Our privacy policy

Who we are

We are Sutton Housing Society (SHS), a registered provider of social housing. SHS is a charitable organisation registered under the Co-operative and Community Benefit Societies Act 2014 (No.16614R). Our registered office is Pat Shaw House, 13-19 Ventnor Road, Sutton, Surrey, SM2 6AQ.

More information about SHS can be found in our ‘About us’ section.

Who collects your personal data

We, Sutton Housing Society, collect and manage personal data ourselves.

If you have any questions about how we use your personal data (and your associated rights), please send them to our data protection manager at hello@shsoc.org.uk, or by contacting the office on 020 8642 1500.

Alternatively, you can write to us using the address below:

Sutton Housing Society
Pat Shaw House
13-19 Ventnor Road
Sutton, Surrey, SM2 6AQ

Who we share your data with

We only share your information when it is necessary for the provision of a service that you require.

We may share information with contractors or agencies that we work with, such as local authorities, social services, and other social landlords. We will also disclose information to relevant organisations when required by law.

Our staff have restricted access to personal information on a ‘need-to-know’ basis – each member of our team can only access the information relevant to their role and responsibilities.

Please be aware that:

• Your name, address and telephone number(s) will be shared with our contractors when they need to carry out work on your home. This may also include sensitive information that we feel is relevant to the provision of this service. For example, in cases where the resident has difficulty walking, we will advise the contractor that they must allow the resident enough time to answer the front door.
• Current or forwarding addresses may be shared with utility companies and Council Tax offices to ensure billing details are correct.
• If you default on any tenancy conditions, information about you may be provided to authorised debt recovery agencies to enable them to recover the debt. This may affect future applications for tenancies, credit, and insurance.
• We may discuss your financial situation, rent payments (including any arrears) and any claims made for welfare benefits with an external debt advice agency, a welfare rights advisor, the housing benefit department, the department for work and pensions, or the local authorities housing advice and homeless prevention team to make sure that benefits are paid correctly.
• We may pass your contact information to a third party to conduct surveys and research on our behalf to allow us to gather feedback and improve the services we offer you, such as a resident satisfaction survey. The third party will be bound to strict terms and conditions outlined by us and will not share your data with other organisations. Should you choose not to participate in the surveys, the third party will permanently remove your data from their systems.
• We may use your national insurance number to verify your Universal Credit application and manage these payments. We may also share your national insurance number to prevent and investigate fraudulent tenancy and right-to-buy applications.

Unless required or permitted to do so by law, we will not otherwise share, sell, or distribute any of the information we hold without prior and relevant consent.

CORE privacy notice for social housing tenants

Sutton Housing Society, like other providers of social rented housing, work with the government on ensuring data is collected nationally to support future housing provision and decision making. We do this by completing CORE data for every new tenant to our housing. This is then returned to CORE in an anonymised format.

New tenants to our housing are provided with a copy of CORE’s new privacy notice as part of their sign up procedure. CORE have also produced a privacy notice with information for existing tenants, set out below, which we want you to be aware of:

Continuous Recording of Social Housing Lettings and Sales (CORE) Privacy Notice

If your household entered a new social housing tenancy after 1989, social housing providers would have shared your personal information with the government for research and statistical purposes. This information is provided via CORE (COntinuous REcording).

How this information is provided

CORE was set up in 1989 and initially only recorded data from private registered providers, but data from local authority lettings has also been recorded since 2004. It collects information on the tenants/buyers, tenancy/sale and dwelling itself. The Ministry of Housing Communities and Local Government (MHCLG) has been responsible for the management of CORE since October 2015.

Why this information is shared

Information collected via CORE may be shared with other government departments and agencies, for example the Greater London Authority or the Homes and Communities Agency. CORE data providers can also access data for their organisations via the CORE system. Data is only shared for research and statistical purposes.

How this affects social housing tenants

It will not affect your benefits, services or treatments that you get. The information shared is anonymous and handled with care in accordance with the law. We are collecting and sharing your information to help us understand better the social housing market and inform social housing policy.

Additional information

CORE data is collected on behalf of the Ministry of Housing, Communities and Local Government (MHCLG) for research and statistical purposes only. Data providers do not require the consent of tenants to provide the information, but tenants have the right to know how and for what purpose your data is being collected, held, and use. The processing must have a lawful basis, which, in this case, is that the processing is necessary for the performance of a task carried out in the public interest to meet a function of the Crown, a Minister of the Crown, or a government department.

You have the right to object and you have the right to obtain confirmation that your data is being processed, and to access your personal data. You also have the right to have any incorrect personal data corrected.

The information collected via CORE relates to your tenancy, the dwelling you are living in or buying, and your household. Some of the information may have been provided by you as a tenant when signing the new tenancy or buying your property. Other information has been gathered from the housing management systems of social housing providers. Data collected will be held for as long as necessary for research and statistical purposes. When no longer needed, data will be destroyed in a safe manner.

We are aware that some of the data collected is particularly sensitive, including: ethnic group; previous tenure in hospital or prison / approved probation hostel support; if household left last settled home because discharged from prison / long-stay hospital / other institution; or if source of referral is probation / prison, youth offending team, community mental health team or health service. Please rest assured that all the information collected via CORE is treated in accordance with all relevant data protection requirements and guidelines.

Data is published by MHCLG in aggregate form on an annual basis as part of a report and complementary tables.

To access the annual publications on lettings, please visit the Gov.UK social housing lettings page.

To see the publications on sales, please visit the Gov.UK social housing sales page.

CORE data is shared with other public sector bodies for research and statistical purposes only. For example, data is shared with the Homes and Communities Agency and the Greater London Authority to allow them to exercise their role in providing adequate social housing. The detail level data is anonymised and protected to minimise the risk of identification and deposited with the UK Data Archive for research purposes.

If you are unhappy with any aspect of this CORE privacy statement or how your personal information is being processed, please contact the MHCLG Data Protection Officer. If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

When and how we collect your personal data

We collect information in a variety of ways, mainly through physical forms completed by our customers (or on their behalf), but also via forms completed on our website, and information sent to us through the Resident App, on social media, in enquiries that we receive, and through our contractors.

Our day-to-day work entails regular, ongoing contact and correspondence with our residents, and with statutory and non-statutory organisations that provide sustainment services, support and care to those residents and their families, and with people associated with our residents, such as family, friends, advocates, and neighbours.

If we are provided with personal information relating to members of a resident’s family or associates, we will assume that it is done so with their knowledge and consent.

We will use and analyse the information we collect so that we can support, improve, and develop our services.

It is important that you notify us of any changes to your personal information as soon as possible so that we can contact you easily and ensure our records are accurate. From time to time, we may contact you to review the information held to ensure it is accurate and appropriate.

If you change your mind about being contacted once you have provided your contact information to us, please let us know.

Applicant and resident (or tenant) data

We collect and hold personal information about current, former and potential residents (or tenants) who live in our properties or access our support and other services. This can include information about members of their family and people associated with them.

We store this personal data from the time that an applicant is added to our housing waiting list, for the length of time that they are a resident with us, and for at least one year after their tenancy ends.

All tenancy records are retained for one year following the end of tenancy. Records for tenancies that end with a debt of £50 or more are retained for five years.

Telephone calls

We do not record telephone calls to or from our head office, however our telecare alarm and out-of-hours contact partner does record calls for the purpose of ensuring your safety and security, and for their staff training. SHS will only ever ask to hear these recordings if you make a complaint about the way your call was dealt with, if staff are not clear about what was said and we are unable to gain clarity elsewhere, and for staff training purposes.

Mailing lists

We maintain a mailing list for residents that consent to receiving information and updates in a digital format. Our mailing list is not available to non-residents, other than those who we know advocate on behalf of one of our residents.

Residents can unsubscribe from the mailing list at any time by contacting us.

Media content

If you provide us with images or other media, either through the website or by other means, we will collect your name and contact details.

By sending media to us, you are giving your consent for it to be used on our website, in our newsletters and other publications, and for other publicity.

(When providing media, you should avoid supplying images with embedded location data included as visitors to the website can potentially download and extract any location data from these images.)

Surveys, interviews, and events

If you participate in an SHS related survey, interview, or resident or community engagement event or activity, we may collect the following personal information:

• your name and contact details;
• information about you;
• your opinions; and
• information about your activities in relation to the services we provide.

Website analytics

We may use third-party service providers to collect information about your usage of our website to monitor and analyse how our website is being used. This information is anonymous and does not include anything that can be used to personally identify you.

Cookies and third-party content

We use cookies to collect information about how you browse and use our website, what pages you visit, how you entered the site and where you left it.

This data is anonymous and not specific to you. It helps us to make improvements to your website experience by identifying pages where more visitors may be exiting the website or where visitors may be struggling to find necessary information.

For more information about cookies and how we use them, please see our cookie policy.

Embedded content from other websites

Some articles on this website may include third-party embedded content (e.g. videos, images, articles, etc). This content comes from other websites, and those websites may collect data about you and use cookies to embed additional third-party tracking to monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Our cookie controls help to prevent embedded content from loading without your consent if it relies on cookies.

How and why we process your personal data

In relation to becoming a resident

When you apply to become one of our residents (tenants), we ask you to complete a form so that we can assess your housing needs. This information is obligatory, and we have a legitimate purpose for requesting the information.

To help us assess your application, we may obtain references from other housing providers or private landlords, your mortgage lender (if you own or have owned your own home), the police, the probation service, support workers, social workers, mental health workers and credit reference agencies.

As an SHS resident (tenant) we will also need your bank details together with any benefit and council tax information. This information is obligatory, and we have a legitimate purpose for requesting the information so that we can collect rent payments.

Once you become an SHS resident (tenant), your housing application form is stored within your scanned tenancy file and stored electronically. During your tenancy, we will use your contact details to send you information that we are required to issue to you, such as rent statements.

In relation to responding to your enquiries

We will collect information about you whenever you contact us or use our services, and we will record details of any subsequent actions. For example, we store details of repairs and feedback from our contractors about their appointments so that we have a record of what happened, and we record enquiries about transfers and the advice/information provided.

We will keep details about you and your enquiry for a maximum of five years after the enquiry, or after your tenancy if you are a resident. This is to help us respond more effectively to any further enquiries you make in the future.

This processing is considered necessary for the legitimate interests pursued by SHS, i.e. providing information to increase understanding of the services we provide.

We may also carry out analysis of the enquiries we receive, including making links between enquiries and the content we produce. We do this to help us improve the quality and relevance of our communications, and to help increase our engagement with particular groups as part of our work on raising awareness of our organisation.

When we carry out this analysis we remove your personal information – including your name and contact information – and focus on the nature of your enquiry and any details you may have provided about the services you require and your general geographical location. The analysis is not concerned with you as individuals: we do not use the information to identify you as an individual, and the analysis is not linked back to you as an individual.

This processing is considered necessary for legitimate interests pursued by SHS, and necessary for the performance of a task carried out in the public interest, i.e. raising awareness our organisation and what we do, and to share knowledge of interest to the public.

In relation to media content you may send us

The data we process should be provided by you when you share media content with us. It will include your name and contact details. This data is used by SHS staff to contact you in relation to the submitted content and its use.

With your permission, we may use your content on our website and/or other publications with an agreed public attribution, such as your name. We may also share the media content and associated copyright information with our partner organisations.

We will keep details of you and your submission for a maximum of five years, post end of tenancy. This is so we can maintain appropriate records of copyright and usage agreements.

This processing is based on your consent. This means that you have agreed that we can use your data for this specific purpose. You can withdraw your consent at any time. When you are asked for consent, you will also be given details of how to withdraw your consent.

In relation to surveys, interviews, events, and activities you may participate in

The data we process is provided by you when you participate in an interview, survey, event, or activity. It will usually include your name and contact details, as well as potentially your views and opinions on certain subjects related to SHS and the services we provide. With your permission, your contact details may be used by our team to contact you in relation to the interview, survey, event, or activity, and we may analyse your views, opinions, and other responses as part of our research and development.

With your permission, we may include your survey, interview, event, or activity responses and/or input or our analysis of them in publications that we prepare. These publications will usually be available to the public and may be referenced at certain events. We may, with your specific consent, attribute quotes to you in our reports, but otherwise we will make your data and opinions anonymous.

We may share audio recordings of interviews with an external transcription service for the purpose of creating a transcript of the interview. This third party will follow their own data processing procedures as part of their contract with us and will not use the data for any other purpose.

We may take photographs at events and activities that we organise, and these images may be used on our website, in our brochures and other publicity material (such as newsletters), and we may submit them to the media for publication in local newspapers. When becoming an SHS resident (tenant), you will be given a form to sign to indicate whether you are happy to be included in these photographs. You will always be given the option not to be included in photographs at our events. You will be advised when group photographs are being taken, and any individual photographs will only be taken with your consent.

This processing is based on your consent. This means that you have agreed that we can use your data for this specific purpose. You can withdraw your consent up to two weeks after you have completed a survey or taken part in an interview. When you are asked for consent, you will also be given details of how to withdraw your consent, usually by contacting us.

How we hold your data

Data relating to your enquiries to us and our responses, and data relating to the other activities outlined above, is captured through a variety of methods and held within our IT housing management systems, within electronic databases or other filing facilities kept by our team.

Where you give consent to be contacted with further information about our organisation and the services we provide, and where you give consent to be added to our mailing list, your contact details and information about your interests are held within our IT systems and our external mailing system.

In general, we will aim to retain your personal data only as long as necessary for the purposes of the processing outlined above, and any secondary purposes such as audit, regulatory and legal record-keeping requirements. Our contractors will delete any personal data they have at the end of their contract with us.

What happens if you do not provide certain data

If you choose not to provide any of the data outlined above, we will not be able to engage with you in relation to the associated activities. This includes:

• We will not be able to contact you about our services or invite you to events or to take part in surveys or interviews.
• We will not be able to use your media content.
• We will not be able to include or consider your experience, views and opinions in our research and development.

Use of automated decision-making or profiling

The data you provide is not processed by any automated means that involve either decisions being made about your data without any human involvement, or a profile being created based on the evaluation of certain things about you.

Transfer of your data to countries outside the European Economic Area (EEA)

Data protection laws limit our ability to transfer personal data to countries outside the EEA (the countries which are subject to the EU data protection regime or very similar data protection laws). This is to help ensure that a consistent level of data protection applies to your data at all stages of processing, and that you are not exposed to additional privacy risks through the transfer of your data. Transfers of data outside the UK and the EEA are only permitted in certain circumstances.

We have given some information above about specific situations in which your personal data is or may be transferred outside the UK and the EEA. Aside from these situations there may be a transfer of your personal data outside the UK and the EEA in the following circumstances:

• Where we are using a cloud-based IT system to hold your data, such as for third-party transcription and mailing list services, and the data in the cloud is stored on servers located outside the UK and the EEA. In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and/or third party and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK and the EEA.
• Where you are based outside the UK and the EEA and we need to send you emails or other communications as part of a direct response to a communication received from you or for the performance of our contract with you. In these circumstances the data protection laws say that transfer is permitted with your specific consent.

Your rights and how to exercise them

Under the data protection laws, you have several rights in relation to our processing of your personal data:

• Right to be informed: before we collect your data, you have the right to know how it will be collected, processed, and stored, and for what purposes.
• Right to request access: after we collect your data, you have the right to request access to the personal data that we hold about you, and to request information about how we process and store it, and for what purposes.
• Right to correction/rectification: you have the right to supplement or correct your personal data, and to have it deleted or blocked, whenever you wish.
• Right to request erasure (to be ‘forgotten’): if you give us your consent to process your data, you have the right to revoke that consent and to have your personal data permanently deleted from our systems and files, unless we have a legitimate reason for holding this data.
• Right to transfer your data (portability): where we process data that you have provided to us, based on your consent or as necessary for the performance of a contract between us, you have the right to ask us to provide your data in an appropriate format to you or to another controller in a safe and secure way. Wherever technically possible, this also includes the right to have the data transferred directly from one controller to another without your involvement.
• Right to object: you may object to the processing of your data, and we must comply with your objections, unless there are justified grounds for the processing.
• Right to restrict processing: you may restrict the processing of your data, and we must comply with any restrictions you place, unless there are justified grounds for the processing.
• Right to not be subjected to automated decision making and profiling: you have the right to prevent your data from being used to reach a decision about you based solely on automated processing, including profiling.

For more information about your rights, please see the Information Commissioner’s Office (ICO) page on individual rights.

Most of these rights are subject to some exceptions or exemptions, depending on the purposes for which data is being processed. For example, we need to maintain certain records to enable us to provide you with the services you enjoy and to meet the requirements of our Housing Regulator.

The Information Commissioner’s Office (ICO) also advises that individuals have a right to have personal data erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• Where the personal data was unlawfully processed (e.g. otherwise in breach of the GDPR).
• Where the personal data must be erased to comply with a legal obligation.

We may refuse to erase the data in certain circumstances:

• To comply with a legal obligation or for the performance of a public interest task or exercise of official authority.
• For public health purposes in the public interest.
• For archiving purposes in the public interest, scientific research, historical research, or statistical purposes.
• To exercise or in the defence of legal claims.

If you have any questions or concerns about our processing of your data, or if you would like to exercise any of your rights as outlined above, please contact our data protection officer at hello@shsoc.org.uk, or by contacting the office on 020 8642 1500.

Subject Access Request

If you would like to make a formal request in relation to the personal information we hold about you, there is a process for this under the Data Protection Act 2018 known as a Subject Access Request (SAR).

When submitting a SAR, please note:

• The right to request access under the Data Protection Act 2018 is an individual one – we cannot process joint requests.
• You can write to us to make your request and, if necessary, we will provide you with a SAR form for completion. Please send your request to: Data Controller, Pat Shaw House, 13-19 Ventnor Road, Sutton, SM2 6AQ.
• We will require proof of your identity and address, and we will confirm this with you when we receive your request.
• When we receive your request and have confirmed your identity to our satisfaction, we shall respond and provide your information within one calendar month.

Compliance with data protection legislation

We will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. We will share information when necessary to meet our statutory requirements.

If we fail to comply with the Data Protection Act 2018, and you suffer damage as a result, you have the right to make a claim for compensation.

If you have concerns about our data processing or consider that we have failed to comply with the data protection legislation then you have the right to make a complaint to the relevant supervisory authority, which in the UK is the Information Commissioner’s Office (ICO).

Changes to our privacy policy

We may amend this policy from time to time to reflect changes to the way in which we operate or changes to data protection legislation. We will aim to bring any significant changes to your attention; however, we suggest that you review this policy when possible to make sure that you stay up to date.

These terms were most recently updated on 28 February 2024.