Who we are

Leeds Federated Housing Association Ltd (“Leeds Fed”, “we”, “us”, or “our”) is a housing association and registered provider of social housing. We are regulated by the Regulator of Social Housing. Our company number is IP21457R.

Leeds Federated is a data controller and we are responsible for collecting and using information about users of our services including our website and any of our other platforms (“you”, “your”, or “yours”).

About this Notice

This Notice lets you know how we collect and use the information you give us and to provide you with sufficient information for you to be able to understand what we are doing with your information. We may change this privacy notice from time to time in order to reflect changes in the law and/or our privacy practices. When we do, we will inform you by an update on our website at www.lfha.co.uk.

As well as this notice, we may provide you with other privacy notices in future to deal with specific occasions when we are collecting or processing personal information about you. It is important that you read all such privacy notices so that you are aware of how and why we are using such information and that those notices may apply to specific types of data collection and processing.

This Notice also applies if you contact us, or we contact you.

Who can I complain to if I am unhappy about how my information is used?

You can complain directly to Leeds Federated’s Data Protection Officer at lee.welsh@lfha.co.uk or in writing to: Data Protection Officer, Leeds Federated, The Tannery,91 Kirkstall Road, Leeds,LS31HS. You also have the right to complain to the Information Commissioner’s Office on 0303 123 1113, or via their website: www.ico.org.uk.

If you have a concern about the way we are collecting or using your personal information, we would ask that you raise your concern with us in the first instance by using our Data Protection Officer’s contact details above.

What are your rights under data protection law?

You have the following rights in relation to your personal data:

Right to be informed: know how we use your data – which is provided to you within this Notice.
Access request: (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information held about you and to check that we are lawfully processing it. This information will be provided within 1 month of receipt of the request. Occasionally it may take us longer than a month if the request is particularly complex or a number of requests have been made.
To request correction of the personal information that we hold. This enables the correction of any incomplete or inaccurate information we hold, though we may need to verify the accuracy of the new information provided to us.
To request erasure of personal information. This enables the deletion or removal of personal information where there is no good reason for us continuing to process it. A request can also be made for deletion or removal of personal information where the right to object to processing has been successfully exercised (see below), where we may have processed information unlawfully or where we are required to erase personal information to comply with local law. Note, however, that we may not always be able to comply with requests of erasure for specific legal reasons. Notification of this will be given, if applicable, at the time of any request.
To object to processing of personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process information which override your rights and freedoms.
To request restriction of processing of personal information. This enables a request to be made to us to suspend the processing of personal information in the following scenarios: (a) if you want us to establish the information’s accuracy; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it because it is needed to establish, exercise or defend legal claims; or (d) you objected to use of the information but we need to verify whether we have overriding legitimate grounds to use it.
To request the transfer of personal information back to whom it belongs or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which we were given consent to use or where we used the information to perform a contract with you.
To withdraw consent at any time where we are relying on consent to process personal information. However, this will not affect the lawfulness of any processing carried out before the withdrawal of consent. If consent is withdrawn, we may not be able to provide certain services. We will advise if this is the case at the time of the withdrawal of consent.

If you wish to exercise any of these rights, then please contact us by using the details of our Data Protection Officer provided above.

There is no fee to access personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if a request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with a request in these circumstances.

We may need to request specific information to help us confirm your identity when making the request and ensure your right to access the personal information (or to exercise any of the other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to the request to speed up our response.

How do we keep your data secure?

We hold all our data in a secure data centre and back it up to a separate disaster recovery site. Access to data is strictly controlled and monitored. All devices and servers are kept up to date with security patches and virus definitions. Our systems are regularly audited and tested to make sure that we are following procedures and to detect and address potential security risks. Our employees are subject to a duty of confidentiality.

We also use technological means such as a secure cloud-based server, virus detection software, encryption, firewalls and SSL/ TLS technology to protect against unauthorised access or alterations to customer data.

The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity data includes first and last name, any previous names, marital status, title, date of birth and gender
Contact data includes billing address, home address, email address and telephone numbers, and social media handle
Financial data includes bank account and payment card details
Transaction data includes details about payments to and from you and other details of payments between you and Leeds Federated.
Technical data includes IP address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access our website.
Your marketing and communications preferences.

One or more of the above will be collected and processed for each purpose we set out below.

Although we do not envisage it to be part of our normal processing, we may need, on occasions, to process special categories of personal data, or other sensitive data, in order to comply with the law. If we do process such data, we will do so according to data protection law.

We may also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

How is your personal data collected?

The information we hold will either have been provided by you (e.g. as you interact with us for our services) or be collected by automated technologies as you interact with our website. As you interact with our website, technical data about your equipment, browsing actions and patterns will be automatically collected. This personal data is collected by using cookies and other similar technologies.

We do not use automated decision-making including profiling.

Other people’s information

If you provide us with information about another person, you confirm that they have appointed you to act for them e.g. you are their Carer, Parent or Guardian, they consent to the processing of their personal data and that you have informed them of our identity and the purposes (as set out above) for which their personal data will be processed. You will produce clear evidence to show you have been appointed and are able to share their personal information. When we first speak to them, we may tell them where we have got their information from.

How long do we keep your information for?

We will only retain your personal information for as long as is reasonably necessary to enable us to fulfil the purpose we have collected it for, including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period where we have a legal reason for doing so, in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect of the relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purpose for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We use guidance from the National Housing Federation to help us decide how long we should keep your information for.

Where your information is no longer required, we will ensure it is disposed of in a secure manner. Where you request that you would not like to receive further marketing communications from us, we will retain your details on a “deactivation list” to ensure that no further marketing communications are sent.

By law, we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers.

In some circumstances, you can ask us to delete your data: see ‘Your Rights’ below for further information.

What should you do if your personal information changes?

You should tell us so that we can update our records. You can do this from the Contact Us page of our website.

Sharing your data

When we use your data for the purposes described above, this may include sharing your data with third parties. We will only share your data where we have a legal obligation to do so, where it is necessary for the performance of a contract between you and us, it is in our legitimate interests and/or another lawful basis applies.

The third parties we may share your data with include:

our partners/ providers who connect us with you;
service providers who provide IT systems and software, and to host our website;
relevant local authorities;
third party service providers that we engage to deliver the material regarding the service you have purchased or for marketing purposes. We only use reputable service providers i.e. Royal Mail, Parcel Force etc;
analytics and search engine providers that assist us in the improvement and optimisation of our website;
HM Revenue & Customs, Department for Work and Pensions (DWP), regulators and other authorities based in the United Kingdom including the police (e.g. for crime prevention or detection, or matters of national security and taxation/fraud reasons (including housing fraud), and emergency services;
credit reference agencies where we need to assess your credit score where when we enter into a contract with you
in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
if Leeds Federated or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets;
if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements, or to protect the rights, property, or safety of Leeds Federated, our customers, or others;
third parties to whom we disclose information about you as required by law, to enforce an agreement and to preserve our rights including debt enforcement organisations we use; and

Third parties only have access to personal information to perform the described purposes and may not use it for other purposes. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We try to ensure this by having data processing agreements with these third parties, requiring that the third party takes such measures in order to maintain our commitment to protecting data. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Cookies and similar technologies

Our website uses cookies to:

Help us identify how you use our website
Provide us with information on how we can improve our website and online services for you
Help us record your user preference

To find out more about cookies, please see our cookie declaration.

What do we use your personal data for and what are our legal grounds (lawful bases) for this?

The law requires us to have a lawful basis for collecting and using your personal data. We rely on one or more of the following lawful bases:

Consent

This applies when you contact us or we contact you and you provide your personal data and specific consent for us to use that data to provide a service. For example:

to send you information about our services;
details of the emails and other digital communications we send to you that you open, including any links in them that you click on;
your feedback and contributions to customer surveys and questionnaires; and
dealing with a customer complaint you have raised with us, and we need to contact you for further information or to otherwise resolve the complaint.

When collecting your data, we will ensure it is clear to you what you are consenting to. You have the right to withdraw consent to any processing that you have previously given consent to at any time.

Contractual obligations

This applies when we process your personal data in order for us to provide you with a service or to take steps to enter into a contract with you. For example, when you make a purchase for a service, we’ll collect your address details in order to carry out the service.

Legal obligations

This is where we need to process your data in order to comply with the law. For example, we may pass on details of individuals involved in criminal activity if required to by law enforcement.

Legitimate interests

This is where we can use personal data to enable us to accomplish our legitimate interests as may be reasonably expected as part of running our business. For example, we may review your purchase history with us to ensure we are providing you with the correct service. Also, we may contact you for feedback on the engagements provided for service improvement purposes.

Our purposes for collecting the data we have set out in this Notice and the lawful bases relied on are as follows:

To administer the housing register and allocate properties. This is necessary to enter into a contract with you and to meet our legal obligations.

To administer the sale and re-sale of properties where applicable. This is necessary to enter into a contract with you and for the performance of the contract between you and us.

To contact you and respond to correspondence from you to us regarding your contract with us. This is necessary for the performance of the contract between you and us, or taking steps for entering into a contract with you, and to meet our legal obligations.

To manage your tenancy including pre-tenancy work, tenancy changes, mutual exchanges, and end of tenancy administration. This is necessary to enter into a contract with you and for the performance of the contract between you and us, and to meet our legal obligations.

To deliver repairs and other works to your home and any communal areas. This is where necessary for the performance of the contract between you and us, and to meet our legal obligations.

To take rent payments and manage your rent account. This is necessary for the performance of the contract between you and us.

To take payments for any service charges and other non-rent services. This is necessary for the performance of the contract between you and us and where necessary to meet our legal obligations.

To respond to any enquiries or complaints you contact us about. This is in our legitimate interests in ensuring we provide the correct service to you, running our business and preventing fraud, and, where necessary, to meet our legal obligations.

To deal with complaints of anti-social behaviour, preventing and detecting crime. This is necessary for the performance of the contract between you and us and to meet our legal obligations. If we identify through contact with you any additional support needs you have, we will tailor the way we engage with you to help you successfully maintain your tenancy. This is in our legitimate interests in providing a suitable and correct service to you..

To provide housing support for customers in extra care, sheltered housing schemes and general needs properties, where applicable. This is where necessary for the performance of the contract between you and us, and for our legitimate interests in providing a suitable and correct service to you..

To contact you to seek feedback on the contractual services we provide to you. This is necessary for the performance of the contract between you and us, and for our legitimate interests in providing a suitable and correct service to you.

To engage you in the delivery of our services. This is in our legitimate interests in providing a suitable and correct service to you and, in particular cases, necessary to meet our legal obligations.

To take any action necessary for breach of tenancy. This may be necessary for the performance of the contract between you and us and/or where it is in our legitimate interests in protecting other customers and our business to do so.

To recover any debt owed to us. This is in our legitimate interests in running and protecting our business and may be necessary for the performance of the contract between you and us.

To process any application from you to exercise your Right to Buy or Right to Acquire. This is necessary to meet our legal obligations. Where necessary, to protect our employees and other individuals. We may capture your image on our CCTV systems if you visit premises which are covered by this service. This information may be necessary for the purposes of public safety and crime prevention. We record calls to help us review our performance and investigate complaints or claims. It is in our legitimate interests to do this. We may use your image in photographs for publicity material, where we have your consent to do so. When we obtain your consent for this, we will tell you how you can withdraw your consent.

To develop, test and maintain internal systems and processes used in the delivery of our services. This is in our legitimate interests as it may be necessary from time to time to ensure our systems and processes are effective, efficient and secure.

To send you marketing communications. This is in accordance with your contact preferences and so based on consent and/ or legitimate interests in running our business, and providing you with a suitable and correct service.

To use data analytics to improve our website, marketing, relationships and experiences. This is necessary for our legitimate interests to better understand visitors to our website and their use of our services, to keep our website up to date, to develop our business and to inform our marketing strategy.

How to contact us

We have a dedicated Data Protection Officer (DPO). You can contact our DPO using the details in the section “Who can I complain to…” above. There are also lots of other ways you can get in touch with us. You can find the details by going to the Contact Us page on our website.

Third party links

Our website may contain links to other websites or other organisations that have their own privacy notices. Please make sure you read their terms and conditions and privacy notices carefully before providing any personal data as we are not responsible for the content of these websites, their own privacy notices or for the way in which they hold and treat information about their users. In particular, unless expressly stated, we are not agents for these sites, nor are we authorised to make representations on their behalf.

Changes to the privacy policy

We keep our privacy policy under review, so please check back regularly to keep informed of updates to this Notice.

Privacy policy