Privacy Statement

Introduction

The purpose of this notice is to outline our approach to protecting the personal data we collect, process, hold and share as a Data Controller. We take your privacy seriously and are committed to protecting information through a range of technical and organisational measures to safeguard all personal information under our control. We maintain records of our processing activities, data protection risk assessments and a range of other measures to support our compliance with data protection law. This privacy notice is a key component of our wider Data Protection Framework incorporating our Data Protection and IT policies.

Personal and Special Category Data We Collect

• Name and title;
• Date of birth;
• Contact details;
• Address;
• Former address details;
• Tenancy records to manage and support tenancies including where additional support needs are identified;
• Rent, service charge, rent and arrears account and other financial information;
• Profiled information for internal analysis purposes only;
• Repair, maintenance and property adaptation records;
• Customer feedback and satisfaction;
• Records of tenancy changes (e.g. mutual exchange, succession or an application to purchase);
• Third-party authorisation / nominated contact details – this could be a family member, friend or carer;
• Information about specific issues affecting our tenants or their household members (e.g. anti-social behaviour, violence and aggression, safeguarding concerns, hoarding, social protection and welfare matters);
• CCTV footage around our properties, in our neighbourhoods and at our office hubs;
• Photographs;
• Lone-worker device recordings;
• Details for effective communication of information to tenants and the promotion of social, environmental and economic well-being pursuant to the Regulatory Standards;
• Information about you that relates to demographic data such as race, religion, ethnicity, sexual orientation, gender, age for regulatory reporting requirements;
• Information about you or your household regarding health data to tailor our service to meet your household needs;
• We may also receive information about you from other agencies such as local councils, safety community partnerships, multi-agency relationships for measures designed to protect an individual’s health, safety and welfare for example, from domestic violence or drug abuse.

How We Use Your Personal Data

Eastlight use your personal data primarily for your tenancy or leasehold. Below is a table of the reasons why we use your personal data and the corresponding lawful basis.

Purposes For Processing	Lawful Basis
Processing applications for rental, shared ownership and supported living schemes	Contract
Providing support to help advise on rent, service charge, rent and arrears account and other financial information	Contract
Managing tenancies including collecting rent and services charges and providing support on general tenancy related queries	Contract
Providing repairs, maintenance and adaptions at our properties	Contract
Providing relevant support to help sustain tenancies	Contract
Providing safeguarding services where appropriate	Consent
Engaging in customer feedback and satisfaction to enable Eastlight to improve services	Legitimate Interest
Process records of tenancy changes e.g. mutual exchange, succession or an application to purchase	Contract
Process information about specific issues affecting our tenants or their household members e.g. anti-social behaviour, violence and aggression, safeguarding concerns, hoarding, social protection and welfare matters	Legitimate interest
Process CCTV footage and photographs around our properties, in local communities and around our office hubs	Legitimate Interest
Provide information about our membership	Legitimate Interest
Provide details for effective communication of information to tenants and the promotion of social, environmental and economic wellbeing pursuant to the Neighbourhood and Community Standard m2024 and the Transparency, Influence and Accountability Standard 2024	Legitimate Interest
Maintain information about you that relates to demographic data, such as race, religion, ethnicity, sexual orientation, gender, and age, for regulatory reporting requirements	Contract
We record your telephone calls to us, as some calls to our customer service centre are recorded for training and monitoring purposes to ensure we are delivering an excellent service	Legitimate interest
Providing a self-service portal that enables our tenants to access their rent records, log repairs, update their personal details, notify us of anti-social behaviour, make a complaint or check their rent statements. We collect information when you log into our portal, for example, to pay your rent or request a repair. We collect your username, password and email address when you register on our resident portal for an account.	Consent
Receiving information about you from other agencies, such as local councils, community safety partnerships and multi-agency relationships for measures designed to protect an individual’s health, safety and welfare e.g. from domestic violence or drug abuse	Legitimate Interest
Processing information about the sale or purchase of a lease, or its extension, or about the sale of a freehold	Contract
Processing of noise recording from Eastlight employee’s lone worker devices	Legitimate interest
Processing information relevant to a lessee’s mortgage or re-mortgage application	Legal Obligation
Processing information relevant to services/repairs/other charges	Contract
Conducting rent reviews	Contract
Processing information in connection with managing your business lease or tenancy	Contract
Investigating complaints	Legitimate Interest
Preventing and detect crime and resolve disputes	Legal Obligation
Preventing and detect fraud and money laundering	Legal Obligation
Promoting safety and the quiet enjoyment of our neighbourhoods and communities	Legal Obligation
Promoting equal opportunities and fair treatment for all our customers	Legal Obligation
Meeting the obligations we owe to our funders and regulators	Legal Obligation
Processing information in connection with resident led scrutiny participation including the organisation of scrutiny sessions, sending calendar invites, and sharing follow-up information.	Legitimate Interest

Where we rely on Legitimate Interest as our lawful basis, we may not always perform a Legitimate Interest Assessment (LIA). However, we ensure that any processing carried out on this basis is necessary, proportionate, and does not override your rights and freedoms. Our legitimate interests fall into these categories:

• Disclosures to public bodies, or bodies carrying out public tasks where the requesting body has confirmed it needs the information to carry out its public task.

• Safeguarding vulnerable individuals – this allows for the use of personal data for safeguarding purposes.

• Crime – this allows use of personal information where necessary for the purposes of detecting, investigating or preventing a crime; or apprehending or prosecuting offenders.

• National security, public security and defence – this allows the use personal information where necessary for purposes of safeguarding national security, protecting public security or defence.
• Emergencies – this allows use personal information where necessary when responding to an emergency.

We only rely on this basis where individuals would reasonably expect their data to be used in this way, and we take steps to minimise any privacy impact. You have the right to object to processing based on legitimate interests at any time. For more information or to exercise this right, please contact us using the details provided in this policy.

Sharing Your Personal Data

We will share your personal data that we hold with the following organisations:

• Adult Social Services
• Babergh District Council
• Braintree District Council
• Careium 
• Chelmsford City Council
• Child Protective Services
• Colchester City Council / Colchester Borough Homes
• Community 360
• Fire services
• Gateway to Homechoice
• Ipswich Borough Council
• Local MPs and Councillors
• Local support groups
• Maldon District Council
• Mid Suffolk District Council
• Multi-agency Public Protection Arrangement (MAPPA)
• Multi-agency Risk Assessment Conference (MARAC)
• Next Chapter
• NHS and GP Services
• Peabody
• Police Services
• Redloft
• Referral routes to include mental health support, alcohol / drug support
• Safeguarding Services
• Schools
• Third-party contractors who carry out repair and maintenance work on our behalf
•  Tendring District Council
• The Change Portfolio
• Travis Perkins
• Uttlesford District Council
• West Suffolk Council

We may disclose your personal data to other organisations who assist us to deliver our products or services; make a lawful request for disclosure; provide us with professional services or advice; or assist us in our marketing and promotional work.

International Transfers

We may transfer personal data to a country not in Europe where data subjects’ rights may not be adequately protected or enforceable. Whenever we arrange for international transfers of data overseas, we will ensure the suitable arrangements are in place to provide suitable safeguards for the people whose information we transfer. When we appoint overseas data processors, we check that suitable arrangements are in place such as European Commission Adequacy Decisions, Standard Contractual Clauses, or other permitted mechanisms.

CCTV

We rely on and use CCTV as an effective tool in helping us to achieve our aims and regulatory duties of creating safer communities and spaces in and around our residential properties, community hubs, commercial premises, office buildings and to create safer environments where people want to live and work. We place visible signage where we operate CCTV equipment, and where this is operated on our behalf.

We are obliged to share information with the relevant authorities for the prevention and detection of crime. The request for this information may be made under a police warrant, court order or an information sharing protocol. We may also share CCTV images in safeguarding cases.

CCTV is collected and stored in and around Eastlight's properties for crime prevention and detection purposes.

We use Dashcam recordings for maintaining staff safety and the efficiency of fleet vehicles. Dashcam footage may be provided to our insurance companies or the relevant authorities, where requested, following a road traffic incident. Vehicle tracking information and dashcam images may be used for disciplinary purposes, where driving standards fall below acceptable levels.

Data Retention

Eastlight will only keep your personal data for as long as it is necessary for the purposes for which they were collected. Typically, where data is collected for the purpose of a tenancy, this will be kept until the end of the tenancy plus 6 years.

Eastlight have policies in place to guide our retention of your personal data, using guidelines published by the National Housing Federation to fully inform the retention periods set.

If you would like more information on Eastlight’s retention periods, you can request to see our retention schedule on the contact details under ‘How to Contact Us’.

Your Rights

Under UK data protection law, you have a set of certain rights, and they are as follows:

• The Right to Access
• The Right to Rectification
• The Right to Erasure (In certain circumstances)
• The Right to Restrict Processing (In certain circumstances)
• The Right to Data Portability (In certain circumstances)
• The Right to Object (In certain circumstances)
• Rights in Relation to Automated Decision Making and Profiling
• The Right to Withdraw Your Consent at any time

You can exercise your rights by emailing us on the contact details below or by writing in to us at Eastlight Community Homes Ltd, Charter Way, Braintree, Essex, CM77 8FG. Please mark your correspondence for the attention of the Data Protection Officer.

You have the right to lodge a complaint if you believe we have mishandled your personal data or processed it in a way that is unlawful or not aligned with data protection principles. If you have concerns about how we collect, use, or protect your data, you can contact our Data Protection Officer at [insert contact details]. We take all complaints seriously and are committed to responding in a fair and timely manner, in line with our obligations under the UK GDPR. You also have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, if you are not satisfied with our response. You will not be penalised or treated unfairly for exercising this right. You can contact the ICO via www.ico.org.uk, casework@ico.org.uk or 0303 123 1113.

How to Contact Us

For further information regarding your personal data or about Eastlight’s approach to data protection in general please contact our Data Protection Manager at:

Eastlight Community Homes
Charter Way,
Braintree,
Essex,
CM77 8FG

(e) DPA-FOI@Eastlighthomes.co.uk

(t) 0330 128 0330