Privacy notice.

This privacy notice covers ‘personal data’ which is information which directly or indirectly identifies a person. This could mean:

• name
• address
• email address
• telephone number
• date of birth

Some personal data is called special category data. This includes types of information like ethnicity, religion and health.

When you provide information about household members, we assume you do so with their full knowledge. This information is requested as part of your tenancy, and it is in our legitimate interests to know who will live in our homes.

We collect children’s information only as necessary. For instance, you provide children’s information because they are part of your household.

We only collect children’s information with appropriate parental or guardian consent.

We collect your personal data to provide our services to you.
Each service has its own requirements. We only ask you to provide the information that we need to provide you with that service.

For instance, we need your information to:

• evaluate your application for a tenancy/lease or license
• enter into a tenancy with you
• provide services relating to your housing needs

In addition, we may collect your information to comply with our legal and regulatory obligations.

We will:

• only ask for information if we have legitimate grounds to do so
• only ask for the information we need
• keep accurate and up-to-date information
• only keep information for as long as it is needed
• ensure that we take appropriate steps to keep your information secure
• ensure all staff who have access to information about you will have received training on data protection and information security

The information we hold includes, but is not limited to, the following:

• name
• address, including previous and forwarding addresses
• contact information including email address
• gender
• date of birth
• employment details
• National Insurance number to carry out to carry out functions such as Universal Credit and/or supporting people contracts
• income and state benefits
• information about your family, lifestyle and social circumstances
• marital status
• details about your representatives or next of kin
• audio recordings – in an emergency where a colleague is at risk of harm or abuse
• telephone call recording
• household members

Special category personal data is information that requires extra protection.

This includes but is not limited to:

• racial or ethnic background
• sexual orientation
• health information
• religious or philosophical beliefs
• trade union membership
• criminal convictions or offences

We only process sensitive personal data when it is necessary, and we follow strict rules to protect your privacy.

We may process this information if:

• we are legally required to (eg to protect vulnerable people)
• it’s necessary to protect life or safety (eg during a medical emergency)
• it serves the public interest (eg to ensure fair access to services)
• it’s needed to prevent or detect crime
• it’s required for insurance purposes
• you have explicitly agreed to it (eg under a contract or agreement with us)
• we are under contractual necessity (eg commissioner’s contracts)

We may also use sensitive data to:

• monitor equality, diversity, and inclusion in our services
• ensure we deliver services fairly and appropriately

We use video surveillance management systems (commonly known as CCTV) to help reduce the fear or threat of crime, to protect customers, colleagues, our premises including our offices, fixtures, fittings, and property.

Video surveillance images will be used to:

• assist in the prevention and detection of crime
• facilitate the identification, apprehension and prosecution of offenders in relation to crime
• ensure the security of customers, residents, employees, visitors and property
• facilitate appropriate door and site access
• reduce incidences of vandalism and criminal damage
• enhance the feeling of security provided to customers, staff, and visitors

What information is collected

Video surveillance images may reveal or enable the inference of special categories of data, such as any disability or health conditions, racial or ethnic origin as well as religious beliefs.

It will depend on the service; however, the starting point will normally be yourself or someone acting on your behalf.

We may also receive information from other organisations who we work with to deliver a service. Information may be shared with us by your local authority or other government agencies.

We may receive information about you from third parties, for example a previous landlord, other professional bodies, the police, energy providers, the Home Office to confirm your immigration status or repairs carried out by contractors.

Your personal data is also gathered if you use our web forms, social media and webchat.

Where it is necessary to share information about you, we will always comply with all aspects of Data Protection Legislation. Set out below are examples of when this may occur.

Some of your information will be accessible by colleagues who need to see it to carry out their roles, and with those parts of our organisation that are involved in supporting our services to you. Sometimes, we appoint third parties to do work for us which may involve them processing your data on our behalf.

Occasionally we need to share personal information we hold about you with others, including next of kin (particularly in emergencies or when we urgently need to carry out gas safety inspections and are unable to make an appointment with you), or with anyone who has been designated by you as authorised to receive information in specific circumstances, or to help you manage your account with us.

Sometimes, we may need to share your information with other organisations. We will only do so when reasonably necessary, and when we have a lawful basis under the UK GDPR, e.g. because we need to do so in performing our landlord obligations effectively and efficiently. Occasionally we share your information because we are compelled to do so, for example, because a court has ordered it, or because we must do so by law.

Where reasonably necessary and lawful, we may share certain information with:

• contractors (who carry out repairs, safety work, surveys, inspections and property improvement assessment and works, as well as general maintenance and repair)
• specialist IT service providers that help us to safely store, process and back-up our data
• providers of residential building security systems
• archiving and data management service providers
• out of hours customer contact services
• local government (including homelessness units, social services, occupational therapists and council tax departments)
• agencies involved with benefits and tax credits (including the DWP and Pensions service)
• other registered providers of social housing or landlords in the context of a stock disposal or acquisition, sale, acquisition or partnership agreement in respect of some, or all, of its business
• support service providers which you have contracted directly
• charities and voluntary agencies (always with your consent)
• health services (including GPs) (always with your consent, unless in case of a life-threatening emergency)
• Police and law enforcement agencies e.g. in respect of anti-social behaviour or suspected crimes
• the Financial Conduct Authority and HMRC
• probation services
• emergency services
• anyone you have appointed as your authorised contact for management of your tenancy, or who is formally registered (by the Office of the Public Guardian) as your lawful attorney under a Lasting Power of Attorney
• home service and care providers
• other landlords (always with your consent, where a reference is being provided)
• utilities companies e.g. where you have ended your tenancy but failed to pay your bill
• insurance companies
• courts and tribunals e.g. where we are filing or defending a claim, or where an order is issued for disclosure to the court
• The Regulator of Social Housing
• The Housing Ombudsman
• UK and Welsh government departments (e.g. the Department for Energy Security and Net Zero)
• auditors
• debt collection agencies
• credit reference agencies to facilitate social housing fraud checks
• survey and research organisations
• press and the media (always with your consent)
• financial service providers and advisors
• ortgage administrators and lenders
• solicitors

Sometimes, these third parties are simply carrying out work on our behalf and to do this, they need certain personal information of customers. In such cases, we appoint them to do this under contracts that contain data processing clauses which safeguard the data rights of our customers.

We have in place a variety of technical and organisational security measures designed to protect your personal data and prevent unauthorised access to use or disclose it. For example, we limit access to your information to only those who need it and are authorised to view it. When we share your data with contractors, suppliers, or partners, we have strict contracts in place to ensure they handle your information securely and keep it confidential.

To help protect your information, we will ask you, or anyone representing you, security questions to confirm your identity when you call us—or when we call you.

We won’t discuss your information with anyone else unless:

• the law requires or permits it
• you have given us written permission
• there is a legal deputy or Power of Attorney
• you give us a clear, one-time verbal instruction

Right of access

You have the right of access to the information we hold about you. by making a Subject Access Request. If you would like to do this, you can email us at the following address: dpo@hedyn.wales or contact us by telephone on 0300 1212 345, in writing or in person.
When you make a request, we will comply with it within one calendar month.

If we cannot comply or need to extend this timescale by a further two months, we will let you know. In some cases, we may limit access if it concerns the rights of others or if there is a lawful reason to withhold certain details. For further information visit the Information Commissioner’s Office (ICO) ‘subject access request’ page.

Right to be informed

You have the right to be informed on the processing of your personal data. In this privacy notice we tell you who we are, why we collect your information, how we use it, who we may share it with and how long we keep the information for. For further information please visit the ICO ‘right to be informed’ web page.

Right to rectification (also known as correction)

If any of your information is inaccurate or incomplete, you can ask us to correct it to ensure accuracy. For further information please visit the ICO ‘right to rectification’ web page.

Right to erasure (also known as the right to be forgotten)

You may request that we delete your personal data This is not an absolute right. We will assess your request, and, in some circumstances, your information may need to be kept. For further information please visit the ICO ‘right to erasure’ web page.

Right to restriction

This right gives you the ability to limit how we use your personal data in some circumstances. Our lawful bases for processing may affect how and whether this right applies. For further information please visit the ICO ‘right to restrict’ web page.

Right to data portability

In certain circumstances, you can ask us to transfer your data to another party of your choosing. The right to data portability is subject to the lawful basis for processing and is typically applicable when processing is based on consent or contractual necessity. For further information please visit the ICO ‘right to data portability’ web page.

Right not to be subject to automated decision making

We do not currently undertake any automated decision making using technology and without human involvement. Should we do so in future to help us provide services to you, we will inform you of your right to object. For more information, please visit the ICO ‘Your rights relating to decisions being made about you without human involvement’ page.

Right to object

You have the right to object to how we process your personal data. This means that you can stop or prevent us from using your personal data in certain limited circumstances. For more information, please visit the ICO ‘right to object’ web page.

Right to withdraw consent

Where you have given us your consent to use your information, you have the right to change your mind and withdraw your consent. Withdrawal of your consent won’t affect any processing we have done before the withdrawal but may limit our ability to continue providing you with certain services.

We use your information to provide the housing and support you need and maintain these services during your time as our resident.

We also use your information for the following reasons:

• manage applications made by you
• manage your tenancy, lease or other services you have engaged with
• fulfil our legal obligations
• meet your needs in our service delivery
• plan, develop and improve our products and services
• prevent fraud and illegal sub-letting
• to contact you regarding your request
• to prevent and detect crime, resolve disputes, and promote safety and the quiet enjoyment of our neighbourhoods and communities
• we may contact you for resident satisfaction surveys to help monitor performance and improve our services
• information may be used for resident research, analysis and developing statistics and we may supply data to third party contractors to deliver services on our behalf for this purpose
• to understand how we are performing we undertake call recording in some of our service areas for training and quality monitoring purposes

The lawful bases we rely on for our different processing activities are included but are not limited to the activities set out in our lawful basis table:

We will only keep your information for as long as necessary to fulfil the purpose we collected it for, including for satisfying any legal, accounting, or reporting requirements and in accordance with our retention and disposal guidelines.

If you would like further information, please contact our Data Protection Team at dpo@Hedyn.wales.

We will not transfer or store your personal information outside of the United Kingdom unless:

• The country that we send the information to is approved by the Information Commissioner’s Office as providing an adequate level of protection for the transfer of personal information.
• The recipient has agreed with us standard contractual clauses approved by the Information Commissioner’s Office, obliging the recipient to safeguard the personal information.
• Another situation exists where the transfer is permitted under applicable data protection legislation.

For further information you can contact our Data Protection Officer at:
Data Protection Officer
Hedyn
Nexus House
Newport
NP20 2DW

Email: dpo@hedyn.wales

For independent advice about data protection, privacy and data sharing you can contact the Information Commissioner’s Office (ICO). Visit the ICO website for their contact details, or you can call them on 0303 123 1113.

If you have concerns about how we handle your data, please contact us so we can address them. We are committed to upholding your rights and addressing any data protection concerns promptly.

If you are unsatisfied with our response, you can also contact the Information Commissioner’s Office at:

• Visit the ICO website
• Telephone: 0303 123 1113

We keep this privacy notice under regular review. This privacy notice was last updated on 30/09/2025.