About this policy
Target exists to transform the lives of vulnerable and marginalised people; helping them to achieve a stable home, increase their independence and realise their potential. We collect personal data, special category data and criminal offence data in order to provide safe and effective personalised support to our customers, assist with public protection arrangements and meet the reporting and monitoring requirements set by our Commissioners.
Whilst we do not engage in automatic data processing or marketing activity we are responsible for the security of a significant amount of personal data about our customers and as an employer we retain personal data about our employees, volunteers and applicants. We will ensure that the collection, storage, retention and disposal of this data conform to all the principles and requirements under the GDPR.
We are committed to protecting your privacy and take this responsibility very seriously. This notice outlines the data we collect, how we may use it, how we protect your data and your rights, and how you can exercise those rights.
References to ‘we’, ‘us’, or ‘Target’, refer to Target Housing Ltd, registered charity no. 1017481, Norman House, 134 Upperthorpe, Sheffield, S6 3NF.
1. Why we collect your data
We collect personal data for many reasons, including providing you with services, communicating with you and sending you information you have requested. Depending on how you interact with us, we may process data for the following reasons:
- to provide you with advice or support that either you have requested or because someone else has referred you to us.
- to administer services Target is providing to you
- to communicate with you regarding Target’s work
- to process donations and administer Gift Aid information for any donation you make to Target
- to provide you with information about meetings or events
- to manage your communication preferences
- to process job applications or volunteer placements
- to conduct surveys, research and gather feedback
- to obtain information to improve Target’s services and user experiences
- to address and resolve complaints about Target and our services
- to carry out research in support of our charitable aims
- to comply with applicable laws and regulations, and requests from statutory agencies
- to comply with our contractual obligations to our funders
2. Information we collect
We may collect the following personal information:
- your full name and date of birth
- contact details – including your postal address, telephone number(s), and email address
- National Insurance number
- details of your case when providing you with housing advice or services
- your bank details – if you make payments to us or if we employ you.
- records of your correspondence and engagement with us
- information you may enter on the Target website
- photographs, video or audio recordings
- biographical information
- other information you share with us
This information may be collected via:
- any paper forms you complete
- telephone, webchat or email conversations, or face-to-face interactions
- digital forms completed via our website, or online surveys
- communication via social media
We sometimes also collect sensitive, personal data about individuals. This includes information about health, religion, sexuality, ethnicity and criminal records. We will normally only record this data where we have your explicit consent, unless we are permitted to do so in other circumstances under data protection law. For example, we may record information about your offences or health as part of necessary risk management practice or as part of your employment contract.
3. Using your personal data – Target Services
If you are receiving advice or support from us, or if someone else has referred you to us for such a service, we will need to process your data because of your specific relationship with us.
We will keep all your relevant personal information – including notes, letters and information given to us about you – in a confidential record that is specific to you. We use an electronic case management system as well as paper records to support our advice, guidance and support provision. This means that we can keep the information you provide us, so we are able to see the history and relevant details of your case(s). This ensures that we provide appropriate and accurate advice or support. We take information security very seriously. No one is allowed access to our system or files unless they need this to provide the service to you, or for one of the other purposes discussed in this notice.
We may need to disclose and discuss your personal information to third party individuals or organisations if this is necessary to help resolve your issue. Examples include:
- your landlord
- council housing, social services and Housing Benefits teams
- the DWP/Job Centre or HMRC
- your GP or medical professionals
- lenders and creditors
- legal representatives or advisers
- the court
We will discuss this with you as we go along, and will only act with your express consent unless one of the other legal bases in data protection legislation applies.
To ensure that our services meet a high standard of quality, client files are sometimes checked by our quality assurance staff. Files may also be checked by external auditors if the work we do is funded by another organisation, such as a local authority, Home Office or Big Lottery. All auditors are bound by confidentiality policies.
Some of our funders require us to complete reports in order to demonstrate whether we are meeting our contractual obligations. These reports may be compiled utilising personal data that is collated to form statistics. These statistics will not personally identify you and we will ensure the confidentiality of any person described within the report.
We may use your data for general statistical reports to monitor performance across the organisation. These statistics will not include any information that could be used to identify any individual.
4. Using your personal data – Newsletters, events and general updates
Target would like to keep you informed about events and updates that may be of interest to you.
Target Hosts a regional Front-Line network funded by St-Martin-in-the-fields. The forum brings together front-line workers across the sector so that they can share the challenges and barriers they face and try to seek collective solutions. We would love to keep you up to date with our events and forum news so that you can participate in this.
We will obtain your consent to contact you by email and text message for the purpose of keeping you informed about Target of Front-line Network activity. We will also obtain consent from all new supporters (who sign up after 25 May 2018) to provide this information.
We will not normally send you any information by post, unless you specifically request to receive information in this way, or if it is a necessary part of you support or employment contract with us.
We will send the following materials, if you choose to receive them:
- updates about Target’s work – including newsletters, magazines, and other publications informing you about our work
- events – including details of Frontline Network events. Please note that if you sign up to a Target event, we will also send you administrative communications about how you can take part. On occasion we will also send you a reminder about the same event in the future, in case you want to participate in it again
- volunteering – information about how you can help support Target by giving up your time or using your influence to progress our aims, along with updates on the impact of your work
We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.
You can withdraw your consent, unsubscribe from or update your marketing preferences at any point using the details in the ‘Contact us’ section below.
If you make any changes to your consent, we will update your record without undue delay and at the latest within one month of receipt.
5. Social media/digital
Depending on your settings or the privacy policies for social media messaging services like Facebook and Twitter, you may – in the future – receive targeted advertisements through our use of social media audience tools.
We only work with social media networks that provide a facility for secure and encrypted upload of data. For more information, or to manage your social media ad preferences, please see Facebook’s ‘About Custom Audiences’ guide and its Data Policy.
6. Applying for a job at Target
When you apply for a job with us, your personal data will be collated to monitor the progression of your application, and the effectiveness of the recruitment process. Where we need to share your data – such as for gathering references or obtaining Disclosure and Barring Services – you will be informed beforehand, unless the disclosure is required by law. These checks are only done after a position has been offered.
On the application form, you are asked to complete the referee details, and can tick permission to contact referee. If ‘yes’ is ‘ticked’ we will automatically send out reference requests, once offered a role. If you tick no, we will contact successful candidates for permission first.
Personal data about unsuccessful applicants is held for 12 months after the recruitment exercise is completed. You can ask us to remove certain items of your data before this time. However, please be aware that if you have asked us to delete your information you cannot later appeal our decision and will need to complete any new applications in full.
We may ask if we can contact you about other vacancies of potential interest. We will establish your contact preferences, which you can change at any time, especially if you later decide you do not want to be kept informed of potential job opportunities.
Once you have taken up employment with Target, we will compile a file relating to your employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment. Once your employment with us has ended, we will retain the file in accordance with the requirements of our retention schedule (this is currently five years, but this is under review and may be subject to change) and then delete it from our files.
You are entitled to see the information that we hold about you and you have the right of ‘rectification’ if any of your personal data has been recorded incorrectly.
7. Professional contacts
We may collect data about professional contacts and partners with whom we work, or to whom we provide professional services – such as training or publications. Personal data collected in this way will be processed in accordance with data protection legislation and this policy.
We may send our professional partners information and updates about our work (primarily by email). Such contacts can opt out of receiving this information at any time.
We maintain a record of contact and job role information related to key stakeholders within third sector and statutory services to enable us to engage effectively in multi-agency working. This is at an organisational, local and at individual levels across the organisation. This usually includes keeping records of contact details such as name, job title, address, telephone number and email address.
8. Our legal basis for processing personal data
A lawful basis is required for the collection and use of all personal data. The law allows for six core bases under which personal data can be processed. Four of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:
- a person’s consent (for example, to send you news or details of events and also for the processing of sensitive personal information, such as ethnicity and sexuality for equalities monitoring)
- a contractual relationship (for example: your employment contract with us, or your tenancy agreement if you rent a property with us)
- processing that is necessary for compliance with a legal obligation (e.g. payroll information)
- Target’s legitimate interests (please see below for more information)
Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair and does not adversely impact the rights of the individual concerned.
When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that benefit you and our charitable aims and are not intrusive or potentially harmful.
If you would like more information on our uses of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us using the details in the ‘Contact us’ section below.
9. Disclosure of your personal data
We will not share any of your personal data with any third party – except where:
- the transfer is to a secure data processor, which carries out data processing operations on our behalf. For example we outsource our payroll function to a trusted provider and we have checked that they are compliant with GDPR.
- we are required to do so by law, for example to law enforcement or regulatory bodies where this is required or allowed under the relevant legislation
- we are required to do so because it is a condition of our funding or service provision that we share certain information with the funder or with partnership organisations. We will tell you if this is the case.
- it is necessary to protect the vital interests of an individual
- we have obtained your consent
We will never share or sell your personal data to a third-party organisation for marketing, fundraising, or campaigning purposes.
10. Security of your personal data
We use appropriate technical and organisational measures and precautions to protect your personal data and to prevent the loss, misuse or alteration of your personal data.
The transmission of information via the internet is not completely secure. We cannot guarantee the absolute security of data transmitted to our website, however we will utilise the precautions available to protect your personal data. Once we have received your information, we will use strict procedures and security features to prevent unauthorised access.
We encourage you to review the privacy statements of websites you choose to link to from the Target website, so that you can understand how those sites collect, use and share your information. We are not responsible for the privacy statements, security, or other content on sites outside of our own website.
11. Use of data processors
We use third-party suppliers to manage some aspects of data processing, for example:
- Voluntary Action Rotherham: carry out our payroll function
- ESP provide cloud storage, web and general IT support
- OmniLedger provide our rent and case management systems.
We only utilise trusted external companies who have demonstrated their commitment to fully meeting the requirements of the GDPR. They are only permitted to use the data in accordance with relevant data protection legislation, and in accordance with a data processing agreement entered into between Target and the supplier.
12. Retention of your data
Whatever your relationship with us, we will only store your information for a specified amount of time, as set out in our internal data retention policy.
The length of time that data will be kept may depend on the reasons for which we are processing the data and on the regulations that the information falls under, such as financial regulations, Limitations Act, Health and Safety regulation etc., or any contractual obligation we might have – such as with government contracts or if we have a business case, such as with research data. For business case data, we will anonymise the data so no individual is identifiable.
Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy. Similarly the personal data obtained due to an unsuccessful or inappropriate referral will be retained for 12 months.
Once the retention period has expired, the information will be confidentially disposed, permanently deleted, or anonymised.
13. Your rights
You have many rights under data protection legislation. These include:
1. Right of Access
You have the right to know what information we hold about you and to ask, to see your records.
We will supply any information held about you, as soon as we can – following your request – and within one calendar month. We will not usually charge you for this, unless the request places a significant administrative burden upon us. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We will also need to establish a safe and secure means of transferring the data to you: such as giving you the data in person, or sending it via a secure, encrypted email address. We need to be sure we are only releasing your personal data to you.
This is called a data subject access, and can be done by:
- emailing: firstname.lastname@example.org
- writing to: Data Protection, Target Housing, A5 & A6 Bradmarsh Business Park, Bow Bridge Close, Rotherham, S60 1BY
- speaking to your key worker
2. Right to be informed
You have the right to be informed how your personal data will be used. This policy is intended to provide general information about how Target uses personal data. We are looking into the best ways of providing an appropriate level of specific information whenever we ask for personal information. You are also free to make enquiries about how your data is used – at any time – if you want more detailed information.
3. Right to withdraw consent
Where we process your data based on your consent you can withdraw that consent at any time. To withdraw consent or discuss this right further, please contact us using the ‘Contact us’ section below. There are some exceptions to this, for example where sensitive data relates to issues of safeguarding and each case will be reviewed on a individual basis.
4. Right to object
You also have a right to object to us processing data where we rely on it being within our legitimate interests to do so. To object or discuss this right with us further, please contact us using the details in the ‘Contact us’ section below.
5. Right to restrict processing
In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
6. Right of erasure
In some cases, you have the right to be forgotten (i.e. to have your personal data deleted from our database). It is unlikely that we can delete all records relating to existing employees or customers as we need to retain some personal information in order to continue the employment contract or to continue providing a service.
There will also be limitations as to the information that can be erased for recent ex-staff or ex-customers, however each case will be considered on an individual basis, weighing up the need to retain information against the needs of the person requesting the erasure. There may be some elements of personal data that can be deleted at the time of request, whilst others may necessitate a longer period of retention. We will also need to seek permission from our commissioners where the request relates to records that we are required to maintain, under our contractual obligations.
7. Right of rectification
If you believe our records are inaccurate, you have the right to ask for those records concerning you to be updated. To update your records, you can ask your key-worker, line-manager, the Data Protection Officer or get in touch with us using the details in the ‘Contact us’ section below.
8. Right to data portability
Where you have provided personal information in a standard electronic format, you have the right to request that the data is transferred to another service provider.
If you have any complaints about the way in which we have used your data, please get in touch with us using the details in the ‘Contact us’ section below. We would be happy to help and discuss your concerns.
You are also entitled to make a complaint to the Information Commissioner’s Office.
16. Contact Us
If you have any questions about this policy, would like more information, or want to exercise any of the rights set out in section 15 above, you can get in touch with us in the following ways: