Privacy Policy Privacy Notice – For Customers

This privacy notice is a public document, which everyone can access and it is applicable to all customers of to explain how we collect and process information that is personally identifiable (PII) to conduct standard business activities as Registered Social Landlord (RSL), which the Regulator of Social Housing (RSH) regulates.

Who we are is a Data Controller. This means that as a business we decide the purpose for which and the manner in which the details we collect about you are deleted, stored, and processed.

Our head office is based at 1st Floor, Charlotte Square, Edinburgh, EH2 4HQ

Information we may collect about you

We may gather the following personal details about you:

When you initially make an application to us for housing:

If you wish to enter into a contract with a customer – whether a tenancy agreement or any other sort of contract – we need to gather certain kinds of personal data. This data makes certain we can supply appropriate services and meet the demands of the Social Housing Regulator.

The personal data that we gather includes the following:

  • Your full name (and a photo ID/proof of your identity).
  • National Insurance (NI) number.
  • Date of birth (DOB).
  • Contact information (correspondence address, email, or phone).
  • Details of any person authorised to act on your behalf, if applicable.
  • Proof of your eligibility for housing, or equity or interest in any other property.
  • Card details if you are going to pay by card, yet your card details will not be stored.
  • Banking details should your rent be paid by Direct Debit.
  • Basic details (DOB and name) of all residents in the household.
  • Other personal details that will differ on an individual basis to enable us to resolve fraud, alleged anti-social behaviour, or a breach of the tenancy.

It could also be a necessity for us to gather extra information to make certain the specific requirements of our customers can be reached.

Extra details that we may request include the following:

  • Income details, payslips, bank statements, or photo ID for processing a house purchase or sale.
  • Health details when this is needed to supporting funding adaptations to be made to the property you reside in.
  • Monetary information to supply advice and assistance on financial matters.
  • Vulnerabilities or disabilities.

Information needed for tenancy management and contacting you regarding your housing requirements:

    • Image and voice recordings for quality management, crime prevention, and safety.
    • Feedback from our contractors regarding their appointments with you.

Information that you supply to your relevant maintenance, local housing, or other type of dedicated team.

  • Details relating to the maintenance and repair of your property.
  • Your support needs, enabling us to know how we can help you before your tenancy and during it.

To help you buy part or all of your property:

  • Credit ratings.
  • Affordability checks.

To provide security:

  • Calls that are made to our customer services team will be recorded for quality and training purposes.
  • We operate CCTV systems, which will gather images that can be used for intelligence and evidence with regards to tenancy enforcement, police information, or court proceedings.

To improve the experience you have with us:

  • Our calls are recorded for quality and training purposes.
  • Your comments regarding our service and the service provided by our suppliers.
  • Details regarding complaints about our service or other individuals, incidents or accidents that involve you or your property.
  • With your consent, your story or video, photo, or name could be used for press releases, advertising, or brochures.
  • Your contact details and name for service information, newsletters, and customer satisfaction surveys.
  • You can give us details of your neighbours, relatives, and friends who you trust, and have supplied us with the consent for processing their data, to contact us on your behalf.

When you request extra services from us:

  • We may hold details regarding your history, for instance, in relation to offences or credit status, to enable us to decipher how best to provide services to you.
  • If we provide you with training or additional learning opportunities, we will ask about your learning history and employment.
  • If you get in touch with us regarding monetary issues, we will hold detailed information regarding your financial situation and income.
  • Records of payments for the services provided to you.
  • If you ask us for Support and Care requirements, we will keep detailed information regarding the needs of you and your family.
  • Contact details and the name of someone to contact you. The person contacting you could be one of our employees or a person from another organisation. When the individual is from a third party, we will make you aware of this before the information is processed about you.

Processing your information is only going to process personal data when we have a lawful basis for doing so. There are six lawful bases against which information will be processed. These are as follows:

Legitimate interests

We may need to process data about you for certain purposes that are not covered in different types of lawful basis. We would supply justification for doing so while making certain your rights and freedoms are balanced with our needs as a business.

Public interest

We could need to fulfil a duty that an official authority has given us. This would incorporate our obligation to a local authority or the government whereby we could be obligated to process your data for a certain reason.

Vital interests

Your data may be processed because this is deemed necessary in terms of protecting your interests. This would be to stop any incident that is life-threatening and could include us supplying medical and other details to the emergency services if required.

Legal obligations

The processing of data is required so that we can ensure we are in compliance with our obligations legally. We utilise this basis for all processing incorporating in compliance with laws and regulations that are applicable to us.


We could ask your consent for the use of data, for instance, to give you information regarding any services or offers that you could be interested in. You have the right to deny consent here, whether at the point of request or if you change your mind at a later point.

Contract fulfilment

The sixth basis is contract fulfilment. The processing of data here would be required so that the performance of our obligations that have been detailed in the contract with you can be fulfilled. This basis is utilised when data is processed in regards to tenancy management and your account with us and property. This is extended to making certain that there is the compliance of all tenancy conditions, as signed up to in your tenancy agreement. We use this basis to process all data involved in detecting fraud and prosecuting it, as well as anti-social behaviour and otherwise making certain that conditions of the tenancy are adhered to.

Information is also processed on behalf of organisations. In this instance, we will only process data that has been supplied to us in a manner in which the third party has instructed us to do so.

At, we strive to make certain that our customers are listened to with regards to the improvement or development of services and products. We could, therefore, ask for your views on a frequent basis through meetings, focus groups, or surveys. We will seek your consent on such matters where we feel it is necessary to do so.

For personal data storage, we have used a number of IT systems. This allows us to make sure that the organisation runs smoothly and that the right level of service is provided to our customers.

Who can access your personal information?

There are some occasions whereby your personal information will be shared with partners and third parties that are supplying you with a service. – There is the restriction of personal data on a need-to-know basis, for example, employees will only be permitted data access if this is required for them to do their job.

Third parties – Information and personal data will sometimes be shared with third parties. When this is done, it is always going to be subject to the complaint General Data Protection Regulation (GDPR) sharing agreements we have in place. For instance, we would share files on a customer with a business that would be involved in printing and distributing your rental statement. Once this task has been carried out, the third party will delete your information.

When third parties are asked to process your data on our behalf, we will always be clear regarding the way data should be used. They are not allowed to use this data for any other reason. Any third party that processes your data must adhere to the GDPR. We can routinely audit them to make certain data is correctly safeguarded.

Government agencies and departments – Regulator of Social Housing and the Department for Work and Pensions (DWP).

Contractors – Any contractors carrying out work for There are a number of contractors that we utilise to support us with the compliance, maintenance, and repair of properties.

Who else we could pass on your data to

There could be instances whereby your data is disclosed to others. This includes the following:

  • Trading agencies so that debt can be recovered where there is no known forwarding address
  • Debt collection agencies that are acting for others and on our behalf
  • Utility businesses
  • Learning institutions or training providers
  • External assistance where you have agreed to the referral, for instance, investigating monetary issues
  • Debt collection companies for collecting former and current debt
  • Credit reference agencies for rental tenants
  • Our insurers in the case of claims of public liability or similar
  • Our solicitors
  • Advocacy partner organisations
  • Mediation partner organisations
  • Local authorities, other supporting and housing organisations, and statutory agencies
  • Businesses that help us mail out newsletters and leaflets
  • Banks to carry out payments via a secure system
  • Our out-of-hours service call handling provider
  • Repairs contractors and housing maintenance contracts to undertake improvements or repairs to your property
  • Suppliers, contractors, and advocacy partners who supply services to you, or who provide services on our behalf. We will make certain that we have suitable data sharing protocols implemented.

In some instances, we could have duty to disclose your information by law to the following:

    • Medical staff, health authorities, fire services, or police.

Government departments, regulatory bodies, or local authorities.

We do not give any person access to your data in return for payment for their commercial or marketing purposes.

We will not share personal data with any person who claims they are representing you unless we are satisfied that they have been appointed by you or that they act in some official and recognised capacity.

Data retention will keep personal data in accordance with our Retention Schedule for Personal Data. data is kept in accordance with statutory, regulatory, and legislative guidelines. It will be held onto for no longer than is required for the purposes for which the personal data has been processed.

Details of periods of retention should be made accessible to you at the time the data is requested.

Your personal data rights

You have numerous rights when it comes to your personal data and the processing and holding of it. You can request the following:

The right to access your personal information

You have the right to request access to the personal information that holds about you.

Rights regarding automated data processing

You have the right to ensure a human is involved in data processing. Where we use systems that make automated decisions, we will always explain how the decision-making process works, and we will do this in person.

The erasure of your data

In some occurrences, you have the right for the deletion of your personal information. This is called the “right to be forgotten” and it is not absolute, so do be aware that it will only be applicable in specific circumstances. Examples include where the personal information we keep is not needed anymore for the reason it was collected in the first place.

In certain occurrences, you could be asked to provide us with consent to process your personal information lawfully. When we are given consent, you can also withdraw this at any time. The only exception is if we have some right for your request to be denied, for example, due to significant public or business interests, legal proceedings, or an account that is in arrears.

The rectification of your data

You have the right to make sure that the data about you is complete and accurate. Should you notice any mistakes in the data we keep, you can get in touch with us for information and to request that our records have this amended.

While we evaluate your request, your data will not be processed until we can determine whether there needs to be any corrections made.

The restriction of personal data processing

You have the right to request that stops or reduces the processing of personal data about you.

The right to data portability

Finally, you also have the right to request to transfer, duplicate, or move your personal information where you have supplied that information to us directly. To make a request, please get in touch with us.

Queries or complaints

We try to meet optimal standards when storing, processing, or collecting your personal data. If you feel like the storing, processing, or collection of your data is not appropriate in any way, please contact us so that we can rectify this.You should contact us at

The right to lodge a complaint with a supervisory authority

You also have the right to raise a concern or complaint regarding the way your personal data has been handled by us. This can be raised with a supervisory authority, i.e. the Information Commissioner’s Office (ICO)