Privacy notice

"Personal data" means any information that can identify you, either on its own or with other details we have.

We collect different information depending on what you need from us.

• If you just contact us, we only need basic details to help you.
• If you’re a customer, we need more information to manage your home and support you. This can include your contact details, financial information (such as information regarding benefits), and health details (such as disabilities or support needs).
• Sometimes, we also collect information to meet legal requirements. This may include information to support safeguarding duties or for tax purposes.
• If you work for us, we need information to handle your job application or to pay you.

Below is a summary of why and how we use your data:

We only use your data for its intended purposes, keep it only as long as needed, and may share it where required to provide services or meet legal obligations. (further details on how long we keep your data is found later in this policy and is documented in our Data Retention Policy). 

If you provide information about others (e.g. household members), please ensure they are aware of this Privacy Notice.

In order to comply with UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018, Cottsway ensures that the processing of your data is fair, lawful and transparent. To achieve this, how we use your data will be limited to one or more of the following legal basis:

Enter into, or manage any contract we have with you, including (but not limited to):

• Processing applications and requests for: rental accommodation, home ownership, garage rental
• Managing tenancies including collecting rent and service charges 
• Ensuring compliance with the conditions of any agreement between us
• Providing repairs, maintenance and adaptions at our properties
• Providing home ownership products
• Processing orders and managing our professional relationship, if you are a supplier or contractor
• Employment contracts to ensure we are fulfilling our obligations as an employer

Provide you with services in our legitimate interests including (but not limited to):

• Assisting you in the management of account charges, payments and arrears, including through our online portal
• Providing support services to help customers achieve their goals
• Keeping in touch with customers to understand your needs and preferences and invite you to events, and to notify you about changes to our service
• Engaging with customers to make improvements to our products and services
• Resolving enquiries and complaints
• Providing training from external providers to our employees

Comply with our legal and regulatory obligations, and acting in the public interest, including (but not limited to):

• Preventing and detect crime and resolve disputes
• Preventing and detect fraud and money laundering
• Promoting the health & safety of our employees, by recording and monitoring accident reports
• Promoting safety and the quiet enjoyment of our neighbourhoods and communities
• Promoting equal opportunities and fair treatment for all
• Meeting the obligations we owe to our funders and regulators
• Submitting employee information to the HMRC for tax purposes

Where you have given your consent

In most instances, ‘consent’ will not be the most appropriate legal basis for our processing of your personal data. This is because one of the above legal bases may be more appropriate, or where it is a necessity out of law to process your data, withdrawal of consent may not be able to be to be actioned.

However, where we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. This may affect the services that we can make available to you, but this will be explained when we gain your consent.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your vital interests (or someone else’s vital interests) - this is often in the case of life-saving interventions.

Sensitive personal information

When the personal information we process about you is classed as sensitive (criminal offences information and ‘Special Category Personal Data’ such as your health, sexual orientation and ethnic origin), we must have an additional lawful basis for such processing. This is because this type of data may result in greater risk of harm to the individual should a breach or loss occur. As such, Cottsway will only process this data where necessary, and justified with one of the following legal bases:

• Where you have given your explicit consent
• It is necessary under laws relating to social security and social protection 
• Where we need to protect your vital interests (or someone else’s vital interests)
• It is necessary in connection with legal proceedings 
• It is necessary for reasons of substantial public interest (for example: equality monitoring, preventing or detecting unlawful acts, preventing fraud).

The use of AI will be restricted to internal processes only, such as in the formatting of internal documents, or helping us source important information within our internal communications and reports. This may include data relating to our customers and their tenancies.

These technologies are used to support our operations, improve efficiency, and enhance the quality and timeliness of the services we provide.

The introduction of AI does not change the original lawful basis which is used to process your personal data. All processing activities, including those supported by AI, continue to be carried out in accordance with data protection laws and the lawful bases previously communicated to you.

AI is used solely as a tool to support human decision-making and operational processes. We do not use AI to make solely automated decisions and all outputs generated by AI are reviewed by trained staff to ensure accuracy, fairness, and appropriateness.

Appropriate safeguards are in place to ensure that personal data remains secure and is handled responsibly. We do not use personal data collected through our services to train, retrain, or develop artificial intelligence or machine learning models, and personal data is processed solely for its original intended purposes.

We collect different types of personal information depending on our relationship with you, and we only collect what we need. When you give us your information, we will explain why we need it.

We will also tell you if giving certain information is optional and what could happen if you choose not to provide it. If you don’t give us the information we need, we may not be able to offer you some of our services or support.

We may collect your information in the following ways:

• Directly from you, such as in person, by email, phone, text, letter, forms, web chat, or social media.
• By looking at how you use our services, such as your account activity or transactions. Please see the below section on ‘Information we collect when you use this site’ for further details.
• From other organisations, like previous housing providers, health and social care services, police, debt collectors, utility companies, benefit agencies, or credit and fraud prevention agencies.
• From people connected to you, such as a joint tenant, a relative, someone acting for you, your legal representative, or neighbours (for example, reporting antisocial behaviour).
• By recording phone calls to help with training, handling complaints, and keeping our staff safe (we do not record card payment details).
• From CCTV, to help prevent crime, detect damage or vandalism, and keep people safe.

For communication purposes

Sometimes we may use photos or videos of staff and residents for publicity.

If a photo or video focuses on you, we will ask for your consent. At public or large events, we won’t ask each person individually, but we will let you know that photos or videos are being taken. By attending, you are accepting that you might be included but you can opt out by speaking to the event organiser.

Photographs and film will be kept on our records for up to 4 years and may be used for communications purposes more than once during this time.

Should you wish to have your image removed, your consent can be withdrawn at any time, by notifying us via email at contact@cottsway.co.uk or by reaching out to our friendly team on 01993 890000

Information we collect when you use this site

When you visit our website, we may automatically collect some information about you, including:

• Technical details - like your IP address (your device’s internet address), login details, browser type, time zone, location, and the device or system you’re using
• How you use our website - such as the pages you visit, what you look at or search for, how long you stay on pages, any errors you see, and how you move around the site
• Cookies - small files stored on your device that help us recognise you and improve your experience on our website. You can find more details in our cookie policy

We use this information to run and improve our website. This includes fixing problems, analysing data, testing changes, carrying out research, and making sure the site works well for you.

We will not share this information with other organisations unless:

• you have given us permission, or
• we are required to by law (for example, to help with criminal investigations or prevent fraud).

Most of the time the personal information we hold about you is information you have given to us or has been gathered by us to provide products and services to you under contract.

We collect and hold personal data about:

• Employees: Personal data for current and former employees is retained under their employment contract.
• Job applicants: Personal data is obtained via the recruitment process with their consent and disposed of if they are unsuccessful.
• Board Members: Personal data for existing Board members is retained for the duration of their office with their consent under an Agreement for Service.
• Shareholders: Personal data for shareholders is held under their share certificate.
• Leaseholders and shared owners: Personal data for current and former leaseholders and shared owners is held under contract in their lease.
• Customers: This includes current, former and potential customers who live in our properties or access our support and other services and includes members of their family and people associated with them.
• Housing applicants: Personal data is obtained via the application process with their consent and disposed of if they are unsuccessful.
• Contractors and suppliers (including professionals): Personal data may be held under their contracts, agreements and letters of instruction.
• Visitors: to our website and our offices, those who email, call, message us via a social media application or our webchat, or write to us, including anyone who makes a complaint or enquiry to Cottsway.

Further details on how long we keep your data is specified in this policy below, and will be outlined to you when entering into any employment or housing contract with us.

For most products and services, we need to use some or all the following items of personally identifiable information about you, occupants of your home, or your representatives:

a) Personal information

• Contact details - name, address, email, home and mobile telephone numbers
• Age - date of birth, age range
• Gender
• Identification - information to allow us to check your identity (e.g. official documents)
• Financial/payment information - information about your financial circumstances, where you make payment by credit/debit card, or where we need to make payments to you
• Photograph - information to record your identity
• Online computer identifiers (IP address) - information recorded when you engage with us electronically
• National insurance numbers - information to carry out functions such as universal credit and/or personal support services
• Next of kin - contact details.
• CCTV images.
• A record of your contact with us - including recording of calls to our customer services team, any requests or conversations that take place through our live chat functionality and noting any action taken because of your contact with us.
• Details of our contract, agreement or instructions.
• Contact preferences, including whether you have signed up to our mailing list.
• Personal details of all household residents.
• Proof of housing eligibility.
• Relationship status.
• Your needs or preferences so that we can understand them better.

b) Special category information

• Health - to support our housing functions and vulnerable customers.
• Ethnicity - to support our equality monitoring purposes.
• Religion - to support our equality monitoring purposes.
• Sexual life or sexual orientation - to support our equality monitoring purposes.
• Convictions - to prevent and detect anti-social behaviour, crime, fraud, anti-money laundering and to aid in the prosecution and rehabilitation of offenders.

Some personal information is classed by law as more sensitive. This is called “special category” or “sensitive” personal data.

We try to keep the amount of this type of information we collect as low as possible. However, because of the services we provide, there are times when we need to use it. For example, we may use it to better understand your needs, such as providing housing for someone with a disability or dealing with neighbourhood issues that may involve crime.

Depending on our relationship with you, we may need to use some of this information. We will only use what is necessary to provide services to you or work with you.

Children’s personal data

We usually don’t collect information about children under 18, because all our tenants and homeowners are adults. However, if children live in one of our properties, we may record basic details about them, such as their name and date of birth.

We need this information to make sure the home is not overcrowded and to help manage the tenancy properly by knowing who lives in the property and their ages.

We may also receive information about children if we are involved in a welfare or safeguarding concern, or if we are working with other organisations to provide support.

We will only process personal data in accordance with one of the legal bases outlined above, limited strictly to what is necessary for the specified purpose, and we will implement appropriate security measures to safeguard that data.

Cottsway will not share your information with anyone who says they are acting for you unless we have checked and confirmed that you have given them permission or they are officially authorised to do so.

We will never sell your information to other businesses.

How we use your information will depend on our relationship with you and how you interact with our various services, website and customer portals. We may use your personal data for a number of different purposes.

We may use your personal data to: 

Enter into, or manage any contract we have with you, including:

• Processing applications and requests for: rental accommodation, home ownership, garage rental.
• Managing tenancies including collecting rent and service charges.
• Ensuring compliance with the conditions of any agreement between us.
• Providing repairs, maintenance and adaptions at our properties
• Providing home ownership products.
• Processing orders and managing our professional relationship, if you are a supplier or contractor.

Provide you with services in our legitimate interests, including ensuring the proper management of tenancies and providing appropriate support:

• Assisting you in the management of account charges, payments and arrears, including through our online portal.
• Providing support services to help customers achieve their goals.
• Keeping in touch with customers to understand your needs and preferences and invite you to events, and to notify you about changes to our service.
• Engaging with customers to make improvements to our products and services.
• Resolving enquiries and complaints.

Comply with our legal and regulatory obligations, and acting in the public interest, such as:

• Preventing and detect crime and resolve disputes.
• Preventing and detect fraud and money laundering.
• Promoting safety and the quiet enjoyment of our neighbourhoods and communities.
• Promoting equal opportunities and fair treatment for all our customers.
• Meeting the obligations we owe to our funders and regulators.

Under data protection laws we can only process your information where we have one or more legal ground or condition for doing so as set out in the law (a “lawful basis.” We have set out below common “lawful bases” we use when processing your personal data.

Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform the contract we have entered into with you.
• Where we need to comply with a legal obligation, such as providing information to HMRC.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where you have given your consent.

Where we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. This may affect the services that we can make available to you, but this will be explained when we gain your consent.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your vital interests (or someone else’s vital interests).

When the personal information we process about you is classed as sensitive personal information (criminal offences information and ‘Special Category Personal Data’ such as your health, sexual orientation and ethnic origin), we must have an additional lawful basis for such processing.

This lawful basis may be:

• Where you have given your explicit consent.
• It is necessary under laws relating to social security and social protection law.
• Where we need to protect your vital interests (or someone else’s vital interests).
• It is necessary in connection with legal proceedings.
• It is necessary for reasons of substantial public interest (for example: equality monitoring, preventing or detecting unlawful acts, preventing fraud).

Cottsway does not make any decisions based solely on automated processing, including profiling, using the personal data you have given us.

We store your personal information in secure computer systems. Sometimes we make copies of this data for testing, backups, or in case something goes wrong.

We regularly check and update our systems to keep them safe. Your information is protected by strong security measures.

Our staff are trained in data protection and security. Only people who need your information to do their job, including trusted partners, can access it.

We take your privacy seriously. We use strong encryption to protect your information when it is stored or sent, including when you use our website.

International transfers

We are based in the UK and keep most of your data here, or in countries with similar data protection laws (such as those in the European Economic Area) These countries have ‘Adequacy Decisions’ in place, which means they have sufficient levels of data protection legislation.

However, if we need to move your data outside of the UK to a country that does not have an Adequacy Decision in place, we make sure it is still protected by putting proper legal and security safeguards in place.

We keep your personal information for as long as we need it to provide our services and to meet legal and regulatory requirements.

Where possible, we reduce or remove personal details so the data can be used safely for things like statistics or analysis. We follow a data retention policy which is aligned to the National Housing Federation and the Data Retention Schedule and sets out how long we keep different types of information.

In some situations, we may need to keep your information for longer, for example if there is a legal issue or dispute.

We take protecting your personal data seriously and do our upmost to protect it from authorised access or loss. However, you also have a responsibility to ensure that the data we hold about you is accurate.

If there is a change to your personal data, for example your contact details, please let us know so that we can keep your information up to date and accurate. To do this you can:

• Update your details online
• Email contact@cottsway.co.uk
• Write to us at: Cottsway Housing, Heynes Place, Avenue Two, Witney OX28 4YG.

You have the right to ask us to do different things with your personal information. For example, you can ask for a copy of it, ask us to correct any errors, change how we use it, or ask us to delete it.

We will either do what you ask or explain why we can’t, usually because we have a legal reason for keeping or using the information.

You can make any of the requests set out below using our contact details:

• Write to: Cottsway Housing, Heynes Place, Avenue Two, Witney OX28 4YG
• Email: contact@cottsway.co.uk
• Call: 01993 890000

You can find out more about your data protection rights on the Information Commissioner’s Office website.

The right to complain

You have a right to be able to complain about how we have handled your personal data. Any complaints received will be acknowledged within 30 days and a response provided without undue delay.

If you wish to complain about how Cottsway have handled your data, you can reach out to one of our friendly team using our contact details:

• Write to: Cottsway Housing, Heynes Place, Avenue Two, Witney OX28 4YG
• Email: contact@cottsway.co.uk
• Call: 01993 890000.

Your complaint will be investigated in line with our Customer feedback and complaints policy

However, if you are still unhappy with our response, you can reach out directly to the ICO, and escalate your complaint to them. To contact the ICO, please use the following contact details:

• Call: 0303 123 1113
• Visit: ICO - Make a complaint
• Write to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You have several rights when it comes to your personal information:

Right to be informed

We must tell you who is using your information, why we need it, how we use it, how long we keep it, and who we share it with.

Right of access

You can ask to see the information we hold about you. This is called a Subject Access Request. It’s usually free and we will respond within one calendar month, although there are some cases where we may not be able to share everything or where this deadline may be extended In such instances we will respond and notify you, providing reasons as to why these exceptions are the case.

Right to correct information

You can ask us to fix your information if it is wrong or incomplete. Please let us know if your details change so we can keep our records up to date.

Right to have information deleted

In some cases, you can ask us to delete your personal information. This is sometimes called the “right to be forgotten.” We will consider each request, but we may need to keep some information for legal or regulatory reasons.

Right to restrict how we use your information

You can ask us to limit how we use your information if you think it is being used incorrectly or is inaccurate.

Right to object

In some situations, you can object to how we use your information.

Right to move your data

You can ask for your information to be shared with another organisation if needed, where possible.

Rights about automated decisions

You can ask us to review decisions made automatically or object to profiling. However, we do not make decisions about you without a member of staff reviewing them.