Privacy notice

1.1 The General Data Protection Regulation (GDPR)
1.1.1 The EU Data Protection Directive [95/46/EC], implemented as GDPR came into effect on the 25 May 2018. In the UK, the Data Protection Act 2018 has incorporated GDPR into UK law in full and from 1 January 2021 will be known as the Data Protection Act 2018 and UK General Data Protection Regulation.
1.1.2 For independent advice about data protection and privacy concerns in the UK, you can contact the Information Commissioner (ICO) online at www.ico.org.uk or by phone on 0303 123 1113.
1.1.3 Soha is registered with the ICO as follows:

Soha Housing Ltd registration reference: Z5069196

Soha Response Ltd registration reference: ZB977060

1.2 The Notice
1.2.1 Soha Housing is a successful, award-winning, community-based housing association working in and around Oxfordshire. We are a mutualised organisation meaning that members can get involved, influence decisions and shape the future of Soha Housing. Soha is a non-profit making social business limited by guarantee and registered with the Regulator of Social Housing (RSH). Where we refer to “we” or “us” in this Privacy Notice, we are referring to Soha and its operating structure.
1.2.2 Soha is a “data controller” of your personal identifiable information. The data controller is
responsible for determining the means of collection and the use of this information.
1.2.3 Soha needs to collect and process personal data to deliver services such as:

• Tenancy management & property maintenance services,
• Providing, managing and developing affordable housing,
• Delivering independent living services,
• Helping to support individuals to prosper and contribute to their community,
• Employing people,
• Selling homes.

1.2.5 We are committed to handling your personal information fairly, lawfully and securely in line with current data protection laws.
1.2.6 We take your privacy seriously and this privacy notice explains the categories of personal data we process and for what purposes. It explains the personally identifiable information we will collect and hold about you. This information may be provided by you or from a third party.
1.2.7 By reading this notice you will understand what to expect when Soha processes your personal information and your rights in relation to your data. It applies to information about tenants, homeowners, housing applicants, potential home buyers, employees, job applicants, board members, shareholders, contractors and other service users.
1.2.8 We keep our privacy notice under regular review and we will place any updates on our website (www.soha.co.uk) if you would like to receive a printed copy of our privacy notice, please contact our customer contact centre. This privacy notice replaces any previous notices that we have published about using your personal identifiable information.
1.2.9 If you have any questions about how we use your personal information, our Data Protection Officer can be contacted:
Data Protection Officer (DPO)
Soha Housing,
Royal Scot House
99 Station Road,
Didcot OX11 7NN.
Tel: 01235-515-900 / 0800-014-15-45
Email: dpo@soha.co.uk
1.3 Fair Processing Notice(s)
Soha does not issue individual fair processing notices. Instead we have a single privacy notice. Part 4 and 5 of this privacy notice contains the lawful processing we undertake, the information we require and how we obtain it. When a data subject first presents themselves to us, we will ensure this privacy notice is made available to them and that it is referred to in each of our legal contracts.
Our privacy notice resides on our website. It is either signposted or included as follows:

• in a dedicated section of contracts of employment
• in our board packs
• in our shareholder packs
• in our resident’s handbooks
• on our web-based marketing site where we advertise the properties, we sell
• in our seller’s packs
• in our sign-up packs for new tenants
• in our recruitment packs for new employees
• in our tendering and procurement literature for new contractors and suppliers

The right to be informed

You have the right to be informed about the collection and use of your personal data.

This privacy notice informs you of who is obtaining and using your personal data, how this data will be retained, shared, and secured, and what lawful bases will be used to process it.

The right of access

You have the right to obtain a copy of the personal data we hold relating to you. This is known as a Subject Access Request, or SAR.

A SAR can be made in writing or verbally. We need to confirm your identity before we can proceed, so we ask that your request is accompanied by proof of your address and identity.

If someone is requesting personal data on your behalf, they will need written confirmation from you to evidence your consent for us to release this to them, as well as proof of ID (both yours and theirs).

It helps if your request is as specific as possible. Let us know the types of information you need, the subject matter, and the time frame, and we may be able to respond to you more quickly.

We will provide a response to your SAR within one month of receiving your proof of identity.

The right to rectification

You can ask us to rectify your personal data if it is inaccurate or incomplete. Please help us to keep our records accurate by keeping us informed if your details change.

The right to erasure

The right to erasure is also known as “the right to be forgotten.” In some circumstances, you can ask us to delete or remove personal data where there is no compelling reason to continue to hold it. This is not an absolute right, and we will need to consider the circumstances of any such request and balance this against our need to continue processing the data, and any legal/regulatory requirements for the data.

The right to restrict processing

You can object and ask us to restrict processing if you feel that we are using your personal information unlawfully and/or holding inaccurate, inadequate, or irrelevant personal identifiable information which if used may have a detrimental impact on you and/or has an impact on your rights.

The right to object

You have the right to object to how we use your personal identifiable information in certain circumstances.

The right to data portability

You have the right to obtain and reuse your personal data for your own purposes across different services.

For such companies as utility providers (e.g., gas, electricity suppliers), you can request that information you have provided to them, such as meter readings be transferred to another company.

If the situation arises where it would be helpful for you to move, copy or transfer personal data we hold about you, across different services, you may be able to ask us to do this.

Rights in relation to automated decision making and profiling

You can ask us to review any decisions that are determined by automated means, and object to our use of your personal data for profiling activities.

3.1 If you would like to exercise any of your rights described above in Part 2, report a breach of personal information, or have any queries or concerns about how we use your data, please contact the Data Protection Officer (DPO) at dpo@soha.co.uk

You can also contact the DPO by phone on 01235 515 900 or 0800 014 15 45 (a Freephone number that costs nothing to call).

By post you can write to the DPO at

Data Protection Officer (DPO)
Soha Housing
Royal Scot House
99 Station Road
Didcot
OX11 7NN

3.2 If you feel the DPO has not adequately addressed your issues or concerns, you can raise a formal complaint by contacting complaints@soha.co.uk

You can find out more about our complaints process here .

3.3 If you are unhappy with the outcome of your complaint, you can refer the issue to the Information Commissioners Office (ICO), whose contact details are available on their website.

4.1 Soha is a social landlord which rents and builds homes. It has a Board, shareholders and employs staff. Our lawful processing in summary:

• We manage the tenancies of the people we house.
  The information we need is in relation to housing applicants, our tenants, their household members and the communities they reside in.
• We support our vulnerable customers.
  The information we need is in relation to their health and wellbeing.
• We provide a leasehold service.
  The information we need is in relation to their leases and subleases.
• We sell homes.
  The information we need is in relation to the buyers and their ability to purchase.
• We are accountable to a Board and Shareholders.
  The information we need is in relation to its membership and shares.
• We are an employer.
  The information we need is in relation to job applications, management of staff and their personal development and wellbeing.
• We must meet our obligations to our regulators.
  The information we need is in relation to demonstrating our compliance.
• We keep financial records of payments we make and those we receive.
  The information we need is in relation to the maintenance of these records.
• We keep a record of all our contact with you.
  The information will relate to direct contact with or from you and also with third parties on your behalf in order to provide a service.
• We work with suppliers and contractors.
  The information we need is in relation to our agreements and contracts with them.

4.2 Without this information, we may be unable to adequately provide your services.
4.3 We only use personal information where it is permitted by the laws that protect your privacy rights:

• We need to use the information to comply with our legal obligations;
• We need to use the information to perform a contract with you
• We determine it is fair to use the personal information either in our interests or someone else’s interests, but there is no harm to you as a result – this may include where it is in our interest to contact you about relevant products or services or collaborate with others to improve our services;
• Where we need to seek your consent – If we ask for your consent, you have the right to subsequently withdraw it. We will let you know how to do that at the time we gather your consent.

4.4 Special protection is given to certain kinds of personal information that is particularly sensitive. This is information about your health status, racial or ethnic origin, political views, religious or similar beliefs, sexual orientation, or criminal convictions and allegations. We will only use this kind of personal information where:

We have a legal obligation to do so (e.g. to protect vulnerable people);

• It is necessary for us to so do to protect your vital interests (e.g. if you have a severe and immediate medical need);
• It is in the substantial public interest;
• It is necessary for the prevention or detection of crime;
• It is necessary for insurance purposes; or
• You have specifically given us consent to use the information.

4.5 To fulfil our health & safety and crime prevention obligations and to safeguard the people we work with:

• We process your personally identifiable and special category information for this purpose to meet our legal and regulatory obligations for health and safety and crime prevention.
• We may hold information about vulnerabilities or your behaviour if we need to ensure services are tailored to meet your needs, or to look after our staff or anyone else working on our behalf.
• Indicators may be placed on your record and shared with contractors and subcontractors to ensure health and safety measures are in place. We would have informed you of the reason for this indicator, when it will be applied and for how long. For example, a marker is applied for a tenant with a mobility restriction, to ensure that sufficient time is given for the tenant to answer the door.
• We may capture your image on our CCTV systems if you visit our office or residential buildings covered by this facility. Signage at each location provides details of the purpose of the system.
• If we are conducting investigations, we may use audio recording equipment and you will be advised of this before we commence.

4.6 To monitor our performance:

• It is in our legitimate interests to use your personally identifiable information for this purpose to understand how we are performing so we can meet our goals and objectives.
• We may use your contact details to carry out research and customer satisfaction surveys to help us to monitor our performance and to improve our services to our customers.
• We undertake call recordings for training and quality monitoring purposes.
• To perform statistical analysis to manage and reduce complaints, or to help us target our resources and prioritise services.

4.7 Keeping in touch with you, understanding your needs, and inviting you to events:

•  To fulfil our contractual obligations, we will process your personal information to communicate with you for operational purposes using the most appropriate contact details you have given us e.g. by post, email, text message, or social media.
• It is in our legitimate interests to communicate with you about products and services which relate to services you already receive from us, and to keep you up to date with news and events which meet our objectives around social inclusion and helping to build communities.
• Where you have given us consent to receive marketing, you can withdraw consent and update your marketing preferences by contacting us.
• We have a WhatsApp Channel that we use to keep residents up to date with the latest news from Soha in their community. It is a one-way broadcast, and we do not capture or process your personal information. However, if you choose to follow the channel, you will be sharing some personal information with WhatsApp (owned by Meta Platforms Inc.). For more information on how WhatsApp will process your personal information please see the WhatsApp Privacy Policy.

5.1 Depending on the products and services we deliver to you, the types of personally identifiable information used will vary. We will only collect personal information when we need it. When you provide your information, we will explain why we need it. We will also explain when information is optional and the impact of not providing this.

5.2 Most of the time the personal information we hold about you is information you have given to us or has been gathered by us in order to provide products and services to you under contract.

Employees Personal data for current and former employees is retained under their employment contract.

Job Applicants Personal data is obtained via the recruitment process with their consent and disposed of if they are unsuccessful.

Board Members Personal data for existing Board members is retained for the duration of their office with their consent under a Deed of Service.

Shareholders Personal data for shareholders is held under their share certificate.

Leaseholders and Shared Owners Personal data for current and former leaseholders and shared owners is held under contract in their lease.

Tenants Personal data for current and former tenants is held under contract in their tenancy agreement. Information additional to this may be held for those who receive support or care, and this will be obtained at the point of setting up a plan.

Housing Applicants Personal data is obtained via the application process with their consent and disposed of if they are unsuccessful.

Contractors and Suppliers (including professionals) Personal data may be held under their contracts, agreements and letters of instruction.

5.3 For most products and services, we need to use some or all the following items of personally identifiable information about you, occupants of your home, or your representatives:

a) Personal information

• Contact details – name, address, email, home and mobile telephone numbers;
• Age – date of birth, age range;
• Gender;
• Identification – information to allow us to check your identity (e.g. official documents);
• Financial information – information about your financial circumstances, or where you make payment by credit/debit card;
• Photograph – information to record your identity;
• On-line computer identifiers (IP address) – information recorded when you engage with us electronically;
• National insurance numbers – information to carry out functions such as universal credit and/or personal support services, and;
• Next of kin – contact details.

b) Special category information

• Health – to support our housing functions and vulnerable customers;
• Ethnicity – to support our equality monitoring purposes;
• Religion – to support our equality monitoring purposes;
• Sexual life or sexual orientation – to support our equality monitoring purposes, and
• Convictions – to prevent and detect anti-social behaviour, crime, fraud, anti-money laundering and to aid in the prosecution and rehabilitation of offenders.

5.4 We may collect a reduced set of information for the other occupants of your property unless they also have a direct relationship with us (e.g. obtain services from us directly).

5.5 If you choose not to supply the personal information required, then we may not be able to provide some of our support, products and services.

5.6 We may also obtain information from third parties such as the local authority, your doctor (or other health professional), a previous landlord or another relevant community partner. In addition, we may also obtain information from publicly accessible sources or engage the service of research organisations to validate, or where appropriate, enhance the information that we hold. For example:

• Directly from you – in person, by email, telephone, text message, letter or form;
• By observing how you use our support, products and services from the transactions and operation of your accounts and online services;
• From other organisations such as former housing and support providers, health and social care agencies, law enforcement agencies, debt collectors, energy or utility companies, benefit agencies and/or credit reference and fraud prevention agencies;
• From other people you know and/or are linked to you – for example; a joint tenant, a relative, a person nominated to act on your behalf, your legal representative, or people who live in the same community as you (e.g. those making reports of antisocial behaviour);
• From monitoring or recording calls as part of quality and complaint monitoring. We record these calls for training and to ensure the safety of our staff. We will not record any payment card details as part of our accounts and payments operations;
• From the CCTV systems for the prevention and detection of crime or to detect damage/ vandalism to our properties and to ensure the safety and security of our staff and individuals obtaining services from us.

6.1 We will share your personal information where we need to do that to provide products and services to you, market products and services to you, meet or enforce a legal obligation or where it is fair and reasonable for us to do so.

6.2 Who we share your personal information with depends on the products and services we provide to you and the purposes we use your personal information for. For most products and services, we will share your personal information if it is in our legitimate interests to do so without seeking your consent first. This may be with:

• Our contractors to facilitate repairs, maintenance or improvement works.
• Debt and money management advisors.
• Local authority teams such as social services, environmental health and benefit agencies.
• Utility companies (and their representatives) and Council Tax Departments to ensure billing details are correct.
• Third parties providing services on our behalf. For example, a mailing company distributing our newsletter; a research company carrying out a customer satisfaction survey, or a debt collection agency pursuing former tenant arrears.
• Agencies committed to protecting public funds and/or preventing fraud in line with the National Fraud Initiative.
• Police and other relevant authorities (e.g. Department of Work & Pensions, Probation Service, HM Revenue and Customs) in relation to the prevention and detection of crime, the apprehension of offenders or the collection of tax or duty.
• Other statutory organisations e.g. social services and health authorities as necessary for exercising statutory functions.

6.3 Where the information is of a sensitive nature, for example about your health, we will generally obtain consent from you prior to sharing this information, unless we are required or permitted to share this by law.

6.4 We may also share information when required by law for example where ordered by the Court or to protect an individual from immediate harm.

6.5 Soha will never sell your personal data to third-party organisations for marketing purposes.

6.6 Soha actively works to safeguard children, young people and vulnerable adults from harm. We have a duty to tell Social Services where an individual’s safety is at risk and share information with them, whether reported directly or indirectly to our staff or contractors. This will be undertaken in line with local safeguarding information sharing protocols.

Sometimes we use your personal identifiable information in automated processes to make decisions about you. We do this to help ensure decisions are made accurately, fairly and efficiently and to offer you services tailored to you. You have a right to challenge the validity of any decisions made in this way. You may also ask us not to process your information in this way. Contact us if you would like more information.

To ensure the safety and security of information you provide, it will not generally be transferred or processed outside of the UK and EU. There may be occasions where we need to process your information outside of the European Economic Area (EEA), for example where we use a third-party computer system within the USA to distribute marketing emails or complete internet-based surveys. Where we do this, any personally identifiable information will be limited, we will communicate where the information you provide will be stored, and we will take all necessary steps to ensure that your information remains as secure as possible.

9.1 The length of time we keep your personal information for depends on the services we deliver to you. We will never retain your personal identifiable information for any longer than is necessary for the purposes for which we need to use it.

9.2 Soha will apply appropriate technical and organisational measures to ensure your personal information is secure.
When we need to engage a contractor or third-party suppliers to process your personal information, our contracts with them shall include strict controls on their security and confidentiality protocols.

9.3 To help us ensure confidentiality of your personal information we will ask you or anyone contacted on your behalf security questions to confirm your identity. We will not discuss your personal information with anyone other than you unless you have given us prior written authorisation to do so or where we have received a clear verbal instruction from you.

9.4 If we need to share your personal information with one of our third parties it will be protected with suitable encryption software.

10.1 Information we collect when you visit our website

• Cookies are small text files that are placed on your computer’s hard drive by your web browser when you visit any website. They allow information gathered on one web page to be stored until it is needed for use on another, allowing a website to provide you with a personalised experience and the website owner with statistics about how you use the website so that it can be improved. Some cookies may last for a defined period of time, such as one day or until you close your browser. Others last indefinitely. Your web browser should allow you to delete any you choose. It also should allow you to prevent or limit their use.
• We use cookies in the following ways:
  • to track how you use our website;
  • to record whether you have seen specific messages we display on our website
  • to keep you signed into our site;
  • Analytical/performance purposes – this allows us to recognise and calculate the number of visitors and to see how visitors navigate around the website when they are using it. Therefore, helping us improve our website functionality for example, by ensuring that users can find what they are looking for easily;
  • Functionality purposes – to help us recognise you when you return to our website. This allows us to personalise our content for you and remember your preferences and settings (e.g. your choice of language or region);
  • Recruitment statistics – to allow us to monitor the download statistics of job packs and other downloadable content.
• When you first visit our website, we ask you whether you wish us to use cookies. If you choose not to accept them, we shall not use them for your visit except to record that you have not consented to their use for any other purpose. By choosing this option, you will not be able to use all the functionality of our website.

10.2 Personal identifiers from your browsing activity

This functionality allows us to do the following:

• Requests by your web browser to our servers for web pages and other content on our website are recorded.
• We may record information such as your geographical location, your internet service provider and your IP address. We also record information about the software you are using to browse our website, such as the type of computer or device and the screen resolution.
• We use this information in aggregate to assess the popularity of the webpages on our website and how we perform in providing content to you.
• If combined with other information we know about you from previous visits, the data possibly could in theory be used to identify you personally, even if you are not signed into our website.

We do NOT currently monitor our website in this manner. We review this regularly and may use this functionality in the future to improve our services.

10.3 Third party advertising or notices on our website

• We do not currently have any third-party advertisements on our website. However, we do on social media. If this changes in future, we will update this notice accordingly.
• At present, we may provide information about third party events or services, with a click through link to further information. In doing so, those parties, their agents or other companies working for them may use technology that collects information about you when you use such a link.
• They may also use other technology such as cookies or JavaScript to personalise the content of, and to measure the performance of their adverts.
• We do not have control over these technologies or the data that these parties obtain. Accordingly, this privacy notice does not cover the information practices of these third parties.

10.4 Use of our website by children

• We do not provide services to children directly though we recognise they may be part of the household of one of our residents.
• If you are under 18, you may use our website only with consent from a parent or guardian.
• We collect data about all users of and visitors to these areas regardless of age, and it is possible that from time to time some of those users and visitors will be children.

11.1 Media Consents

Soha may sometimes use images and/or video of our staff and residents for the following reasons:

• Internal or external publicity.
• Social media posts.
• Articles and news stories on our website.

Your consent will be required if you are the direct subject of any of these. However, at community events or larger gatherings we will not seek your consent directly. We will clearly advertise that photography and/or video recording is taking place and that by attending the event you are aware that your image may be taken or recorded. We will keep this data no longer than necessary to fulfil our media requirements. If you decide after the event that you no longer wish us to use this data, then you should submit a Subject Erasure Request.

11.2Expressions of Interest

As remote working has now become the default, we may occasionally need to send items out to staff at their home address. We are currently operating an opt-out policy for this. Staff who do not wish their contact details to be used for this purpose should contact HR and will be placed on an exemption list.