SWAN NEW HOMES LIMITED, TRADING AS NU LIVING, PART OF THE SWAN HOUSING ASSOCIATION LIMITED GROUP OF COMPANIES
Identity and contact details of Controller
Swan New Homes Limited, trading as ‘NU living’ (“NU living”) is part of the Swan Housing Association Limited group of companies and is a controller of personal information for the purposes of the General Data Protection Regulation (‘GDPR’). Our contact details for data protection purposes are as follows:
Data Protection Officer – Pilgrim House, High Street, Billericay, Essex CM12 9XY
Email – [email protected]
Phone: 0300 3032500
Purpose of this Privacy Notice
This Privacy Notice tells you what to expect when NU living processes personal information. It applies to information about applicants, residents and other service users. It tells you the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information).
NU living needs to collect, process and store personal information about you and other household members (when you provide information about household members we assume that you do so with their full knowledge and consent) in order to provide property marketing, sales and property management services.
Legal basis for processing
We often have two main legal bases for processing personal data. Firstly, where it is necessary for the purposes of the legitimate interests pursued by NU living or by a third party to process your information. We can do that so long as we do not interfere with your fundamental rights or freedoms.
Secondly, because we have your consent (i.e. agreement) to us processing your personal information. Our purchasers are asked to sign a data protection consent form when they buy a property from us or later if they did not sign one when they bought a property from us. The consent form sets out the organisations and type of organisations we often have to share personal information about our service users with. Under the GDPR, consent is a legal basis for processing personal information. You can withdraw your consent at any time. This is explained further below in the section entitled ‘Your rights under GDPR’.
The other reasons we can rely upon to process your personal information under GDPR is as follows:
The information we hold on our records concerns our relationship with you. For example:
This list is not exhaustive, as we hold records of most contacts we have with you, or about you, and we process this information so we can deliver services to you. Generally the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you), but we may also hold information provided by third parties where this is relevant to your housing circumstances e.g. from mortgage institutions, solicitors or financial advisors.
We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact our ability to provide some services to you if you refuse to provide information that stops us from doing so.
We process your personal information in accordance with the principles of GDPR.
We will treat your personal information fairly and lawfully and we will ensure that information is:
Access to personal information is restricted to authorised individuals on a strictly need to know basis.
We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate.
To help us to ensure confidentiality of your personal information we may ask you security questions to confirm your identity when you call us. We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so.
We will only hold your records during the period of our relationship with you and for a set period afterwards, in accordance with our corporate retention guidelines, to allow us to meet our legal obligations including resolving any follow up issues between us.
Normally, only NU living staff will be able to see and process your personal information. However, there may be times when we will share relevant information with third parties and other members of the Swan group of companies for the purposes as outlined, or where we are legally required to do so. When sharing personal information, we will comply with all aspects of the GDPR. Special categories of personal data about health and financial circumstances for example is subject to particularly stringent security and confidentiality measures.
Where necessary or required, we may share information as follows:
You have a number of rights under the GDPR:
Access to personal information
You have the right to ask us what personal information we hold about you, and to request a copy of your information. We have a form you can use for this purpose (available on our website), but this request can be made by email or over the phone. You can download a Subject Access Request Form here and return it to us at the address below.
We have one calendar month within which to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible). Following your SAR, we will provide you with a copy of the information we hold that relates to you.
We will advise you if there is some information we cannot provide. This could be if your request is manifestly unfounded or excessive, or if it would adversely affect the rights and freedoms or others. We may also refuse if the request would cost too much or take too much staff time to deal with.
If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting your Sales Negotiator or alternatively, contact the Business Improvement Team by email to [email protected], by post at Pilgrim House, High Street, Billericay, Essex CM12 9XY or by telephone on 0300 3032500.
Erasure (‘right to be forgotten’)
You have the right to ask us to delete personal information we hold about you. You can do this where:
We can refuse to erase your personal information where the personal information is processed for the following reasons:
Restriction on processing
You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:
If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.
We must inform you when we decide to remove the restriction giving the reasons why.
Objection to processing
You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.
Withdrawal of consent
You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.
Right to data portability
The right to data portability allows us to obtain and reuse your personal data across different services. It allows us to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. The right only applies to personal data you have provided to us where the reason we are relying on to use the information is either your consent or for the performance of a contract. It also only applies when processing is carried out by us using automated means.
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We do not make decisions based on automatic processing.
We keep our privacy notice under regular review and will place any updates on our website; you will be notified of any major changes to this policy.
For further information on how to request your personal information and how and why we process your information, you can contact us using the details below.
The Information Commissioner (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, and one of their primary functions is to administer the provisions of the GDPR.
You have the right to complain to the ICO if you think we have breached the GDPR. You can contact the ICO at:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113 / http://www.ico.org.uk/