Website Privacy Policy

1 – This privacy policy applies to the website(s) of Bro Myrddin Housing Association at www.bromyrddin.co.uk.  We at Bro Myrddin Housing Association take privacy of personal data seriously. This privacy policy covers the collection, processing and other use of personal data under the Data Protection Act 1998, for which purpose the data controller is Bro Myrddin Housing Association. By using the website of Bro Myrddin Housing Association you consent to this privacy policy and its application to you. We are registered with the Information Commissioner’s Office for this purpose.

Information we collect

2 – We will collect personal data on our above website(s) only if it is directly provided to us by you the user, e.g. your e-mail address, name, home or work address and telephone number, and therefore has been provided by you with your consent. We also use analytical and statistical tools that monitor details of your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data (but this data would not identify you personally).

3 – Your payment information (e.g. credit card details) provided when you make a payment via our website is not received or stored by us. That information is processed securely and privately by the third party payment processors that we use. Bro Myrddin Housing Association will not have access to that information at any time. We may share your personal data with our payment processors, but only for the purpose of completing the relevant payment transaction. Such payment processors are banned from using your personal data, except to provide these necessary payment services to us, and they are required to maintain the confidentiality of your personal data and payment information.

Use, storage and disclosure of your information 

4 – We may hold and process this personal data in accordance with the Data Protection Act 1998 and send you our e-newsletters from time to time, but we will not transfer, share, sell, rent or lease your personal data to third parties 

5 – The information that we collect and store relating to you is primarily used to enable us to provide our services to you. In addition, we may use the information for  purposes including the following:

5.1 – To provide you with information requested from us, relating to our services. To provide information on other services which we feel may be of interest to you, where you have consented to receive such information;

5.2 – To meet our contractual commitments, if any, to you;

5.3 – To notify you about any changes to our website, such as improvements or service/product changes, that may affect our service;

5.4 – To assist fraud protection and minimise risk.

6 – Please be advised that we do not reveal information about identifiable individuals to our any third parties but we may, on occasion, provide them with aggregate statistical information about our visitors.

7 – As part of the services offered to you, for example through our website, the information you provide to us may be transferred to, but not stored in, countries outside of the European Economic Area (EEA) as we use remote website server hosts to provide the website and some aspects of our service, which may be based outside of the EEA, or use servers based outside of the EEA – this is generally the nature of data stored in “the Cloud”. A transfer of your personal data may happen if any of our servers are located in a country outside of the EEA or one of our service providers is located in a country outside of the EEA. If we transfer or store your personal data outside the EEA in this way, we will take steps with the aim of ensuring that your privacy rights continue to be protected, as outlined in this privacy policy and in accordance with the Data Protection Act 1998. If you use our service while you are outside the EEA, your personal data may be transferred outside the EEA in order to provide you with these services.

8 – We do not use or disclose sensitive personal data, such as race, religion, or political affiliations, without your explicit consent. 

9 – Otherwise, we will process, disclose or share your personal data only if required to do so by law or in the good faith belief that such action is necessary to comply with legal requirements or legal process served on us or the website. 

10 – You have the right to opt out of our processing your personal data for marketing purposes by contacting us at [email protected]

Security 

11 – The transmission of information via the Internet or email is not completely secure.  Although we will do our best to protect your personal data, we cannot guarantee the security of data while you are transmitting it to our site; any such transmission is at your own risk.  Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access. 

12 – Where we have given you (or where you have chosen) a password so that you can access certain parts of our site, you are responsible for keeping this password confidential.  You should choose a password it is not easy for someone to guess.

Third party links 

13 – You might find links to third party websites on our above website(s). These websites should have their own privacy policies, which you should check. We do not accept any responsibility or liability for their websites or policies whatsoever as we have no control over them.

Use of cookies 

14 – On occasion, we may gather information about your computer for our services and to provide statistical information regarding the use of our website to our advertisers. Such information will not identify you personally – it is statistical data about our visitors and their use of our site. This statistical data does not identify any personal details whatsoever. Similarly to the above, we may gather information about your general Internet use by using a cookie file. Where used, these cookies are downloaded to your computer automatically. This cookie file is stored on the hard drive of your computer, as cookies contain information that is transferred to your computer’s hard drive. They help us to improve our website and the service that we provide to you. All computers have the ability to decline cookies. This can be done by activating the setting on your browser which enables you to decline the cookies. Please note that should you choose to decline cookies, you may be unable to access particular parts of our website. Our advertisers may also use cookies, over which we have no control. Such cookies (if used) would be downloaded once you click on advertisements on our website.

Access to information 

15 – The Data Protection Act 1998 gives you the right to access information held about you by us. This right can be exercised by you in accordance with the Act – an access request will be subject to a fee, currently of £10, towards our costs of complying with your request for the information we hold about you. Should you wish to receive details that we hold about you, please contact us using the contact details below.

Changes to this policy 

16 – We may update this privacy policy at any time to reflect changes to the above website(s) and customer feedback. Please regularly review this privacy policy to be informed of our current privacy policy. 

We welcome any queries, comments or requests you may have regarding this Privacy Policy. Please do not hesitate to contact us at 

Bro Myrddin Housing Association

Plas Myrddin, Merlin St, Carmarthen, SA31 1RU

or e-mail: [email protected]  

General

Identity and contact details

1.0 – Bro Myrddin Housing Association is a charitable not for profit housing association working to provide a range of housing services to our residents and other stakeholders.

Our head office is located at:

Plas Myrddin, Merlin Street, Carmarthen, SA31 1RU

Telephone: 01267 232714

Email: [email protected]

Data Protection Officer

Name: Rhodri Jones

Telephone: 01267 232714

Email: [email protected]

Purpose of this Privacy Notice

2.0 – This Privacy Notice relates to Bro Myrddin Housing Association and outlines what information we hold about you and how we collect and use your personal data. This privacy notice informs residents, applicants, employees, board members and the public what data is collected and how it is managed by the Association.

Information we may hold about you and how we use it

3.0 – Bro Myrddin Housing Association enters into a contractual obligation with its residents upon completion of a tenancy agreement. By signing the tenancy agreement, Bro Myrddin Housing Association shall be required to process data in order to serve the contract. Other legal basis for processing includes Housing Legislation requirements, the Equality and Diversity Act, and Employment Law.

The information we require from you include the following:

• Full Name (proof of identification – passport, drivers licence, birth certificate)
• Contact Details – Telephone number and Email
• National Insurance Number
• Date of Birth
• Nationality
• Gender
• Photographs
• CCTV Images

We also collect and process the following information on our residents, former residents and prospective residents:

• Household members – Full Name, Date of Birth, Age, Gender, Relationship to main applicant
• Current address, previous addresses and communication preferrences.
• Physical health conditions
• Mental health conditions
• Disabilities, mobility issues, learning difficulties
• Medication details
• Other health, support and behaviour details including drug issues, alcohol issues, criminal convictions and offences, probation details.
• Financial details including current employment, benefits, bank account details, debts, income, pensions, expenditure.
• Special Categories of data including gender identity, marital status, religion, sexual orientation, ethnic group and support needs.
• Children’s personal data, which includes their full name, age and Date of Birth, may be captured as part of the tenancy agreement.

The information we require from potential candidates, board members and employees include the following:

• Recruitment information including references, correspondences, right to work checks and related documents, qualifications, training
• Emergency contacts
• Employment details including start date, contractual terms, job title, previous employment details
• Payroll and bank details
• Pay benefits including pension schemes, incentive schemes and expenses
• Holidays and other leave, sickness absences and medical information, family leave (maternity and paternity)
• Disciplinary, conduct and grievance matters
• Special categories of personal data for equal opportunities and diversity including health, religious beliefs, sexual life or sexual orientation, trade union membership, ethnicity.
• Criminal convictions and offences.

Source of personal data

4.0 – Bro Myrddin Housing Association may collect your personal data directly from you using various methods:

• Application for tenancy and employment opportunity made through telephone, email or visiting at reception
• Face to face pre tenancy interview
• Application through our recruitment online portal

Personal data can also be collected from third party organisations and external sources when you make an application for a tenancy through the council. Further information may be collected from publicly available sources including social media and references from previous and current employers.

In some instances, personal data about someone else may be provided which includes details of an emergency contact and next of kin and details of other household members. In this case, you are required to inform the individual that their personal data will be shared with Bro Myrddin Housing Association and the details of the personal data shared. You must also give them our contact details and let them know that they should contact us if they have any queries about how we will use their personal data.

Why we collect your personal data

5.0 – The lawful basis for processing your personal data may be for one of the following:

• For the performance of a contract
• In our legitimate interest
• As a legal obligation

We collect and process personal data in order to provide you with housing and tenancy services and for the performance of and maintenance of your tenancy agreement. Personal data is also collected for the administration of your employment contract and contract for services.

Personal data is also collected about you for the following purposes:

• To manage tenancies
• To provide services
• To tailor services
• To serve individual needs
• To manage employment in the business
• To process payments
• For health and safety purposes
• To identify other beneficial services to tenants.
• To process your tenancy application or for recruitment purposes
• In order to confirm your identity
• In order to contact you when we need to
• To inform you of other services that may be of interest to you
• To investigate breaches in terms of your tenancy or employment contracts
• In order to manage employment contracts and in our legitimate interest to analyse pay and benefits, make decisions about appropriate compensations, ensure effective business operation, manage performance, ensure appropriate training and qualifications for various roles, to effectively manage disciplinary, grievances and sickness leave and absences, assessment of working capacity.
• In order to manage your tenancy agreement and in our legitimate interest by ensuring maintenance and  repair work are carried out, ensuring your details are updated with various utility companies, ensuring rent arrears are managed.
• To comply with relevant legislation and regulation.
• Personal data on children is required as a legal obligation and in the legitimate interest of Bro Myrddin Housing Association to assess the needs of the residents and to ensure that properties are not overcrowded. Personal data on children is also required if there is a safeguarding or welfare case.
• To meet our legal obligations, such as those relating to equality and diversity, health and safety and safeguarding
• Help prevent and detect crime and prosecute offenders
• Telephone calls are recorded for training and monitoring purposes
• CCTV images are captured at the head office and various housing schemes for the prevention and detection of crime, ASB monitoring and investigation with the police.

Who is your personal data shared with

6.0 – Bro Myrddin Housing Association may be required to share your personal data with various third party organisations from time to time. Personal data will be shared when there is a legal ground under the data protection regulation to do so. Sharing of personal data is also necessary to meet and comply with our contractual obligations and where necessary in our legitimate interest.

Sharing of personal data may include the following:

• With contractors and sub-contractors who carry out various maintenance and building services on our behalf. All contractors and sub-contractors are required to sign and comply with our data sharing agreements
• With utility companies – details of new residents.  Details and forwarding addresses of former residents who have left with arrears.
• Details of residents who have left with rent arrears will be shared with the Associations debt collection agency.
• Personal data may be shared with government departments, councils, with our regulators and auditors, and other legal entities where there is a legal obligation to share your personal data.
• Personal data may be shared with solicitors, insurance brokers and financial advisors.
• Credit check agencies for identification of fraud.

Periods for which we will store your personal information

7.0 – We will only hold your records during the period of our relationship with you and for a set period afterwards to allow us to meet our legal obligations including resolving any follow up issues between us.

Data retention periods vary depending on the type of personal data and the purposes for processing the data.

For more details on our data retention schedule, please contact us at [email protected]

Your rights

8.0 – Under the General Data Protection Regulation and UK Data Protection Legislations, you have a number of legal rights as it relates to your personal data held by us.

These include the following:

• Your right to a subject access request: You may lawfully make a request to receive certain information on how we use your personal data, receive a copy of personal data we hold on you, and check that we are lawfully processing your personal data. If a request is made, you will not be charged and we will aim to respond to your request within 30 calendar days.

In responding to your subject access request, we will firstly ask you to confirm your identity by providing copies of any one of the following: passport, driving licence. If we do hold information about you, we provide you with a description of the data and provide you with a copy of the requested personal data in a legible form or a commonly used electronic form.

• Your right to request that incomplete and inaccurate data are updated appropriately.
• Your right to request that we delete personal data that we hold about you if you no longer wish to use our services or remain an employee / board member or if there is no justifiable reason for us to keep your personal data.
• Your right to object to us processing your personal data if we cannot show a convincing reason for the processing.
• Your right to request us to restrict processing if the accuracy of the personal data is of concern or if you believe the processing is unlawful.
• Your right to data portability and request for us to transfer your personal data to you or another third party in an agreed structured format.

If you would like to exercise any of the above rights, please contact us in writing to Plas Myrddin, Merlin St, Carmarthen, SA31 1RU

Email: [email protected]

If you wish to make a complaint to the Information Commissioner’s Office on how we process and collect your data, you can do so by contacting their Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113 or 01625 545745.