What personal data we collect and why we collect it

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Personal data we collect

When you register an interest in buying a home from us or apply to live in one of our homes, we collect the following personal data about you:

• Name and title
• Address and former addresses
• Telephone number and email addresses
• Data of birth
• Copies of proof of identity and address documents
• Information relating to members of your household, including their names, dates of birth and contact details
• Information about any disabilities or special requirements that you or members of your household have
• Information about your employment, employment history and earnings
• Details of your deposit and savings
• Details of any existing relationship or transactions between us

We collect personal data directly from you when register an interest in buying a property from us, such as when you fill out one of our forms or submit your details through our website. We also collect your personal data if you live with someone who has registered with us and they have provided your details to us. We also collect personal data about you from other sources, including our panel solicitors and mortgage advisers, if you use their services.

How we use your personal data

What we use your data for	The lawful grounds for processing your data
Creating a profile about you based on the personal data you have provided to us, so we can understand you better as a customer and provide you with a more personalised experience. [This may include using automated profiling.]	It is in our legitimate interests to understand your requirements and to serve you better as a customer.When processing personal data you have provided to us about disabilities or health or medical requirements that you or members of your household have, we do so with your explicit consent.You can tell us to stop sending you marketing information at any time by objecting or by withdrawing your consent.
Sending you information about our shared ownership and market sales properties which we think may be of interest to you based specific information such as your preferred area.	It is in our legitimate interests to send you marketing and promotional materials from time to time. Where we have obtained your consent to send marketing we rely on consent as the legal basis.You can do so by contacting us at dpo@originhousing.org.uk or by using the unsubscribe link in any marketing email you receive from us.hich we think may be of interest to you based specific information such as your preferred area.
Managing and developing our relationship with you, including inviting you to participate in surveys.	It is in our legitimate interests to develop our relationship, collect your feedback, improve our products and services and continually improve based on your feedback to better serve you.
Sharing your personal data with our recommended third-party service providers (such as mortgage advisers and conveyancers) so they can contact you about their services. We also share your information with our website provider, Full Comms, who will contact you from time-to-time about appropriate properties and services.	With your consent, we will provide you with details about such parties before asking consent to share your contact details with them. Our trusted provider, Full Comms, is compliant under the new GDPR regulations and endeavor to keep your personal information safe and secure.
Responding to correspondence you send to us.It is in our legitimate interests to respond to your correspondence, including enquiries, complements and complaints.	To the extent that we rely upon consent as the legal basis under which we use your data, then you are permitted to withdraw your consent at any time.

Your rights about automated decision-making and profiling:

We may make automated decisions and use automated processing of personal data to evaluate certain things about you.

Preventing and detecting fraud

We also use your personal data to prevent and detect fraud and to investigate fraud that we reasonably think might have been committed. This involves comparing your information with information held by third parties, such as the Land Registry, banks, schools and utility companies, solely for the purpose of preventing and detecting fraud. We use your data for this purpose as it is in our legitimate interests to ensure individuals do not defraud us. It is also in the legitimate interests of our customers and the public in general to ensure that fraud is detected and prevented.

Website Visitors, Cookies and Web Beacons

We use cookies on our website which automatically collect limited personal data about how visitors use and interact with our website. We also use web beacons in marketing emails which help us track whether our emails have been opened and whether links in our marketing emails have been clicked. Cookies are small text files and web beacons are small graphic files. They are downloaded to your device when you visit a website unless you have set your browser to stop them. Web beacons in emails load when you open the email.

We use cookies to remember your preferences, display content that is more relevant to you and improve your overall experience on our site. We use web beacons to track the actions of individuals (such as email recipients) and to measure the success of our marketing campaigns and response rates.

To learn more about cookies and web beacons and what you can do to opt-out of receiving them, please view our Cookies Notice.

Our website includes links to third-party sites. These sites may collect your personal data if you follow them or use the embedded content. We link to third-party sites including Facebook. If you follow these links, our privacy notice no longer applies and the data controller is the website provider (such as Facebook). Please read the privacy notices provided by the third-party sites for more information on how they collect and process your personal data.

Sharing your data

Who we share your personal data with

We may share your data with:

• Third parties who partner with us to deliver services, such as mortgage advisers, conveyancers and our website provide, Full Comms, if we have you consent to do so.
• Legal and professional advisers acting on your behalf in relation to the purchase of a home from us.
• Third parties with whom it is necessary to share your personal data for the purpose of managing any request or complaint you have made to us, such as the Housing Ombudsman service.
• Third parties such as the Land Registry, banks, schools and utility companies where it is necessary for the purposes of preventing or detecting fraud.
• Third parties who provide you or us with services, including our IT and cloud software and service providers
• All third-party service providers to Origin Housing (our data processors) with whom we share your personal data are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
• We also share your personal data with our professional advisers, including our lawyers and auditors where it is strictly necessary or to comply with applicable laws or with valid legal processes, such as in response to a court order.

Location of your personal data

We do not transfer your personal data out of the UK, but our IT and cloud service providers may transfer the personal data we store on their systems outside the European Union, to data centres located in other countries, such as the USA. Where this happens, we will ensure that appropriate safeguards are in place that ensure your personal data is protected to the standard expected in the European Union. These safeguards typically include standard contractual clauses approved by the European Commission for international transfers or (in the case of processors located in the USA) participation in the EU-US Privacy Shield Framework.

How long we store your data

We only retain your personal data for as long as necessary to fulfil the purposes we collected it for. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may continue to use your information without it being connected to you.

Our Data Retention Policy sets out the retention periods for the different types of information we collect and hold. Please contact us is you would like to know the retention period applicable to your personal data.

How we protect your data

We have implemented appropriate technical and organisational measures to prevent the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data.

We apply information governance and security best practice. We have implemented appropriate policies and procedures and provide all employees with information security and data protection awareness training. We restrict access to personal data to only those employees who need to know it for the purposes of their role. We have implemented technical security controls and have back-up and disaster recovery systems in place.

Your rights

Data subject rights

You have the following rights in respect of your personal data:

• You have the right of access to your personal data (commonly known as a “subject access request”) and can request copies of it and information about our processing of it.
• If the personal data we hold about you is incorrect or incomplete, you can ask us to rectify or add to it.
• Where we are using your personal data with your consent, you can withdraw your consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose/s you originally agreed to, unless we have another legitimate basis for doing so by law.
• Where we are using your personal because it is in our legitimate interests (or those of a third party) to do so, you can object to us using it this way.

You can ask us to restrict the use of your personal data if:

• It is not accurate;
• It has been used unlawfully but you do not want us to delete it;
• We do not need it any-more, but you want us to keep it for use in legal claims; or
• if you have already asked us to stop using your data but you are waiting to receive confirmation from us as to whether we can comply with your request.
• In some circumstances, you can compel us to erase your personal data or request a machine-readable copy of your personal data to be transferred to another service provider.

How to exercise your rights

If you wish to exercise your rights, please contact us using the information provided below.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Lodging a complaint with the ICO

You can also lodge a complaint with the Information Commissioner’s Office. They can be contacted using the information provided at: https://ico.org.uk/concerns/.

Contact us

You can contact us about data protection by:

• Calling us on 0300 323 0325
• Emailing us at enquiries@originhousing.org.uk
• Using the enquiry form on our Contact Us page of our website
• Writing to us at:

Origin Housing
St Richards House
110 Eversholt St
London
NW1 1BS

You can also contact our data protection officer by emailing dpo@originhousing.org.uk

Updates

We may update this Privacy Notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to services we offer. When changes are made, we will update the ‘Last Updated’ date at the top of this page. Please review this Privacy Notice periodically to check for updates.