Customer Privacy Notice
The privacy and security of personal information relating to our customers is extremely important to us. The below privacy notice explains how and why we will use personal data to provide and improve services. Our full privacy notice for customers is available to view download.
Purpose of the Privacy Notice
This Privacy Notice tells you what to expect when Orwell processes personal information. It applies to information about applicants, customers, residents, former residents and other service users. It tells you the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information).
Identity and contact details of Controller
Orwell Housing Association Limited (‘Orwell’) is a controller of personal information for the purposes of the Data Protection Act 2018 and General Data Protection Regulation (GDPR) 2018. Our contact details for data protection purposes are as follows:
Data Protection Officer
Orwell Housing Association
Crane Hill Lodge
325 London Road
0345 60 100 30
We are a registered data controller with the Information Commissioners Office (ICO), our registration number is Z8370519
Why do we collect and store personal information?
Orwell needs to collect, process and store personal information about you and other household members (when you provide information about household members we assume that you do so with their full knowledge and consent) to operate as a registered provider of housing and deliver efficient and effective services
Legal basis for processing
We often have more than one legal basis for processing personal data. Firstly, where it is necessary for the purposes of the legitimate interests pursued by Orwell or by a third party to process your information. We can do that so long as we do not interfere with your fundamental rights or freedoms. Secondly, where we are under a legal obligation or an obligation under a contract (such as your tenancy agreement) to process/disclose the information.
The other reasons we can rely upon to process your personal information under GDPR is as follows:
- Where we need to protect the vital interests (i.e. the health and safety) of you or another person.
- Some personal information is treated as more sensitive (for example information about health, sexuality, ethnic background. The legal basis for processing these special categories of personal information is more limited. To lawfully process special categories of personal data, we must identify a lawful basis for the processing and meet a separate condition for the processing. The basis we can use are:
- With your consent;
- Where we need to protect the vital interests (i.e. the health and safety) of you or another person;
- Where you have already made your personal information public;
- Where we or another person needs to bring or defend legal claims; and/or
- Substantial public interest grounds
We class special category data as
- racial or ethnic origin,
- political opinions,
- religious or philosophical beliefs,
- trade union membership,
- processing of genetic data,
- biometric data for the purpose of uniquely identifying a natural person,
- data concerning health
- data concerning a person's sex life or sexual orientation
To process personal data about criminal convictions or offences, we must have both a lawful basis for the processing and either legal authority or official authority for the processing.
Information we may hold about you and how we use it
The information we hold on our records concerns our relationship with you. For example:
- We hold names & dates of birth, photographic ID and information about your previous housing circumstances to assess housing applications and help prevent tenancy fraud.
- We hold contact details for you, so we can communicate with you by your preferred means, and keep you informed about services we offer which may be useful to you.
- We record information about your needs (for example if you have a carer or social worker; if you need adaptations in your home; if you need large print or translated text) to ensure that we take account of any support needs in our dealings with you, and to improve our communications with you.
- We record information to enable us to provide housing management services. For example, we record reports of anti-social behaviour; complaints; change in circumstances (for example when your employment status changes etc.) and information about housing options (e.g. if you have a medical need which means you need to move).
- We keep financial records about the amount of money you have paid us; any amount(s) outstanding, and action taken to recover money you owe.
- We may hold information about you if you are engaged with any additional guidance and support services. For example, in connection with access to training and employment we may hold information about your job history and skills and experience, or if we support you to improve your financial circumstances, we may hold information about your household income and expenditure.
- We may record your telephone calls to our switchboard for training and monitoring purposes to ensure we are delivering a good service. Any call recordings will be held in accordance with our corporate retention policy before being erased.
- We may capture your image on our CCTV systems if you visit a property, office or community facility. Any CCTV recordings will be held in accordance with our corporate retention policy before being erased.
- We record the findings of surveys and other research to help us improve our service to customers. The information you provide will be anonymous unless you agree that we can use your details.
This list is not exhaustive, as we hold records of most contacts we have with you, or about you, and we process this information, so we can deliver services to you. Generally, the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you), but we may also hold information provided by third parties where this is relevant to your housing circumstances e.g. from social workers and health professionals (such as doctors and occupational therapists).
We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases, you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact our ability to provide some services to you if you refuse to provide information that stops us from doing so
How we manage your personal information
We process your personal information in accordance with the principles of GDPR.
We will treat your personal information fairly and lawfully and we will ensure that information is:
- Processed for limited purposes;
- Kept up-to-date, accurate, relevant and not excessive;
- Not kept longer than is necessary;
- Kept secure.
Access to personal information is restricted to authorised individuals on a strictly need to know basis.
We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate.
To help us to ensure confidentiality of your personal information we may ask you security questions to confirm your identity when you call us. We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so. If you request copies of your information, we will also ask you to confirm your identity.
Periods for which we will store your personal information
We will only hold your records during the period of our relationship with you and for a set period afterwards to allow us to meet our legal obligations including resolving any follow up issues between us.
Sharing your personal information
We will share relevant information with third parties for the purposes as outlined, or where we are legally required to do so. When sharing personal information, we will comply with all aspects of the GDPR. Special categories of personal data about health, sexual life, race, religion and criminal activity for example is subject to particularly stringent security and confidentiality measures.
Where necessary or required, we may share information as follows:
- to comply with the law (e.g. the police, Inland Revenue, Council Tax Registration Officer, Social Security Fraud Act) or a court order
- where there is a clear health or safety risk to an individual or members of the public, evidence of fraud against Orwell, other irregular behaviour or a matter Orwell is investigating
- in connection with court proceedings or statutory action to enforce compliance with tenancy conditions (e.g. applications for possession or for payment of Housing Benefit direct)
- where Orwell has entered into a formal protocol with the police, a local authority department or the Care Quality Commission
- providing the name, address and contact number of a resident to contractors or other agents providing services on Orwell’s behalf
- providing the name of a resident and the date of occupancy to gas, electricity and water companies
- providing forwarding addresses to debt collection agencies
- providing information anonymously for bona fide statistical or research purposes, provided it is not possible to identify the individuals to whom the information relates
- information required by the Regulator of Social Housing when monitoring Orwell’s activities in its capacity as the regulator of housing associations.
- information on lettings and sales to The Ministry for Housing, Communities and Local Government via CORE (COntinuous REcording of social housing and sales) for statistical purposes
- To protect the vital interests of an individual (in a life or death situation)
Access to personal information
Under the GDPR, you have a right to ask us what personal information we hold about you, and to request a copy of your information. This is known as a ‘subject access request’ (SAR). SARs need to be made in writing and we ask that your written request is accompanied by proof of your identity. We have one calendar month within which to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible). We will ask you to prove your identity before we respond to the SAR
Following your SAR, we will provide you with a copy of the information we hold that relates to you.
Rectification and Erasure (‘right to be forgotten’)
If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting our Customer services team on 0345 60 100 30.
You have the right to ask us to delete personal information we hold about you. You can do this where:
- the information is no longer necessary in relation to the purpose for which we originally collected/processed it
- where you withdraw consent
- where you object to the processing and there is no overriding legitimate interest for us continuing the processing
- where we unlawfully processed the information
- the personal information must be erased in order to comply with a legal obligation
We can refuse to erase your personal information where the personal information is processed for the following reasons:
- to exercise the right of freedom of expression and information;
- to enable functions designed to protect the public to be achieved e.g. government or regulatory functions
- to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
- for public health purposes in the public interest;
- archiving purposes in the public interest, scientific research historical research or statistical purposes;
- the exercise or defense of legal claims; or
Restriction and objection to processing
You have the right to require us to stop processing your personal information. When processing is restricted, we can store the information, but not do anything with it. You can do this where:
- You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
- You challenge whether we have a legitimate interest in using the information
- If the processing is a breach of the GDPR or otherwise unlawful
- If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.
If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.
We must inform you when we decide to remove the restriction giving the reasons why.
You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights, or the processing is necessary for us or someone else to bring or defend legal claims.
Withdrawal of consent
You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.
Changes to this Privacy Notice
We keep our privacy notice under regular review and will place any updates on our website; you will be notified of any major changes to this policy.
For further information on how to request your personal information and how and why we process your information, you can contact us using the details below.
Data Protection Officer
Orwell Housing Association
Crane Hill Lodge
325 London Road
0345 60 100 30
The Information Commissioner (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, and one of their primary functions is to administer the provisions of the GDPR.
You have the right to complain to the ICO if you think we have breached the GDPR. You can contact the ICO at:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113 / http://www.ico.org.uk/
Employee Privacy Notice
The privacy and security of our employee's personal data is just as important to us as our customer data. A full version of our employee privacy notice is available to view and download.
Website and digital privacy
When someone visits orwell-housing.co.uk or myorwell.co.uk we use a third party service, Google Analytics and HotJar, to collect standard internet log information and details of visitor behaviour patterns. This is a standard practice that is applied to many websites. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.
Our Cookies report provides a complete list of which cookies are used on our site and why.
To make contacting us as easy as possible, our online chat functionality provided by Hubspot has been listed as a strictly necessary cookie. If this causes you any concern, please contact us
How do I change my cookie settings?
Orwell uses a solution from OneTrust to manage cookies and your cookie settings can be modified by using the green cookie icon located in the bottom left hand corner.
Most web browsers also allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.
To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.
The cookies in use by Hotjar can be found here
Our website search and decision notice search is powered by Prodo who host the Orwell website. Search queries and results are logged anonymously to help us improve our website and search functionality. No user-specific data is collected by Orwell or any other third party.
E-news or e-mail communication
Security and performance
Orwell may occasionally use third party specialists to help maintain the security and performance of the Orwell website. To deliver this service it processes the IP addresses of visitors to the Orwell website.
Contacting us via social media
At times, Orwell uses a third party provider, Hootsuite to manage our social media interactions.
If you send us a private or direct message via social media the message may be stored by Hootsuite for three months. It will not be shared with any other organisations.
When you contact Orwell, we collect the Calling Line Identification (CLI) information from the call. Orwell may use this information to help improve our efficiency and effectiveness and provide an improved service to our customers.
All e-mail sent to Orwell may be monitored and used by us for reasons of security and for monitoring compliance with Orwell’s policies. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
Job applicants, current and former Orwell employees
When individuals apply to work with Orwell, we will only use the information they supply to us to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Criminal Records Bureau we will not do so without informing them beforehand unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held in line with Orwell’s retention Policy, it will then be destroyed or deleted. We may retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.
Once a person has taken up employment with Orwell, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Orwell has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it.
Complaints or queries
Orwell tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
Access to personal information
Orwell will try to be as open as we can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 2018.
A request for information may be made by submitting a written request to Orwell’s Data Protection Officer using the address detailed below.
Disclosure of personal information
Orwell will ensure that personal data is not disclosed to unauthorised third parties.
However, Orwell may permit disclosure of information to third parties without consent if the appropriate paperwork is submitted to Orwell and the following conditions are met.
- to safeguard national security;
- prevention or detection of crime including the apprehension or prosecution of offenders;
- assessment or collection of tax duty;
- discharge of regulatory functions (includes health, safety and welfare of persons at work);
- to prevent serious harm to a third party;
- to protect the vital interests of the individual; this refers to life and death situations.
Links to other websites
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated in August 2020.
Data Protection Officer (DPO)
If you have any concerns with regard to Data Protection within Orwell, you can contact our Data Protection Officer on email@example.com.
Alternatively, you can write to our Data Protection Officer by sending a letter using the contact information below.
Data Protection Officer
Orwell Housing Association
Crane Hill Lodge
325 London Road
Our My Orwell customer App requires specific areas of privacy highlighted to our customers and App users. Full details of our App related privacy can be found below:
Orwell Housing App
Last updated: November 30, 2022
Interpretation and Definitions
The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.
Account means a unique account created for You to access our Service or parts of our Service.
Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
Application means the software program provided by the Company downloaded by You on any electronic device, named Orwell Housing
Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Orwell Housing.
Country refers to: United Kingdom
Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
Personal Data is any information that relates to an identified or identifiable individual.
Service refers to the Application.
Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.
Collecting and Using Your Personal Data
Types of Data Collected
While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:
First name and last name
Usage Data is collected automatically when using the Service.
Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.
We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.
Information Collected while Using the Application
While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:
- Pictures and other information from your Device's camera and photo library
We use this information to provide features of Our Service, to improve and customize Our Service. The information may be uploaded to the Company's servers and/or a Service Provider's server or it may be simply stored on Your device.
You can enable or disable access to this information at any time, through Your Device settings.
Use of Your Personal Data
The Company may use Personal Data for the following purposes:
To provide and maintain our Service, including to monitor the usage of our Service.
To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
To provide You with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information.
To manage Your requests: To attend and manage Your requests to Us.
For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.
We may share Your personal information in the following situations:
- With Service Providers: We may share Your personal information with Service Providers to monitor and analyze the use of our Service, to contact You.
- For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
- With business partners: We may share Your information with Our business partners to offer You certain products, services or promotions.
- With other users: when You share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.
- With Your consent: We may disclose Your personal information for any other purpose with Your consent.
Retention of Your Personal Data
The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.
Transfer of Your Personal Data
Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.
Delete Your Personal Data
You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.
Our Service may give You the ability to delete certain information about You from within the Service.
You may update, amend, or delete Your information at any time by signing in to Your Account, if you have one, and visiting the account settings section that allows you to manage Your personal information. You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us.
Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.
Disclosure of Your Personal Data
Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).
Other legal requirements
The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:
- Comply with a legal obligation
- Protect and defend the rights or property of the Company
- Prevent or investigate possible wrongdoing in connection with the Service
- Protect the personal safety of Users of the Service or the public
- Protect against legal liability
Security of Your Personal Data
The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.
Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.
If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.
Links to Other Websites
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
By email: firstname.lastname@example.org
By visiting this page on our website: https://www.orwell-housing.co.uk/contact-us
By phone number: 0345 60 100 30