Privacy notice - Subject Access Requests

The personal information we need to process your Subject Access Request may include but is not limited to:

• your full name and proof of your identity/photo ID
• your date of birth
• your contact details (phone, email or correspondence address)
• your previous address
• details of anyone authorised to act on your behalf if applicable
• length of time at your property address and rent reference number if applicable
• your photograph if you are requesting CCTV footage.

You are giving us your personal information to allow us to process your Subject Access Request and provide you with a response. We will also need to process your personal information if you ask us to review the way that we have handled your Subject Access Request or if you make a complaint to the UK Information Commissioner. We also use your information to verify your identity where required, contact you by post, email or telephone and to maintain our records.

You are entitled to make a Subject Access Request for information that we hold about you. Processing your personal information is necessary for the compliance with our legal obligations under the General Data Protection Regulations and the Data Protection Act 2018. Where you provide us with more sensitive personal information about you we will process this information for reasons of substantial public interest as set out in the Data Protection Act 2018.

We may ask you if we can process your personal information for additional purposes.

Where we do so, we will provide you with an additional privacy notice with information on how we will use your information for these additional purposes.

We are required to verify and check your details internally for fraud prevention. We may share this information with other public bodies (and also receive information from these other bodies) for fraud checking purposes. We are also legally obliged to share certain data with other public bodies, such as HMRC and will do so where the law requires this. We will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and appropriate. Your information is also analysed internally to help us improve our services.

We may transfer information about you to other Wheatley Group subsidiaries for purposes connected to your subject access request or the management of the company’s business.

Where you make a complaint to the UK Information Commissioner we are legally obliged to share your information with them.

As you have requested information from us we need to communicate with you. This will usually be in writing or by telephone, but is more commonly becoming electronic.

We will only discuss your request with those authorised (temporarily or permanently) by you.

Your personal information is stored on our paper and IT filing systems which may be copied for testing, backup, archiving and disaster recovery purposes. Access to your information is limited to those who require it to provide services to you. All data is held within the UK.

If any of your personal information is transferred out with the European Union or the European Economic Area by any of our contractors we will ensure that there are adequate safeguards in place to protect your personal information in accordance with the General Data Protection Regulations and the Data Protection Act 2018.

We only keep your personal information for the minimum period amount of time necessary. Sometimes this time period is set out in the law, but in most cases it is based on the business need.

We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. You can request a copy by contacting us at InformationRequests@wheatley-group.com

You can exercise any of the following rights by writing to us at InformationRequests@wheatley-group.com

Your rights in relation to your personal information are:

• you have a right to request access to the personal information that we hold about you by making a "Subject Access Request"
• if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information
• you have a right to request that we restrict the processing of your personal information for specific purposes
• if you wish us to delete your personal information, you may request that we do so.

Any requests received by Wheatley Care, will be considered under applicable UK Data Protection Legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office at www.ico.org.uk

The accuracy of our information is important to us - please help us keep our records updated by informing us of any changes to your email address, telephone numbers and other details.

Our privacy notice is regularly kept up to date and this version was updated on 13 March 2020. The latest full version is always available from our website.