Privacy and Cookie Policy

Cookie Policy

What Cookies Do We Use?

Privacy Policy

1. Introduction

This Privacy Notice is a public document available to anyone and applies to customers of Grŵp Cynefin to explain how the organisation collects and processes personal information in order to conduct normal business activities as a UK charitable housing association. We are a Registered Social Landlord (RSL) regulated by Welsh Government. Normal activities can be summarised as:

• Providing social and other types of housing.
• Property and grounds maintenance and repair.
• Managing your housing, tenancy/lease and account as your landlord.

We also provide additional optional services including:

• Organising and assisting community events.
• Offering opportunities to be involved.
• Providing welfare and benefits advice.
• Adaptations made to the properties we manage.
• Selling properties.
• Support to Service Users.

We are what is known as the ‘data controller’ of personal information we collect and use. This means that we are responsible for determining the purpose and the means of processing your personal data. We are registered with the Information Commissioner’s Office under number Z6706892.

Our Data Protection Officer (DPO) ensures that we apply the best standards to protecting your personal information and comply with our responsibilities for data protection. If you have any questions about how we handle your personal information or concerns please contact us using the information provided under ‘How to Contact Us’.

2. How we collect your personal data

Grŵp Cynefin collects information from you via a variety of sources, including when you apply for one of our properties or services, complete one of our forms, when you call, write, e-mail or meet with us or respond to a survey. We may also collect information when you use our social media sites and websites.

We may receive information about you from third parties including:

• Your council or benefits office relating to your housing.
• Previous landlords and credit agencies when you apply for housing.
• Police, welfare or support organisations dealing with you.
• Councillors, MPs or other representatives acting on your behalf/instruction.
• Financial institutions when you apply for our services.

3. What personal data we collect about you

The information we require from you, the tenant(s) or leaseholder(s), includes:

• Full name (and proof of your identity / photo ID).
• Date of birth.
• National Insurance number (your unique identifier).
• Contact details (phone, e-mail or correspondence address).
• Details of anyone authorised to act on your behalf if applicable which includes the contact details of your next of kin.
• Basic details (name and DOB, gender and preferred language of communication) of all household residents.
• Banking details if you pay your rent by Direct Debit.
• Card details if you pay by card (however card details are not stored).
• Proof of housing eligibility, any interest or equity in other property.
• Other personal information that will vary on a case by case basis to help us resolve breach of tenancy, alleged anti-social behaviour or fraud.
• If you provide us with a mobile phone number or email address, we will use these methods to communicate with you.

The information we may collect from you includes:

• Disabilities or vulnerabilities and protected characteristic information.
• Financial information.
• Health information
• Bank statements, payslips or income details
• Information about your support needs.

We operate a CCTV system at Grŵp Cynefin office premises for the detection and prevention of crime. From time to time we may operate CCTV / sound recording and / or use photography to capture evidence of breach of tenancy, alleged anti-social behaviour or crime.

We may also take photographs at our events, at our properties and in our communities to use for general marketing and publicity.

4. How we will use your personal data

The information we require from you is used to manage your tenancy or leasehold agreement or other contract between you and Grŵp Cynefin. Please read your contract carefully for specific details as ‘performance of a contract’ is usually the legal basis for processing your information and carrying out our activities.

Below is a table that provides you with the purposes for which we intend to use your personal data and the lawful grounds for doing so under UK GDPR Article 6.

5. If you fail to provide personal data

If you fail to provide certain information when requested, we may not be able to provide all of our services to you; perform the contract we have entered into with you (such as managing your tenancy), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers), and ultimately you may not be able to hold a tenancy or lease with us, or sell or purchase a property through us.

6. Children’s and other residents of the property data

Grŵp Cynefin does not normally process children’s information as part of a tenancy, as all tenants are adults. However, we record children’s basic information if they are resident in one of our properties, including their name, gender and date of birth. This is required for checking the property is not overcrowded and to assess other tenancy management issues where all householders and ages are required to be known.

We may receive children’s information if we are involved in the housing and tenancy aspects of a welfare case as part of a multi-agency working solution.

We also may record children’s and young people’s information for support planning and providing support to the household.

This is also applicable for any other adults who live with you as a household.

7. Property data

Much of the data we use relates to our properties and their maintenance and repair. We do not consider property information used in conjunction with the property address to be your personal information. For example, the age of the kitchen, results from an asbestos survey, planning to replace windows or a repair to a tap.

We are usually happy to provide you with answers to questions you may have about the property you are living in and work done to it.

As soon as your name, contact details or other personal information is used in conjunction with property information, such as to complete a property repair visit, then this is treated as personal information.

8. How we will communicate with you

Grŵp Cynefin needs to communicate with our customers and this will usually be in writing or by telephone, but is more commonly becoming electronic and paperless, using systems such as the Cynefin App, Mailchimp, Email, Text and Whatsapp. We are moving many of our services on-line as this is usually more convenient for you and more efficient for us.

Our tenants receive our newsletter ‘Calon’ with information about what is going on within the organisation.

We will only discuss or communicate your tenancy or lease details with those named on the agreement or those authorised (temporarily or permanently) by you. You can authorise someone temporarily verbally over the phone or permanently in writing.

9. Sharing your personal data

Grŵp Cynefin shares limited personal data with our contractors who are carrying out services on our behalf. Our contractors and suppliers who provide services to you and to us are required to comply with the law and our own Data Processing Agreement to ensure data is managed appropriately and for specified purposes, including to run our out-of-hours telephone service or to complete emergency, responsive or planned property repairs.

We may share your information with a language translation service if it is necessary to translate any information into or from a foreign language for you.

Grŵp Cynefin may need to share personal information with government departments and agencies, with our regulator and auditors, with local authorities, with other housing associations and support organisations, with mediation and advocacy partner organisations with utility companies or with other organisations and agencies where we are legally allowed to do so.

We may need to share information with solicitors, insurers, agents, mortgage brokers, financial advisors, credit reference agencies, court agents, surveyors, valuers relating to a property sale and training providers or learning institutions.

In some cases we may have a duty to disclose your information by law to:

• Our partner organisations whose purposes are compatible to ours
• Other housing associations
• Local Authorities, regulators and government departments
• Police, fire services or the health authority or medical staff
• Others who may need information from us for their own purposes (for crime prevention or detection, for the prevention and detection of fraud.

10. Retaining your data

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Details of retention periods for different aspects of your personal information are available in our retention policy which can be exercised under the “How to Contact Us” section of this policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Information relating to a tenancy or lease agreement will be kept for as long as the agreement is active or where money is owed on the account, and for a period not exceeding six years afterwards. The basic history of who held a tenancy at which property and when will be held forever.

11. What we will not do

We will not send you unsolicited marketing material.

We will not sell your personal data on to third parties.

We will not pass on your personal data to unrelated third parties unless we are allowed or required to do so by law or we have your explicit permission to do that.

We do not have any have systems that take automated decisions about you.

12. International transfers

Your personal data may be transferred outside the UK. We will ensure that all international transfers comply with applicable data protection laws by implementing appropriate safeguards in compliance with Chapter V UK GDPR.

For example, when we appoint data processors we check that suitable arrangements are in place such as Adequacy Regulations, binding corporate rules, international data transfer agreements, standard contractual clauses, or other permitted mechanism.

13. Your rights

Under Data Protection Legislation, you have the right in certain circumstances to:

• Be informed: Individuals have the right to be informed about the collection and use of their personal data.
• Request Access: You have the right to request a copy of the data we hold about you (Subject Access Request). We will always endeavour to process your request within 30 calendar days:
• It will always help if you can be as specific about what personal data you want to see, what it relates to and within what timeframe, as that will assist our search;
• Request Rectification: You have the right to correct information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
• Request erasure: This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
• Request the restriction of processing: This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• Request data portability: This enables you to request the transfer of your personal information to another party (in certain circumstances);
• Object: This enables you to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party). You also have the right to object where we are processing your personal information for direct marketing purposes;
• Know about any Automated Decision making and profiling;
• Withdraw your consent to the processing of your personal information at any time where consent is being relied upon as the lawful basis for processing.

You can exercise any of your rights by phoning, emailing or by writing in to us on the contact details under “How to Contact Us” below. Please mark your correspondence for the attention of the Data Protection Officer.

You also have a right to lodge a complaint with Information Commissioners Office (ICO) where you to believe we have not complied with UK data protection law. In the first instance, we encourage you to resolve the matter with us. However, you can contact the ICO via www.ico.org.uk, casework@ico.org.uk or 0303 123 1113.

14. How to contact us

(e) post@grwpcynefin.org

(t) 0300 111 2122

Grwp Cynefin Tŷ Silyn
Penygroes
Caernarfon
Gwynedd
LL54 6LY

15. Changes to our Privacy Notice

Our Privacy Notice is regularly kept up to date and this version was updated in February 2025. The latest full version is always available from our website at www.grwpcynefin.org