Last updated: September 2020
See also
Under data protection law, we need to make you aware of your data rights. Our reason for processing your data will affect the rights you have.
- Your right to be informed
- Your right of access (subject access requests)
- Your right to have us change incorrect or incomplete data
- Your right to have us delete your data
- Your right to restrict how we process your data
- Your right to object to how we process your data
- Your right to data portability
- Your rights in relation to automated decision making and automated profiling
Your right to be informed
This right means we must tell you what personal data we collect about you, how we got it, why we need it and what we do with it, including who we share it with and how long we’ll keep it. See our privacy notice for more information.
Your right of access (subject access requests)
This right means we must give you a copy of your data that we hold as well as details on what we collect, how we got it, why we need it and what we do with it, including who we share it with and how long we’ll keep it.
You can use this right to check if the data we hold about you is correct.
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
Your right to have us change incorrect or incomplete data
This right means you can ask us to correct or complete your data if it's inaccurate or incomplete. If your data is incomplete we may ask you for a statement we can add to what we already hold.
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
Your right to have us delete your data
This right is sometimes called ‘the right to be forgotten’. You can ask us to delete or remove your data if:
- we don’t need it for the purposes we originally collected or processed it (we may need to keep data for legal or audit purposes once we’ve closed your case)
- we were processing it unlawfully
- we were processing it to provide you information society services as a child (for example, social media)
- we relied on your consent to process it and you’ve withdrawn your consent
- you’ve objected to the processing and we don’t have overriding legitimate grounds to continue processing it
- we have to erase your data to comply with a legal obligation
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
We don’t have to erase or remove your data if we need to process it:
- to comply with the law or carry out our official functions or perform a public task
- to exercise or defend legal claims
- to exercise the right of freedom of expression and information
- for public health purposes in the public interest
- for archiving purposes in the public interest, scientific or historical research or statistical analysis.
Your right to restrict how we process your data
This right means you can stop us processing your data, except to store it.
You can ask us to restrict our processing of your data if:
- we’re processing your data unlawfully and you want us to stop processing it but not erase it from our systems and records.
- we no longer need it but you want us to keep it so you can establish, exercise or defend a legal claim.
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
We’ll also restrict our processing of your data whilst we consider your request to:
- change incorrect or incomplete data - we’ll stop processing the data you’ve said is inaccurate
- object to how we process your data – we’ll stop the processing you’ve objected to
When we restrict how we process your data, we won’t do anything but store it unless you’ve given consent or we need to lift the restriction because your data is needed to establish, exercise or defend a legal claim, protect another person’s rights or there’s a substantial public interest. If we need to lift the restriction we’ll let you know.
Your right to object to how we process your data
This right means you can stop us processing your data:
- to profile you or send you marketing information (direct marketing)
- to carry out scientific or historical research or statistical analysis
- to meet our legitimate interests, or
- to carry out our official functions or perform a public task
When this right applies, we’ll consider your objection and stop the processing you’ve objected to or explain why we aren’t complying with your objection. Sometimes we use your data for more than one purpose. So, if we comply with your objection we’ll only stop the processing you objected to. This means if we need to keep using your data for another purpose it won’t be erased from our systems and records.
We don’t have to comply with your objection if we’re processing it for the purposes listed above and:
- we’re processing your data to establish, exercise or defend a legal claim, or
- we can demonstrate we have compelling legitimate grounds to process your data which don’t override your interests, rights and freedoms.
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
If we’re carrying out the processing online then you can also object online (for example, if we send you a marketing email it must include a link to how you object to further marketing emails).
Your right to data portability
This right is to make it easier for you to move your data between service providers.
It only applies if we’re processing your data to carry out a contract between us or if we’re relying on your consent to process your data and we’re using IT systems or databases to do this.
When it applies, you have the right to ask us to provide you with a copy of your data in a structured, commonly used and machine-readable format (e.g. .csv format).
We must provide this to you or, if you’ve asked us to and it’s technically feasible, send it directly to the organisation you’ve specified.
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
Your rights in relation to automated decision making and automated profiling
This right is to protect you from having significant (potentially damaging) decisions made about you by a machine with no person involved.
- Automated decisions: where a machine makes a decision without a person being involved
- Automated profiling: where a machine uses someone’s characteristics to analyse or predict something about them without a person being involved
We won’t make automated decisions or carry out automated profiling on:
- children’s data
- special category data such as health, religious, sexual orientation, trade union membership or ethnic information, unless we have your explicit consent or it’s necessary for a substantial public interest.
If we make automated decisions or carry out automated profiling we’ll explain the logic we use and tell you what impact it could have on you.
If it could have a legal or equally significant impact on you, then you have the right to challenge our decision, express your point of view, ask us to have a person check the decision and get an explanation of our decision. We must respond to your request and act on the decision made by the person and not the automated decision.
You can request this in writing or verbally by contacting our Resident Experience Team. See Your data rights – how to exercise them
This right won’t apply to you if the automated decision or automated profiling is:
- authorised by law
- necessary to enter into or carry out a contract between us
- based on you giving us your explicit consent, or
- if it won’t have a legal or equally significant impact on you.
See also