Privacy Policy

Last updated June 2019

Thrive Homes respects your privacy and is committed to protecting your personal data. This privacy notice applies if you are a customer, visit our website, contact us by email, social media, phone, write to us, or visit us in person.

Purpose of this Privacy Notice
The aim of this privacy notice is to give you information on how Thrive Homes collects and processes your personal data in order to conduct normal business activities as a UK charitable housing association. Normal business activities include:

Providing social and other types of housing;
Property and grounds maintenance and repair;
Managing your housing, tenancy/lease and account as your landlord.

Your privacy is important to us, which is why we only collect the information we need from you and your household to provide you with our services. We take great care to ensure the information we collect is kept confidential and handled responsibly in accordance with the Data Protection legislation.

Who we are
Thrive Homes is the controller and responsible for your personal data (collectively referred to as “Thrive Homes”, “we”, “us” or “our” in this privacy notice).

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details below.

Data Protection Officer
Thrive Homes Limited
Westside
London Road
Hemel Hempstead
HP3 9TD

Email address: GDPR@thrivehomes.org.uk

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

The data we collect about you
The type of information we collect depends on our needs. For example, if you contact or visit us, we may need some personal information to deal with your query. If you are a customer, we require sufficient personal information to ensure that we can provide you with appropriate housing, comply with the terms of your tenancy agreement, or refer you to the appropriate support services to assist you.

Personal data, or personal information, means any information that can identify a person whether directly or indirectly e.g. name or customer reference number.

If you are one of our customers we collect, use, store and transfer different kinds of personal data about you, which include:

Name
Address
Contact details (Phone & email address)
Present, previous and forwarding addresses
Gender
Date of Birth
Marital Status
Rent payment details
Bank details
Housing benefit
Employment details
National Insurance number
Health and care details
Basic details (name and DOB) of all household residents
Disability*
Race *
Religion or belief*
Sexual Orientation*
Anti-social behaviour, violence and criminal activities
Complaints

*Special Categories of Personal Data (formerly referred to as sensitive personal data, include personal information such as: race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation (for more detail on why and on what legal condition we might process some of this information about you please see below).

Equality Act 2010 and Thrive Homes General Public Sector Equality Duty

Thrive is responsible for promoting equality of opportunity and ensuring its customers have equal access to our services in accordance with the Equality Act 2010. The Equality Act 2010 makes discrimination unlawful in relation to age, disability, gender, marriage (civil/same sex), pregnancy/maternity, race, religion, gender re-assignment, sexual orientation. These characteristics are known as the 9 protected characteristics.

As a social housing provider, Thrive is required to comply with its General Public Sector Equality Duty in the allocation and management of social housing to its customers and to give ‘due regard’ to the need:

to eliminate discrimination, harassment and victimisation
to advance equality of opportunity
to foster good relations by tackling prejudice and promoting understanding

Thrive ensures fair treatment for all members of the community, regardless of race, ethnic origin or nationality; gender; disability, whether mental or physical; religion; marital or family status; sexuality or sexual orientation; age or physical appearance.

Where appropriate and in accordance with legislative requirements, Thrive will use information on the 9 protected characteristics on an anonymised basis to monitor compliance with the Equality Act 2010. This means reports produced in relation to monitoring compliance for Equality and Diversity purposes will have personal data removed so a customer cannot be identified on a report.

When Thrive processes personal data that requires explicit consent (refer to below table), we will always seek your informed consent by explaining how and why we intend to process your personal information and by acquiring your explicit written permission to do so. If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawing your consent may affect the services that are available to you but, this will be explained in the withdrawal of consent form. If you decide, you want Thrive to cease processing your special category personal data you must make a written request to: GDPR@thrivehomes.org.uk.

PROCESSING OF CUSTOMERS’ PERSONAL DATA

GDPR
For any ‘processing’ of personal data to be lawful, the reason for the processing must meet one of the legal conditions in Article 6 of the GDPR. If the personal data includes ‘special category’ data it must also meet one of the additional legal conditions in Article 9 of the GDPR or Schedule 1 of the Data Protection Act 2018. Legal conditions relevant to Thrive’s relationship with you are detailed in the table below.

[Processing means collecting, recording, organising, structuring, storing, modifying, consulting, using, publishing, combining, erasing, and destroying personal data]

Protected Characteristic	Article 6 Lawful basis of processing	Article 9 ‘Special Category’	Customers Proposed ways of using the data to promote or maintain equality of opportunity, and to ensure that customers are treated in line with the general public sector equality duty.
Age	Compliance with a Legal Obligation	n/a	To review complaints and feedback to ensure there is equality in the way we treat customers with regards to age. To consider customers age when allocating specific types of properties where there are restrictions. To consider any variation to a service because of age.
Disability*	Compliance with a Legal Obligation	Equality of opportunity or treatment- Schedule 1, Part 2 Section 8, DPA18	To review complaints and feedback to ensure there is equality in the way we treat customers. To adapt our methods of contact/engagement/ communication as appropriate. To consider any variation to a service because of disability.
Gender (sex)	Our legitimate business interests	n/a	To review complaints and feedback to ensure there is equality in the way we treat customers.
Pregnancy and maternity	Consent	Explicit consent	To review complaints and feedback to ensure there is equality in the way we treat customers.
Marriage and civil partnership	Necessary to enter into or fulfil our Contract with you	n/a	To ensure that services are provided appropriately where customers are married or in a civil partnership.
Race or ethnicity*	Consent	Equality of opportunity or treatment- Schedule 1, Part 2 Section 8, DPA18	To review complaints and feedback to ensure there is no discriminatory attitudes or practices from employees, partners, contractors, suppliers, customers. To consider any variation to a service because of race or ethnicity.
Religion or belief*	Consent	Equality of opportunity or treatment- Schedule 1, Part 2 Section 8, DPA18	To review complaints and feedback to ensure there is no discriminatory attitudes or practices from employees, partners, contractors, suppliers, customers. To consider any variation to a service because of religion or belief.
Gender re-assignment*	Consent	Equality of opportunity or treatment- Schedule 1, Part 2 Section 8, DPA18	To review complaints and feedback to ensure there is no discriminatory attitudes or practices from employees, partners, contractors, suppliers, customers. To consider any variation to a service because of gender re-assignment.
Sexual orientation*	Consent	Equality of opportunity or treatment- Schedule 1, Part 2 Section 8, DPA18	To review complaints and feedback to ensure there is no discriminatory attitudes or practices from employees, partners, contractors, suppliers, customers. To consider any variation to a service because of sexual orientation.

Our landline phone calls are recorded for training and monitoring purposes and our recordings are usually held for a period of six months (unless they contain your explicit consent to send you information on surveys, marketing information etc.).

Some of our locations and offices have CCTV and you may be recorded when you visit them. CCTV is used to provide security and to protect both our visitors and communities. CCTV will be only be viewed when necessary (e.g. to detect or prevent crime) and footage is stored for set period of time after which it is recorded over. Thrive complies with the ICO’s CCTV Code of Practice and we put up notices so you know when CCTV is used.

We may also take photographs at our events, at our properties and in our communities to use for general marketing and publicity. However, photographs of individuals will only be used for marketing and publicity with your explicit consent.

We also collect, use and share Aggregated Data such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your website usage data to calculate the percentage of users accessing a specific website feature.

However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data, which will be used in accordance with this privacy notice. Thrive Homes does not normally process children’s information as part of a tenancy, as all tenants are adults. However, we record children’s basic information if they are resident in one of our properties, including their name and date of birth. This is required for checking the property is not overcrowded and to assess other tenancy management issues where all householders and ages are required to be known.

We may also, receive children’s information if we are involved in the housing and tenancy aspects of a welfare case as part of a multi-agency working solution.

Information from Third Parties
When you apply to become a Thrive Homes customer, we request and hold on file any references necessary to assess your application including as appropriate (but not limited to) references from other housing providers/private landlords, your mortgage lender (if you own/have owned your own home), the Police, the Probation Service, support workers, social workers, mental health workers and credit reference agencies. If you provide us with personal information relating to members of your family or your associates we will assume that you do so with their knowledge.

Changes to your personal data
It is important that the personal data we hold about you is accurate and current. Please help us by keeping us informed if your personal data changes during your relationship with us

If you fail to provide personal data
If you do not provide the information that we need to enter a tenancy or lease we may not be able to provide all our services to you, and ultimately you may not be able to hold a tenancy or lease with us, or sell or purchase a property through us.

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract (i.e. tenancy or lease) we are about to enter into or have entered into with you
To provide the services you need including repairs, maintenance, rents, transfers, sales and anything to do with your tenancy and property
To deal with your account(s) including payments, grants and benefits or run any other service we provide to you
To manage applications made by you
To provide a helpful and efficient response when customers ask for help and advice
To deal with complaints
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
To monitor equality of opportunity and the treatment of persons with protected characteristics
To take photos of you (only with your written consent)

We will only contact you with direct marketing communications should you consent to receive them. You have the right to withdraw your consent to marketing at any time by either writing to us or sending an email to: GDPR@thrivehomes.org.uk

Change of purpose
We will only use your personal data for the purpose for which we collect it.

If we need to use your personal data for another purpose, we will notify you and we will explain the legal basis, which allows us to do so.

Please note that we may process your personal data where this is required or permitted by law e.g. providing information to the Housing Benefits Agency.

Disclosures of your personal data
We may have to share your personal data with contractors in order for them to carry out repairs or refurbishments on our behalf.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Sometimes we may have to share personal information for legal reasons, for example with the Police, appropriate agencies, other landlords, or if it relates to anti-social behaviour, safeguarding, crime or fraud.

If you want to authorise someone to access your personal data and act on your behalf, please contact us by either writing to us or sending an email to: GDPR@thrivehomes.org.uk

If you wish to withdraw your permission to allow someone to access your personal data on your behalf, you must notify us in writing by either writing to us or sending an email to: GDPR@thrivehomes.org.uk

International transfers
Thrive Homes ensures personal data transfers to recipients in the United States of America are registered under the Privacy ShieldEU/US Privacy Shield scheme.

Transfer of personal data to the EEA is covered by GDPR legislation.

Should this change in the future we will only transfer your personal data to a country outside the European Economic Area (”EEA”), provided one of the following conditions applies:

The country to which your personal data is transferred ensures an adequate level of protection for your rights and freedoms
We have your consent
The transfer is necessary under regulation, in the performance of our contract with you, or to protect your vital interests
The transfer is legally required on important public interest grounds or for the establishment, exercise or defence of legal claims
The transfer is authorised by the relevant data protection authority where we have given adequate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights

Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available in our Data Retention and Minimisation Policy, which you can request from us by contacting us. Your personal data will be held for a period of 7 years after your tenancy ends.

In some circumstances you can ask us to delete or remove your personal data where there is no good reason for us continuing to process it. We may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Cookie Policy
Please see our Cookie policy

Your rights
Under the GDPR you have rights regarding the personal data that Thrive Homes process and hold about you. Please see below:

Right of access	You have the right to obtain confirmation from Thrive Homes as to whether or not personal data concerning you are being processed, and, where that is the case, in most but not all cases, access to that personal data.
Right to rectification	You have the right to oblige Thrive Homes to rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.
Right to erasure (right to be forgotten)	You have the right (under certain circumstances, but not all) to oblige Thrive Homes to erase personal data concerning you.
Right to restriction of processing	You have the right (under certain circumstances, but not all) to oblige Thrive Homes to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.
Right to data portability	You have the right (under certain circumstances, but not all) to oblige Thrive Homes to provide you with the personal data about you which you have provided to Thrive Homes in a structured, commonly used and machine-readable format. You also have the right to oblige Thrive Homes to transmit those data to another controller.
Right to withdraw consent	If the lawful basis for processing is consent, you have the right to withdraw that consent.
Right to object to direct marketing	Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.
Rights in relation to automated decision making and profiling	Thrive Homes does not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.

If you would like to contact us then you can email us at GDPR@thrivehomes.org.uk or call us on 08700 917 6077. We will ask you to provide proof of identity before disclosing any information. It is free to use these rights, but Thrive Homes reserve the right to charge a reasonable fee if we feel there are excessive requests.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

In some circumstances we can refuse to comply, if this is the case it will be explained to you. Please note that your right to see certain information may be limited. For example, if it may affect a police investigation or a criminal prosecution then we are not permitted to disclose the information to you.

If you believe our records are inaccurate, you can write to us, asking for them to be amended. If you believe we have unfairly withheld information or unfairly refused to amend our records, you can make a complaint using our standard complaints procedure. Alternatively, you can contact the Information Commissioner’s Office.

In order to ensure that we keep up with the law and other developments, we may revise or update this privacy notice from time-to-time.