Privacy notice
Your privacy is important to us and we understand how important it is to you.
Our Privacy Notice tells you about the type of information Southdown collects and processes, what we do with it, what we do to keep your information secure, your rights, and how to contact us.
Registration with the Information Commissioner's Office
Southdown Housing Association is registered as a Data Controller with the Information Commissioner’s Office (www.ico.org.uk), registration number Z6895951.
Clients and tenants
(Please note the following applies to services who use Southdown recording systems. Some of our services access data through other organisation’s recording systems, such as where we have staff based in GP practices, in which case your worker can refer you to the Privacy Notice of that organisation).
Southdown collects, stores and processes (uses) personal data for several purposes, mainly:
- To provide care and support services to our clients and tenants
- In our role as landlord to our tenants
We will only process your personal information for one of the following reasons:
- We have a ‘legitimate interest’, for example in order to fulfil the requirements of our support service contracts with our commissioners
- We have a contract with you that we can only fulfil by using your personal information
- We have obtained your consent to do so
- There is a substantial public interest to ensure equality of opportunity and treatment and to safeguard children and individuals at risk
The types of personal data we hold about individual clients and tenants will vary according to the services provided, and the reporting requirements of our commissioners. The table below highlights the types of personal data that we use, what we use it for and the legal basis for this.
If you are a client or tenant and access more than one Southdown service, some information may be shared between these services to ensure your safety, to give you a better service and to ensure the safety of our staff.
The data we process, why we process it and the lawful basis for this
Below is each type of information we hold about you, why we use it, and the legal reason we’re allowed to.
| Type of data and examples | Purpose | Legitimate interest |
|---|---|---|
| Basic personal information like your name, address, age and contact details. | To keep a record of your relationship with us and enable us to provide services to you. To inform you of further care and support services available to you. To periodically send satisfaction surveys to current and recent clients to help us understand the quality of support we have provided and improve our services moving forward. | We need this information to provide you with a service. Contract - if you're a tenant, we also need it for the tenancy agreement we have with you. |
| Record of your care, support and services provided | To ensure we can provide high quality, appropriate care and support, and to safeguard individuals from harm. To ensure any services to whom we refer you can also provide appropriate care and support. To report against performance measures set by the organisations who fund and commission our services. In addition, if you are a tenant, to ensure we can undertake services we are legally obliged to provide, for example landlord health and safety. | Legitimate interest. Safeguarding the health and wellbeing of clients and tenants. Contract - to fulfill our obligations as a landlord. |
| Emergency contact/next of kin details | To help us keep you safe. | Legitimate interest |
| Health information | To ensure we can provide safe and appropriate support service. To monitor whether our services are having a positive impact on individuals. To report against performance measures set by the organisations who fund and monitor our services. | Legitimate interest / substantial public interest (monitoring equality of opportunity or treatment, support for individuals with a particular disability or medical condition). |
| Safety & risk information. | To ensure we keep you, our staff and colleagues from other organisations safe. | Legitimate interest. |
| Equalities monitoring data such as, for example, racial or ethnic origin, religious beliefs and sexual orientation. | To ensure the client / tenant services we provide are equitable and do not inadvertently discriminate against specific groups. To report against performance measures set by the organisations who fund and commission our services. | Health or Social Care. Substantial public interest (monitoring equality of opportunity or treatment). Legitimate interest (where we have to report on equalities data to our funders/commissioners). |
| Photographs/videos/audio (eg sound bites and client / tenant stories or quotes. | To promote Southdown services. | Consent |
| Details of any complaints made | To help us investigate and resolve the concerns raised and improve our services as a result. | Legitimate interest. |
| CCTV images. | To help us keep you, our staff and visitors safe. For the prevention and detection of crime. | Legitimate interest / legal obligation. |
| Criminal offence data | To ensure the safety of our staff, clients, tenants and others coming into contact with Southdown. | Legitimate interest. Health or social care purposes. Safeguarding of children and individuals at risk. |
Who we share your data with
| Recipient / category of organisation | Purpose | Lawful basis |
|---|---|---|
| NHS services. | To ensure continuity and consistency of support where services are provided in partnership with the NHS. To report against performance measures set by the organisations who fund and commission our services. | Legitimate interest. |
| Other voluntary, community or social enterprise agencies. | To source additional support where agreed with a client / tenant that this would be beneficial to them. | Legitimate interest. |
Other landlords (applies to tenants only). | Where this is needed to ensure the safety of, and maintain the condition of, a property. To protected people's safety (eg yourself, neighbours and contractors). When Southdown is transferring a property over to a new landlord. | Contract. Legitimate interest. |
| 3rd party software providers. | We use external companies to host a number of databases and/or undertake other data processing for us, for example our client survey. | Legitimate interest. |
| Sub-contractors. | We use sub-contractors to provide some of our property safety / maintenance services for our tenants. | Contract. |
| Solicitors. | We may share personal data with solicitors in the course of obtaining legal advice and support. | Legitimate interest. |
| Local authorities, NHS and other relevant legal / statutory bodies. | Coroner's reports, inquests, domestic homicide reviews, raising safeguarding concerns, safeguarding adults reviews, child protection cases, serious case reviews, serious untoward incidents. | Legitimate interest, legal obligation, vital interests. |
| Commissioners. | We may be required to share data with our commissioning organisations as part of our contractual obligations. This could be, for example, if Southdown were to stop providing a particular service and we need to pass on personal information via the commissioning body allow a new organisation to take over providing the service to you. In these cases the commissioner will be a 'Joint Data Controller'. To report against performance measures set by the organisations who fund and commission our services. | Legal requirement. |
| The police. | To support law enforcement and public protection | Legal requirement. |
| Interpreting service providers. | To enable us to support clients / tenants where English is not their first language. | Legitimate Interest. |
| Debt collection agencies or tracing services. | To recover rent arrears. | Legitimate interest. |
Transferring information outside the UK and European Economic Area (EEA)
We do not transfer any client / tenant data outside the UK/EEA.
How long we keep your data
We will keep your personal information for a reasonable time after you have stopped receiving care, support (or for tenants after your tenancy has ended) to ensure that any ongoing obligations can be complied with and we have the records we need as required by our insurance in the event of a complaint or claim. We will not keep your personal information for longer than is necessary.
Employees and job applicants
Southdown collects, stores and processes (uses) personal data to process job applications and undertake our obligations as an safe and effective employer.
We will only process your personal information for one of the following reasons:
- We have an employment contract with you
- To comply with legal obligations
- We have a ‘legitimate interest’ in the course of running our business
- We have obtained your consent to do so
- There is a substantial public interest to ensure equality of opportunity and treatment and to safeguard children and individuals at risk
The data we process, why we process it and the lawful basis for this
| Type of data and examples | Purpose | Lawful basis |
|---|---|---|
| Identification - for example your name, staff ID, nationality, national insurance number, bank details, qualifications. | To pay you and arrange your benefits. To comply with the law and our obligations as your employer. To communicate with you. To comply with our financial and regulatory obligations. To verify applicants and staff have the right to work in the UK and the necessary qualifications / suitability for a role. | Legal obligation / contract. |
| Contact details. | To pay you and arrange your benefits. To help us keep you safe. | Legal obligation / contract. |
| Emergency contact / Next of kin details. | To help us keep you safe. | Legitimate interest. |
| Job details - including your hours, salary, benefits and training record. | To pay you and arrange your benefits. To manage our workforce and keep track of your career. To comply with our financial and regulatory obligations. | Legal obligation / contract / legitimate interest. |
| Employment references provided to and by Southdown. | To assess the suitability of candidates for Southdown roles. To enable other organisations to assess the suitability of a Southdown employee who has applied for one of their roles. All references are treated in confidence. | Legitimate interest. |
| Performance and disciplinary information. | To ensure our employees are complying with our policies and procedures. | Contract. |
| Absence and working time information. | To pay you and arrange your benefits. To comply with the law and our obligations as your employer. | Legal obligation / contract. |
| Organisational data including IDs for IT systems. | To operate our IT systems and keep them secure. | Legitimate interest. |
| Photographs/videos/audio (eg sound bites and client / tenant stories or quotes. | To promote Southdown services. | Consent. |
| CCTV images, telephone, email, and internet usage records. | To help us keep you and our visitors safe. To ensure our employees are complying with our policies and procedures. For the prevention and detection of crime. | Legitimate interest / legal obligation. |
| Travel and expenses. | To pay you and arrange your benefits. To comply with the law and our obligations as your employer. | Legal obligation / contract. |
| Equalities monitoring information. | To ensure the employment services we provide are equitable and do not inadvertently discriminate against particular groups. To better understand our people and the way they interact with us, whether they are staff, volunteers, supporters, or service users. | Legitimate interest. Health or social care. Substantial public interest (monitoring equality of opportunity or treatment) / legal obligation. |
| Health and medical data. | To help us keep you safe. | Legitimate interest. |
| Criminal offence data. | To ensure the safety of our staff, clients, tenants and others coming into contact with Southdown. | Legal obligation. Employment. Safeguarding of children and individuals at risk. |
| Details of other work or activities that could affect your work at Southdown. | To ensure there are no conflicts of interest. | Legitimate interest. |
| Safety & risk information | To ensure we keep you, our clients and visitors safe | Legitimate interest |
Staff have the option to use facial/fingerprint recognition on their work issued mobile phones. This is completely your choice and alternative security options are available. If you chose to use this feature, your biometric data will only be stored on the device itself. All devices are wiped once returned.
If you are required to clock in and out of your service you have the option to do this using an App on your personal or work phone, or via an on-site tablet device. If you choose to use your personal or work mobile, your location at the time of clocking in/out will be stored in our workforce scheduling database.
You will also need to have enabled your camera to use the App and a photo will be taken each time you clock in/out. You can choose to cover the camera but be aware any photo taken will be stored in the same database. Both the location and photo data is subject to the same retention period as your core employee record.
Who we share your data with
| Recipient / category of organisation | Purpose of sharing | Lawful basis |
|---|---|---|
| External regulators, courts and other authorities - for example HM Revenue and Customs, the Office for National Statistics, the Care Quality Commission. | Tax and law enforcement. To fulfil our obligations as a large employer. To ensure the services we provide are safe. | Legal obligation. Safeguarding of children and individuals at risk. |
| Third parties who provide support services to us (for example our DBS checking service, pensions provider, staff benefits platform and our auditors). | To process staff pay and benefits. To undertake pre-employment checks. | Contract. Legitimate interest. Safeguarding of children and individuals at risk. |
| Third parties who 'process' data on our behalf (for example the company the helps us with our staff survey, the company that provides our HR & payroll IT system, our health & safety database, and our lone worker devices. | To process staff pay and benefits. To store staff training records. To undertake our staff survey. To record health & safety information. To keep staff safe. | Legitimate interest. |
| Other employers (reference requests). | To allow organisations to assess the suitability of Southdown employees / ex-employees for job roles they have applied for. All references are treated in confidence | Legitimate interest |
| Commissioners. | To meet the requirements of external reviews aimed at keeping clients and staff safe. | Legitimate interest. |
| The police. | To support law enforcement and public protection. | Legal requirement. |
| Partner organisations where Southdown staff work on their premises. For example, where we have staff working in GP practices we may need to evidence our staff have the right to work in the UK. | To enable those organisations to meet their obligations under the law and keep their clients and staff safe. | Legitimate interest. |
Transferring information outside the UK and European Economic Area (EEA)
We do not transfer any client / tenant data outside the UK/EEA.
How long we keep your data
We will not keep your personal information for longer than is necessary.
Unsuccessful job applicants: We will keep your application form on file for 12 months.
Employees: We will keep your personal information for a reasonable time after you have left to ensure that we have the records we needs in the event of a dispute or regulatory investigation and to ensure that any ongoing obligations can be complied with, such as requests from regulators and information we are required to keep by HM Revenue and Customs.
Professional stakeholders
Where provided to us, we hold professional stakeholder contact details. These may be shared with partner organisations where necessary, eg to respond to a request.
They may also be added to mailing lists (you will be informed of this before processing). Our lawful basis is Legitimate Interest. Should you wish to have your contact details removed from our records, please contact the sender of the mailout you have received.
Agency staff
Southdown collects, stores and processes (uses) personal data to undertake our obligations in providing safe services for clients, and ensuring we provide the required information back to provider agencies to ensure agency staff are appropriately paid.
The data we process, why we process it and the lawful basis for this
| Type of data and examples | Purpose | Lawful basis |
|---|---|---|
| Identification and contact details. For example, name, phone number | To communicate with you. To help keep you safe. | Legitimate interest. |
| Details of your Right to Work, DBS, your training record and professional registration. | To ensure you are suitable for the work assignment. To help keep clients safe. | Legitimate interest. Safeguarding of children and individuals at risk. |
| Details of your hours worked, and your rate of pay. | To ensure you are paid correctly. To ensure we are invoiced correctly. | Legitimate interest. |
| Performance information. For example, supervision records. | To ensure you are working to the required standards and Southdown policy. | Legitimate interest. |
| CCTV images, telephone, email and internet usage. | To help keep you and our visitors safe. | Legitimate interest. |
| Safety & risk information. | To help keep you, our clients, staff and visitors safe. | Legitimate interest. Legal requirement. |
Who we share your data with
| Recipient / category of organisation | Purpose of sharing | Lawful basis |
|---|---|---|
| Regulators such as the Care Quality Commission. | To ensure the services we provide are safe. | Legal obligation. Safeguarding of children and individuals at risk. |
| Your employing agency. | To ensure you are paid correctly. To ensure we keep clients and staff safe. | Legitimate interest. Safeguarding of children and individuals at risk. |
| Third parties who 'process' data on our behalf. For example, the company that provides our invoicing or roster systems. | To ensure you are paid correctly. To ensure we keep clients and staff safe. | Legitimate interest. |
| The Police. | To support law enforcement and public protection. | Legal requirement. |
Transferring information outside the UK and European Economic Area (EEA)
We do not transfer any agency staff data outside the UK/EEA.
How long we keep your data
We will not keep your personal information for longer than is necessary.
We will keep your personal information for a reasonable time after you have stopped working in Southdown services to ensure that any ongoing obligations can be complied with and we have the records we need as required by our insurance in the event of a complaint or claim.
Volunteers
Southdown collects, stores and processes (uses) personal data to process volunteer applications and manage and support our volunteers.
We will only process your personal information for one of the following reasons:
- To comply with legal obligations
- We have a ‘legitimate interest’ in the course of running our business
- We have obtained your consent to do so
- There is a substantial public interest to ensure equality of opportunity and treatment and to safeguard children and individuals at risk
The data we process, why we process it, and the lawful basis for this.
| Type of data and examples | Purpose | Lawful basis |
|---|---|---|
| Identification and contact details - for example your name, phone number, address | To communicate with you. To help keep you safe | Legitimate interest |
| Emergency contact | To help keep you safe | Legitimate interest |
| Details of previous experience, skills, references | To assess suitability for a role and shortlist volunteer applications | Legitimate interest |
| Details of your volunteering assignments | To manage our volunteer activity To help keep you safe | Legitimate interest |
| Performance information | To provide and supportive and safe environment To ensure volunteers are complying with our policies and procedures | Legitimate interest |
| Equalities monitoring information | To ensure the volunteering opportunities we offer are equitable and do not inadvertently discriminate against particular groups | Legitimate interest Health & social care Substantial public interest (monitoring equality of opportunity or treatment) |
| Health & medical data | To help keep you safe | Legitimate interest |
| Criminal offence data | Legal obligation Safeguarding of children and individuals at risk | |
| Photographs/video/audio (eg sound bites, volunteer stories, quotes) | To promote Southdown services. To train Southdown employees and volunteers | Consent |
| CCTV images, telephone, email and internet usage records | To help keep you and our visitors safe To ensure our volunteers are complying with policies and procedures For the prevention and detection of crime | Legitimate interest / legal obligation |
| Safety & risk information | To ensure we keep you, our clients, staff and visitors safe. | Legitimate interest. |
Who we share your data with
| Recipient / category of organisation | Purpose | Lawful basis |
|---|---|---|
| Third parties who provide support services to us (for example our DBS checking service or our auditors) | To undertake checks on volunteer applicants To review our processes to ensure they are safe | Legitimate interest Safeguarding of children and individuals at risk |
| Third parties who process data on our behalf (for example companies that provide our IT software) | To store volunteer records To record health & safety information | Legitimate interest |
| The police | To support law enforcement and public protection | Legal requirement |
Transferring information outside the UK and European Economic Area (EEA)
We do not transfer any volunteer data outside the UK/EEA.
How long we keep your data
We will not keep your personal information for longer than is necessary.
We will keep your personal information for a reasonable time after you have stopped volunteering for us to ensure that any ongoing obligations can be complied with and we have the records we need as required by our insurance in the event of a complaint or claim.
Your rights
You have a number of rights in relation to your personal data. These include:
The right to be informed
You have the right to be informed as to why your personal data is needed for processing, how we will use the data and what will be done with it.
The right of access
You have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy, we may charge a fee.
The right to rectification
You may have the right to rectify inaccurate or incomplete personal data concerning you.
The right to erasure (right to be forgotten)
You may have the right to ask us to erase personal data concerning you.
The right to restrict processing (right to object)
Under certain circumstances you may have the right to object to the processing of your personal data including any profiling being carried out on your personal data. This can include requesting human intervention with regards to an automated decision that was made, so that you can express your view and contest the decision
The right to data portability
You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and you may have the right to transmit that data to another entity
Rights in relation to automated decision making and profiling
Under certain circumstances you may have the right to object to the processing of your personal data including any profiling being carried out on your personal data. This can include requesting human intervention with regards to an automated decision that was made, so that you can express your view and contest the decision.
Artificial Intelligence - How We Use Your Personal Data Alongside AI Tools
Where we process your personal data using AI Tools it is to improve the efficiency, quality, and speed of our business processes. A lot of these processes are already happening manually.
Using AI allows us to use our resources where they are needed most. Any supplier who has access to your data is assessed for compliance with Data Protection legislation before any information is processed by them.
Automated Decision Making: We do not solely use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions aren’t made solely by automated means.
Cookies
Like most websites, southdown.org uses cookies. Cookies are small text files stored on your computer by your browser and are used for many things, such as remembering whether you’ve visited the site before.
What are cookies?
There are two broad categories of cookies:
Session Cookies: These remain on your device until you close your browser when they are automatically deleted; they are generally used in order for the site to operate.
Persistent Cookies: These remain on your device for a longer period and can be deleted manually or automatically depending on the duration rules.
How do we use them?
We use cookies for the following purposes:
- To let you do things on our website – for example, if you make a donation or shop and pay for goods via our online shop, cookies remember where you are in the process from page to page.
- To analyse the performance of our website – for example, collecting anonymous statistics on the use of our website; we use Google Analytics for this.
- To improve your experience of our website – for example, make navigation easier, allow our web pages to be displayed correctly, remembering your preferences, privacy choices etc.
- Social media – for example, if you use Facebook, Twitter or other social media that we’re linked to, cookies can help smooth the sharing process between our site and your online feeds.
Will cookies collect my personal data?
The cookies used by Southdown on this site are conceived so as to be used only by us or those 3rd parties working on our behalf.
Can I disable or clear cookies?
Cookie technology does not collect information that allows you to become personally identifiable. It might be used to identify you as a unique but anonymous visitor to a website.
You are free to disable and/or clear some or all of the cookies our website leaves on your device at any time; however, please note that the website may not work properly if you do this.
You can turn off cookies by using the cookie settings on our site:
Or use the available tools on your browser which allow you to do this, these are usually found in your browser’s ‘Options, Settings, or Preferences’ menu. You can also visit ‘All About Cookies’ www.allaboutcookies.org for further information.
Google Analytics
This site also uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to help the website analyse how users use the site.
The information generated by the cookie about your use of the Site (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators, and providing other services relating to website activity and internet usage.
Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google.
By using this site, you consent to the processing of data about you by Google in this manner and for the purposes set out above.
National data opt-out
Southdown reviews all our data processing on an annual basis to assess if the national data opt-out applies. This is recorded in our Record of Processing Activities.
All new processing is assessed to see if the national data opt-out applies. If any data processing falls within scope of the National Data Opt-Out we will use MESH to check if any of our service users have opted out of their data being used for this purpose.
At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential patient information we process on an annual basis to see if this is used for research and planning purposes.
If it is, then individuals can decide to stop their information being shared for this purpose. You can find out more information at https://www.nhs.uk/your-nhs-data-matters/.
Contacting us
If you have any concerns about how Southdown uses your data you can speak to your support worker, housing officer or (for staff) manager, or you can contact our Data Protection Officer via DPO@southdown.org.
If you wish to make a complaint about the way Southdown has used your personal data, you can use our Have Your Say form.