Privacy Notice for Origin Housing Sales
Last updated 6 September 2018
Personal data we collect
When you register an interest in buying a home from us or apply to live in one of our homes, we collect the following personal data about you:
- Name and title
- Address and former addresses
- Telephone number and email addresses
- Data of birth
- Copies of proof of identity and address documents
- Information relating to members of your household, including their names, dates of birth and contact details
- Information about any disabilities or special requirements that you or members of your household have
- Information about your employment, employment history and earnings
- Details of your deposit and savings
- Details of any existing relationship or transactions between us
We collect personal data directly from you when register an interest in buying a property from us, such as when you fill out one of our forms or submit your details through our website. We also collect your personal data if you live with someone who has registered with us and they have provided your details to us. We also collect personal data about you from other sources, including our panel solicitors and mortgage advisers, if you use their services.
How we use your personal data
|What we use your data for
||The lawful grounds for processing your data
|Creating a profile about you based on the personal data you have provided to us, so we can understand you better as a customer and provide you with a more personalised experience. [This may include using automated profiling.]
It is in our legitimate interests to understand your requirements and to serve you better as a customer.
When processing personal data you have provided to us about disabilities or health or medical requirements that you or members of your household have, we do so with your explicit consent.You can tell us to stop sending you marketing information at any time by objecting or by withdrawing your consent.
Sending you information about our shared ownership and market sales properties which we think may be of interest to you based specific information such as your preferred area.
It is in our legitimate interests to send you marketing and promotional materials from time to time.
Where we have obtained your consent to send marketing we rely on consent as the legal basis.
You can do so by contacting us at email@example.com or by using the unsubscribe link in any marketing email you receive from us.hich we think may be of interest to you based specific information such as your preferred area.
|Managing and developing our relationship with you, including inviting you to participate in surveys.
||It is in our legitimate interests to develop our relationship, collect your feedback, improve our products and services and continually improve based on your feedback to better serve you.
|Sharing your personal data with our recommended third-party service providers (such as mortgage advisers and conveyancers) so they can contact you about their services. We also share your information with our website provider, Full Comms, who will contact you from time-to-time about appropriate properties and services.
||With your consent, we will provide you with details about such parties before asking consent to share your contact details with them.
Our trusted provider, Full Comms, is compliant under the new GDPR regulations and endeavor to keep your personal information safe and secure.
Responding to correspondence you send to us.
It is in our legitimate interests to respond to your correspondence, including enquiries, complements and complaints.
|To the extent that we rely upon consent as the legal basis under which we use your data, then you are permitted to withdraw your consent at any time.
Your rights about automated decision-making and profiling:
We may make automated decisions and use automated processing of personal data to evaluate certain things about you.
Preventing and detecting fraud
We also use your personal data to prevent and detect fraud and to investigate fraud that we reasonably think might have been committed. This involves comparing your information with information held by third parties, such as the Land Registry, banks, schools and utility companies, solely for the purpose of preventing and detecting fraud. We use your data for this purpose as it is in our legitimate interests to ensure individuals do not defraud us. It is also in the legitimate interests of our customers and the public in general to ensure that fraud is detected and prevented.
Website Visitors, Cookies and Web Beacons
To learn more about cookies and web beacons and what you can do to opt-out of receiving them, please view our Cookies Notice.
Our website includes links to third party sites. These sites may collect your personal data if you follow them or use the embedded content. We link to third party sites including Twitter and Facebook. If you follow these links, our privacy notice no longer applies and the data controller is the website provider (such as Twitter or Facebook). Please read the privacy notices provided by the third party sites for more information on how they collect and process your personal data.
Sharing your data
Who we share your personal data with
We may share your data with:
- Third parties who partner with us to deliver services, such as mortgage advisers, conveyancers and our website provide, Full Comms, if we have you consent to do so.
- Legal and professional advisers acting on your behalf in relation to the purchase of a home from us.
- Third parties with whom it is necessary to share your personal data for the purpose of managing any request or complaint you have made to us, such as the Housing Ombudsman service.
- Third parties such as the Land Registry, banks, schools and utility companies where it is necessary for the purposes of preventing or detecting fraud.
- Third parties who provide you or us with services, including our IT and cloud software and service providers
- All third-party service providers to Origin Housing (our data processors) with whom we share your personal data are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
- We also share your personal data with our professional advisers, including our lawyers and auditors where it is strictly necessary or to comply with applicable laws or with valid legal processes, such as in response to a court order.
Location of your personal data
We do not transfer your personal data out of the UK, but our IT and cloud service providers may transfer the personal data we store on their systems outside the European Union, to data centres located in other countries, such as the USA. Where this happens, we will ensure that appropriate safeguards are in place that ensure your personal data is protected to the standard expected in the European Union. These safeguards typically include standard contractual clauses approved by the European Commission for international transfers or (in the case of processors located in the USA) participation in the EU-US Privacy Shield Framework.
How long we store your data
We only retain your personal data for as long as necessary to fulfil the purposes we collected it for. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may continue to use your information without it being connected to you.
Our Data Retention Policy sets out the retention periods for the different types of information we collect and hold. Please contact us is you would like to know the retention period applicable to your personal data.
How we protect your data
We have implemented appropriate technical and organisational measures to prevent the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data.
We apply information governance and security best practice. We have implemented appropriate policies and procedures and provide all employees with information security and data protection awareness training. We restrict access to personal data to only those employees who need to know it for the purposes of their role. We have implemented technical security controls and have back-up and disaster recovery systems in place.
Data subject rights
You have the following rights in respect of your personal data:
- You have the right of access to your personal data (commonly known as a “subject access request”) and can request copies of it and information about our processing of it.
- If the personal data we hold about you is incorrect or incomplete, you can ask us to rectify or add to it.
- Where we are using your personal data with your consent, you can withdraw your consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose/s you originally agreed to, unless we have another legitimate basis for doing so by law.
- Where we are using your personal because it is in our legitimate interests (or those of a third party) to do so, you can object to us using it this way.
You can ask us to restrict the use of your personal data if:
- It is not accurate;
- It has been used unlawfully but you do not want us to delete it;
- We do not need it any-more, but you want us to keep it for use in legal claims; or
- if you have already asked us to stop using your data but you are waiting to receive confirmation from us as to whether we can comply with your request.
- In some circumstances, you can compel us to erase your personal data or request a machine-readable copy of your personal data to be transferred to another service provider.
How to exercise your rights
If you wish to exercise your rights, please contact us using the information provided below.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Lodging a complaint with the ICO
You can also lodge a complaint with the Information Commissioner’s Office. They can be contacted using the information provided at: https://ico.org.uk/concerns/.
You can contact us about data protection by:
St Richards House
110 Eversholt St
You can also contact our data protection officer by emailing firstname.lastname@example.org
We may update this Privacy Notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to services we offer. When changes are made, we will update the ‘Last Updated’ date at the top of this page. Please review this Privacy Notice periodically to check for updates.