your information with other organisations. We will comply with UK data protection law when disclosing this information.

Where it is required or necessary in accordance with UK data protection law, we may share information with:

• Other companies within the emh Group
• Third parties under the provisions of Crime and Disorder Act.
• Our Regulators, such as the Regulator for Social Housing and Housing Ombudsman.
• Government bodies and law enforcement agencies
• Housing Benefits department.
• Collection agencies and legal representatives for the purpose of collecting rents or other monies owed to us.
• Regulatory authorities in response to formal requests.
• Third party service providers in connection with services performed on our behalf, such as repairs contractors, grounds maintenance providers, managing agents.
• Our insurers, legal advisors, auditors and other professional advisors or consultants, such as RICS accredited surveyors.
• Survey and research organisations.
• Other housing associations, trusts or local authorities.
• Health authorities.
• Health and social welfare organisations.
• Adult and children’s social services.
• Utility providers.
• Security organisations.
• Professional bodies.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

This list is not exhaustive as there are other circumstances where we may also be required to share information, for example:

• To meet our legal obligations.
• In connection with legal proceedings (or where we are instructed to do so by Court order).

We may also share information with Experian, as we believe that rent payment history should be used in the same way as mortgage payment information is used, to help you access more affordable credit. Not only will we be able to work with you more closely to manage your existing tenancy agreement, your track record as a tenant will enable Experian to use the information supplied to them to assist other landlords and organisations to:

• Assess and manage any new tenancy agreements you may enter into;
• Assess your financial standing to provide you with suitable products and services;
• Manage any accounts that you may already hold, for example reviewing suitable products
  or adjusting your product in light of your current circumstances;
• Contact you in relation to any accounts you may have and recovering debts that you may
  owe;
• Verifying your identity, age and address, to help other organisations make decisions about
  the services they offer;
• Help to prevent crime, fraud and money laundering;
• Screen marketing offers to make sure they are appropriate to your circumstances;
• For Experian to undertake statistical analysis, analytics and profiling;
• And for Experian to conduct system and product testing and database processing
  activities, such as data loading, data matching and data linkage.

If you would like to see more information on these, and to understand how the credit reference agencies each use and share rental data as bureau data (including the legitimate interests each pursues) this information is provided in this link: www.experian.co.uk/crain (Credit Reference Agency Information Notice (CRAIN)). (For a paper copy, please get in touch with us)

We also share your information with the Central Government and our Regulator as required by law. The continuous recording of lettings and sales in social housing in England (referred to as CORE) is a national information source that records information on the characteristics of both private registered providers and local authority new social housing tenants and the homes they rent.

This collection provides all of the statistical information that the Ministry of Housing, Communities and Local Government produces on social housing lettings and includes:

• Trends in social housing lettings over time
• Characteristics of tenants with new social housing lettings
• Types of tenancy agreements

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

Our arrangements with third party service providers are governed by contractual provisions with us and they only have access to personal information to perform the described purposes and may not use it for other purposes.

All personal information you provide to us is stored on our secure servers within the UK and European Economic Area (‘EEA’). However there may be occasions where your information may need to be stored in or sent to companies, service providers, agents, subcontractors and regulatory authorities in countries outside of the UK and EEA which may not have the same level of security and protection as we have under UK legislation. If we have to do this, we will make sure that suitable security measures are in place subject to the requirements of the UK GDPR.

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:

1. Where we have notified you of the decision and given you one month to request a reconsideration.
2. Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
3. In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if this position changes.

We will only retain personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. For further information about the relevant retention periods applicable to visitors to our website, please see the What information do we collect about you? Section above.

You can find out if we hold any personal information about you by making a ‘subject access request’ under the UK GDPR.

If we do hold information about you, we will:

• Give you a description of it.
• Tell you why we are holding it;
• Tell you who it has been disclosed to; and
• If we are able to, let you have a copy of the information in an intelligible form.

You may also have the right for your personal information to be transmitted electronically to other organisations in certain circumstances.

You can access your personal information we hold by completing this form:

Make a subject access request

Or writing to us at this address:

Emh, Governance & Assurance Team, Memorial House, Stenson Road,
Coalville, Leicestershire,
LE67 4JP.

Or by emailing us at:

dataprotection@emh.co.uk

You have the right to question any information we have about you that you think is wrong or incomplete.

Please contact us if you want to do this. If you do, we will take reasonable steps to check its accuracy and correct it.

If any of your personal information changes, such as a contact number or email address, please let us know right away so we can update our records.

You may also have the right, in certain circumstances, to request that we delete your personal information, to block any further processing of your personal information or to object to the processing of your personal information, though please note there are some specific circumstances where these rights do not apply and we can refuse to deal with your request.

If we are processing your personal information based upon your consent (e.g. as part of our marketing or promotional activities or to make a voluntary referral to an external agency), you have the right to withdraw your consent at any time.

If you require any further information about your right to rectification, erasure, restriction of or object to processing or you wish to withdraw your consent please contact us (see How to contact us below).

We take any complaints we receive about the collection and use of personal information very seriously. We would encourage you to bring it to our attention in the first instance if you think that our collection or use of information is unfair, misleading or inappropriate. You can make a complaint at any time by contacting us (see How to contact us below).

If you think our collection or use of personal information is unfair, misleading or inappropriate or if you have concerns about the security of your personal information, you also have the right to make a complaint to the Information Commissioner’s Office.

You can contact the Information Commissioner’s Office at the following address:

Information Commissioner’s Office, Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Please contact us if you have any questions about our privacy policy or the information we hold about you.

You can do so via one of the contact details below:

• Email: dataprotection@emh.co.uk
• Post: Governance & Assurance Team, Memorial House, Stenson Road, Coalville, Leicestershire, LE67 4JP.
• Telephone: 0300 123 6000

We have appointed a Data Protection Advisor to oversee our compliance in line with the UK data protection legislation. If you have any questions about this privacy notice or how we handle your personal information, please contact our Data Protection Advisor using the details above.

Our Data Protection Officer who is registered with the Information Commissioner’s Officer is our Head of Governance and Assurance. Please also contact our Data Protection Officer using the details above.

Our Privacy Notice will be regularly reviewed, and it may change at any time in the future, we encourage you to check this Privacy Notice regularly.