Home – Privacy Policy
We are committed to protecting and respecting your privacy and this policy tells you how we look after your personal data, what your privacy rights are and how the law protects you
Broadacres Housing Association (we or us) are committed to protecting and respecting your privacy. This privacy policy will inform you as to how we look after your personal data, tell you about your privacy rights and how the law protects you.
This policy aims to give you information about how we collect and process your personal data. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
It is important that you read this privacy policy together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements the other notices and is not intended to override them.
We may update this privacy policy at any time. We display a date at the top of this privacy policy so that you will know when there has been a change. You should check the Broadacres webpage on a regular basis for our most current privacy practices.
We are Broadacres Housing Association Limited, a not for profit housing association based in Northallerton in North Yorkshire with our registered office at Broadacres House, Mount View, Standard Way, Northallerton, North Yorkshire, DL6 2YD. We own and manage more than 6,000 homes and we provide a range of services in relation to both property services and broader social welfare in the community.
We are a “data controller” in respect of the information we hold about you. This means that we are responsible for deciding how we use your personal information. We are registered as a data controller with the Information Commissioner’s Office (the ICO) with registration number: Z6826705.
The person responsible for data protection at Broadacres is our Data Protection Officer. If you have any concerns or questions about our use of your personal data, or any requests to exercise your legal rights, you can contact our Data Protection Officer as follows:
Data Protection Officer Broadacres House, Mount View, Standard Way, Northallerton, North Yorkshire, DL6 2YD.
Email: dataprotection@broadacres.org.uk
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect the following types of personal data from you which we have grouped together as follows:
Some of the information which we collect may be special categories of personal data (also called sensitive personal data). Special categories of personal data require a higher level of protection. The special categories of personal data about you which we may collect include:
The above information which we collect about you will be obtained through a variety of sources which include:
Automated technologies or interactions. As you interact with our website, self-service portal or Broadacres self-service app, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookies Policy for further details: Please see our Cookies Policy for further details.
When CRAs receive a search from us they place a search “footprint” on your credit file whether or not the application proceeds. Records remain on file with CRAs and FPAs for 6 years after they are closed, whether settled by you or defaulted. More information about CRAs and how they use personal information is available at: https://www.experian.co.uk/crain/index.html or you can contact the agencies below:
· Callcredit Consumer Services Team, PO Box 491, Leeds, LS3 1WZ Tel: 0330 024 7579 or visit www.callcredit.co.uk
· Equifax PLC Credit File Advice Centre, PO Box 3001, Bradford, BD1 5US Tel: 0870 010 0583 or visit www.equifax.co.uk
· Experian Consumer Help Service, PO Box 8000, Nottingham, NG80 7WF Tel: 0870 241 6212 or visit www.experian.co.uk
For more information about FPAs and how they use personal information, you can contact Veritau of County Hall Northallerton DL7 8AL Tel: 01609 535034 or visit www.veritau.co.uk
We use your personal data in the following ways and for the following purposes:
To manage our relationship with you which will include:
Our lawful basis for using your information under GDPR and the DPA 2018:
6(1)(b) Contract: It is necessary in order for us to perform our contract with you or to take steps before entering into a contract.
6(1)(c) Legal obligations: It is necessary to meet our legal obligations.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (for the running of our business, the improving of our services, enabling board members to hear customer insights first hand, and ensuring our customers are safe and supported).
9(2)(g) Substantial public interest: DPA Schedule 1 Part 1 (8) Equality of opportunity of treatment*.
To administer and protect our business, this website, our self-service portal and the Broadacres self-service app (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business re-organisation or group restructuring exercise).
To use data analytics to improve our website and self-service applications to ensure that content is presented in the most effective manner for you and for your device.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (to define types of customers for our products and services, to keep our website and self-service applications updated and relevant).
To perform our obligations under our tenancy agreement with you and to manage your tenancy, including to repair or maintain the property, to manage payment of rent and service charges, to arrange appointments for pre-inspection and maintenance/repairs, to create and collect direct debit payment for rent, to manage arrears (including entering into debt agreements and trace of customers), to inform of annual rent and service charges, to investigate and manage claims of anti-social behaviour and hoarding, to communicate about leasehold management, to alert staff and contractors to visit in pairs, to recharge for private repairs, , to execute internal property surveys, to undertake decarbonisation/energy efficiency works on properties, and to defend any legal claims.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights
To enable us to provide you with use of our services including our housing support services. This may include applying for a place in one of our support schemes, provision and tailoring of catering services (to account for allergies, dysphagia and other dietary requirements or to invoice for extra menu choices), to carry out home security checks, to assess suitability for sheltered housing, to vet applications for various support programmes and assess suitability for these services by gaining a full understanding of the individual’s needs.
We may also use long term heath information to ensure we design services that meet customer needs, ensuring fair and equitable access to our services (including necessary adaptations).
6(1)(b) Contract: It is necessary in order for us to perform our contract with you or to take steps to enter into a contract.
6(1)(a) Consent: Where there is not a contract in place between us, or the processing goes beyond our obligations under the contract, and you have given your consent.
6(1)(d)_Vital interests: It is necessary to protect your vital interests or those of another person (in relation to the provision of catering services)
9b) and DPA 2018 Schedule 1 Section 10 part 1 (1) Social protection: Where you choose to share information relating to your health, we will process your information in line with our obligations to you as a housing, health and social care provider*.
9(2)(g) Substantial public interest:
Safeguarding children and individuals at risk – 18 (1)(a) , Schedule 1, DPA 2018*
Support for individuals with a particular disability or medical condition – 16(1)(a), Schedule 1, DPA 2018.
To keep you updated about Broadacres’ work in the community and to provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes. To record key moments of corporate history, use for press releases, corporate communications and branding and to manage press relations for Broadacres.
6(1)(a) Consent: where you have given your consent for us to contact you with updates our work and information, products or services that we feel may interest you.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (for the running of our business and the improving of our services).
To adequately deal with your requests, appropriately manage any services we provide to you and handle any complaints you make, including to provide assistance with making welfare benefit claims, promotion of and provision of free money advice services, and to enable you to apply for DRO or bankruptcy.
6(1)(f) Legitimate interest: It is necessary for our legitimate interests where they are not overridden by your rights (to help us continually improve our services, support you in maintaining your tenancy, handling of non-customer complaints and provide our money advice service).
6(1)(c) Legal obligations: It is necessary to meet legal / regulatory obligations.
9(2)(g) Substantial public interest *
DPA 2018 Schedule 2 Para 19 (1) Safeguarding of economic wellbeing of certain individuals*.
Article 9 2(b) Social protection*
DPA 2018 Schedule 1, Part 1 (1) (social security and social protection)*.
To comply with our legal obligations such as in the prevention, detection and investigation of fraud and corruption (inc tenancy fraud); to provide appropriate disability adjustments to a property, to deal with insurance claims, to enable payment of Universal Credit and Housing Benefits, to take tenancy enforcement action, to assist tenants exercising a preserved right to buy housing, to ensure health and safety of customers, and to share information with the Insolvency Service.
6(1))f) Legitimate interests: It is necessary for our legitimate interests (for ensuring homes are allocated in accordance with our charitable objectives and tenancy agreements).
9(2)(b) and DPA 2018 Schedule 1 Section 10 part 1 (1) Social protection *
To assess your suitability and eligibility for the tenancy/lease (or other agreement including for supported housing) you have applied for/requested (including conducting credit checks), to provide information about the NY Homechoice application, to verify suitability and eligibility for property succession; and to assist with the preserved right to buy or the right to acquire.
To arrange appointments with relatives and appointed persons of tenants for pre-inspection and maintenance activities relating to the tenancy.
6(1)(b) Contract: It is necessary in order for us to perform our contract with you.
To record calls for training and monitoring purposes (such as through the recordings of telephone calls with our call centre handlers or repairs team).
6(1)(f) Legitimate interests: It is necessary for our legitimate interests (for the running of our business and the improving of our services).
To enable us to process your property enquiry or progress your purchase of one of our properties from application through to completion and handover (i.e. shared ownership and other affordable sales), or purchase an additional percentage of a shared ownership property. We also will handle defects relating to your property purchase.
To enable us to remotely monitor the quality of our homes, to monitor the effectiveness of works undertaken, to support early identification of, and proactive management of issues that could impact a customer’s health and wellbeing.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (for improving the quality of our homes)
Use of CCTV footage and dashcams to prevent and detect crime, assist in the management of buildings, protection of assets and ensure customer safety.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (to help keep our assets and customers safe).
Monitoring diversity: We will use information about your ethnicity, religious beliefs, martial or civil partner status, gender, age, disability, sexual orientation or gender reassignment to ensure meaningful equal opportunity monitoring and reporting.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (to ensure equal opportunity monitoring and reporting).
DPA 2018 Schedule 1 Para 8(1)(b) Equality of Opportunity or treatment: It is necessary for equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained through service design*.
To send you details of properties we have for sale or events we are holding (direct marketing) that you may be interested in.
6 (a) Consent.
* This is an additional lawful basis which under Article 9 of GDPR (and the Data Protection Act 2018 in specific circumstances) we need to rely on in order to use special categories of personal data.
We will share your personal information with third parties where required by law, where it is necessary to administer our relationship with you or where we have another legitimate interest in doing so.
Some “third parties” are service providers (including contractors and designated agents) carrying out activities on our behalf. Other third parties will be data controllers in their own right. This means that they are not required to act on our instructions, and they are solely responsible for ensuring that they comply with the law when using your personal data. We are not responsible for their use of your data if we are acting lawfully whenever we share your data with them.
We may disclose your personal information with the parties set out below:
We strive to provide you with choices regarding certain personal data uses, particularly around marketing.
If you are an existing customer, we may contact you by electronic means (email or SMS) with information about goods and services similar to those which were the subject of a previous dealing with you.
If you are not yet a customer, we may process your personal data to send you marketing by electronic means, but we will only do this if you have consented to such marketing.
You may opt out by emailing info@broadacres.org.uk or by contacting us on 01609 767900.
We will not sell our marketing data to third parties without your consent.
We may collect the following types of personal data from you as a colleague (whether prospective or current) which we have grouped together as follows:
Some of the information which we collect about you may be “special categories of personal data”. Special categories of data require a greater level of protection. The special categories of personal data about you which we may collect include:
Workplace adjustments / health and safety: We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits and sick pay, and to facilitate work or volunteer placements.
We may also track your location to ensure you are safe when working alone via our lone worker system.
9(2)(b) and DPA 2018 Schedule 1 Section 10 part 1 (1) Employment: It is necessary for us to carry out our rights and obligations as your employer.*
Monitoring performance (such as conducting performance reviews; managing performance and determining performance requirements; considering education, training and development requirements (including completion of training modules); assessing qualifications for a particular job or task, including decisions about promotions); managing subscriptions; conducting regulatory compliance checks.
6(1)(f) Legitimate interest: It is necessary for our legitimate interests (where they are not overridden by your rights).
9(2)(b) and DPA 2018 Schedule 1 Section 10-part 1 (1) Employment: It is necessary for us to carry out our rights and obligations as your employer.*
Payment and salary related activities (such as making payments to you, deducting tax and National Insurance contributions, liaising with your pension provider; making decisions about salary reviews and compensation), processing expense claims, or applying corporate credit cards and processing corporate credit card expense claims.
To process your job/role application including conducting reference checks, driving licence checks, DBS application and accompanying evidence, assessing conflicts of interest and entering into the employment contract.
Providing the employee benefits to you including providing you with a company vehicle, pension and other employee benefits.
6(1)(a) Consent: We will seek your consent in order to share your personal data (including information about your health) with third party providers of benefits.*
6(1)(f): Legitimate interests: It is necessary for our legitimate interests (where they are not overridden by your rights).
Day to day employment activities such as administering the contract we have entered into with you, regulatory referrals, business management and planning, including accounting and auditing, vehicle allocation, compliance with driving at work policy, electric fleet home charging cost reimbursement, defect management, to provide a uniform and ID badge, defending legal claims and assessing conflicts of interest, including provision of stakeholder and governance newsletter to board members.
Grievance, disciplinary or legal disputes (such as gathering evidence for possible grievance or disciplinary hearings; dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work).
9(2)(f) Legal claims: It is necessary for the establishment, exercise or defence of legal claims.*
Determining your continued employment / engagement such as making decisions about your continued employment or engagement, making arrangements for the termination of our working relationship and receiving feedback, and providing job vacancy alerts.
6(1)(a) Consent: We will only collect and use this information if you have provided your consent for us to do so (for job vacancy alerts).
Determining eligibility and management of board members and shareholders such as keeping a register of members and directors as required under the Companies Act 2006, recording conflicts of interests (including public register), maintaining board minutes and ensuring accuracy by using audio recordings of meetings, sharing contact details, processing applications for shareholders, inviting shareholders to AGMs, appointing and recruiting board members, monitoring board diversity, adhering to probity policy and publishing board member profiles on the website.
Monitoring your health and safety, such as ascertaining your fitness to work, monitoring compliance with health and safety obligations (such as incident reporting and monitoring, annual health surveillance, HAVs monitoring and mask face fit tests).
9(2)(f) Legal claims: It is necessary for the establishment, exercise or defense of legal claims.*
DPA 2018 Schedule 1 Section 10 part 1 (1) Employment: It is necessary for us to carry out our rights and obligations as your employer.*
DPA Schedule 1 Section 10 part 2 Health: It is necessary to assess the working capacity of our employees.*
6(1)(a) Consent: In certain situations, we may require your consent in order to obtain and disclose information about your health.*
Monitoring your use of our information and communication systems to ensure compliance with our IT policies; to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
To comply with our legal obligations such as to prevent fraud and equal opportunities monitoring, including conducting DBS checks and checks on the right to work in the UK.
Staff surveys to receive your views on the ways in which we could improve our services and improve your employment environment.
Monitoring diversity: We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sex life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
Trade unions: We will use trade union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations.
To manage public relations: We will use information about key moments in corporate history for press release, corporate communications, branding and will publish photos and videos in the “Weekly Big Listen” and for other internal company communications.
6(1)(a) Consent: We will only collect and use this information if you have provided your consent for us to do so.
6(1)(f) Legitimate interest: It is necessary for our legitimate interests where they are not overridden by your rights(to maintain records of corporate history).
To administer and protect our business, including provision of general administration and IT services, monitoring compliance with our IT policies and ensure network and information security.
We may use machine learning/artificial intelligence to monitor our IT systems (including emails) to help keep personal data safe and prevent data loss.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (for running our business, provision of administration and IT services, network security, to prevent fraud, data loss and in the context of a business re-organisation or group restructuring exercise).
To use data analytics to improve our website to ensure that content from our website is presented in the most effective manner for you and for your device.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (to define types of customers for our products and services, to keep our website updated and relevant).
Use of CCTV footage and dashcams to prevent and detect crime, assist in the management of buildings, protection of assets and ensure colleague safety.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (to help keep our assets and colleagues safe).
* This is an additional lawful basis under Article 9 of GDPR (and the Data Protection Act 2018 in specific circumstances) which we need to rely on in order to use special categories of personal data.
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
Some ”third parties” are service providers (including contractors and designated agents) carrying out activities on our behalf. Other third parties will be data controllers in their own right. This means that they are not required to act on our instructions, and they are solely responsible for ensuring that they comply with the law when using your personal data. We are not responsible for their use of your data if we are acting lawfully whenever we share your data with them.
Communicating with you: to communicate with you about products, services and projects, placing orders for works to be carried out, responding to any inquiries or requests, and for general contract management purposes, including our stakeholder newsletter.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights.
Planning and administering our relationship with you: such as entering into and performing a contract, sourcing services and professional advice on governance matters, managing the supply service, performing transactions and orders of products or services, billing and processing payments, auditing and arranging shipments and deliveries.
Negotiating and selling land to individuals from corporate landowners, processing applications to purchase a dwelling, selling Broadacres affordable housing property or facilitating the increase/disposal of an interest in affordable housing; including corresponding with estate agents and solicitors.
Compliance with legal obligations: such as record keeping obligations, money laundering checks, providing advice and audit services, providing financial information to funders and Regulator of Social Housing.
Resolving disputes: such as enforcing contractual arrangements, entering into dispute resolution processes and establishing, exercising or defending legal claims.
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights. (For running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business re-organisation or group restructuring exercise).
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights. (To define types of customers for our products and services, to keep our website updated and relevant).
Use of CCTV footage and dashcams to prevent and detect crime, assist in the management of buildings/vehicles and keep everyone safe.
6(1)(f) Legitimate interests: It is necessary for our legitimate interests where they are not overridden by your rights (to help keep our assets, colleagues, and visitors safe).
We may share your personal information with third parties where we have a lawful basis for doing so.
The types of third parties with whom we share your personal data are as follows:
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how processing for the new purpose is compatible with the original purpose, please contact our Data Protection Officer by writing to Broadacres House, Mount View, Standard Way, Northallerton, North Yorkshire, DL6 2YD.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allow us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We store your personal data on our servers which are located within the United Kingdom (UK), however we may need to transfer data outside the UK as a result of some of the service providers we use. Before we transfer your personal data outside of the UK, we will ensure that there is adequate protection in place to ensure the security of your data. Please ask us if you would like to see a copy of these agreements with third parties in respect of data transfers.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal, accounting or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Under certain circumstances, by law you have the right to:
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us by writing to us at: Data Protection Officer , Broadacres Housing Association, Broadacres House, Mount View, Standard Way, Northallerton, North Yorkshire, DL6 2YD or email us at dataprotection@broadacres.org.uk. We may request proof of your identity before sharing such information with you.
If you have any questions, would like to exercise any of your rights or make a complaint, please contact us by writing to us at: Data Protection Officer, Broadacres Housing Association, Broadacres House, Mount View, Standard Way, Northallerton, North Yorkshire, DL6 2YD; email us at dataprotection@broadacres.org.uk or call us on 01609 767900.If we are unable to resolve your complaint you may contact the Information Commissioner’s Office at the Exchange Tower, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone number: 0303 123 1113.
Please email us at info@broadacres.org.uk or contact us using the link below.