Privacy Policy

We will comply with data protection laws. The law says that the personal data that we hold must be:

1. Used in a lawful, fair and transparent way
2. Collected only for valid purposes that we have clearly explained and not used in any way that is incompatible with those purposes
3. Relevant to the purposes for which it was collected and limited only to those purposes
4. Accurate and kept up to date
5. Kept only as long as necessary for the purposes for which it was collected
6. Kept securely

Personal information or personal data means any information about a living individual from which that person can be identified. It does not include data where the individual’s identity has been removed, such as anonymous data.

Much of the data Cobalt holds relates to our properties and their maintenance and repair. We do not consider property information when identified by an address alone to be personal data. As soon as your name, contact details or other identifying information is used with property information, such as during a visit to repair your house, then the property information becomes personal data and where this is the case we will only use it in accordance with this policy.

The data that we collect about you will depend on your relationship with us.

For tenants and leaseholders we collect:

Your basic contact details, including your name, address, telephone number, email address.

Your financial and identity information, including your banking and card details, housing eligibility information, photographic ID and national insurance number.

Service management information, including compliments, complaints and other feedback and records of property visits. This includes recording calls made to our customer contact centre.

Health and welfare information, including details of your physical or mental health and any disabilities or vulnerabilities you may have. This is a special category of personal data and is subject to additional safeguards.

Equality information, including your racial or ethnic origin, your sexual orientation and your religious or philosophical beliefs. This is a special category of personal data and is subject to additional safeguards.

Management and order information, including details of any alleged or actual anti-social behaviour or criminal offences and CCTV images from our offices and developments. This includes a special category of personal data, and the sensitive aspects of this category are subject to additional safeguards.

For housing applicants we collect:

Your basic contact details, including your name, address, telephone number, email address.

Your financial and identity information, including your banking and card details, housing eligibility information, photographic ID and national insurance number.

Health and welfare information, including details of your physical or mental health and any disabilities or vulnerabilities you may have. This is a special category of sensitive personal data and is subject to additional safeguards.

Equality information, including your racial or ethnic origin, your sexual orientation and your religious or philosophical beliefs. This is a special category of sensitive personal data and is subject to additional safeguards.

Service management and monitoring information, including CCTV images from our offices and developments, if you have visited and recordings of calls made to our customer contact centre, if you have called.

For residents who are not tenants, leaseholders or housing applicants we collect:

Your basic contact details, including your name, address, telephone number, email address.

Service management information, including compliments, complaints and other feedback and records of property visits. This includes recording calls made to our customer contact centre.

Health and welfare information, including details of your physical or mental health and any disabilities or vulnerabilities you may have. This is a special category of sensitive personal data and is subject to additional safeguards.

Equality information, including your racial or ethnic origin, your sexual orientation and your religious or philosophical beliefs. This is a special category of personal data and is subject to additional safeguards.

Management and order information, including details of any alleged or actual anti-social behaviour or criminal offences and CCTV images from our offices and developments. This includes special category personal data and the sensitive aspects of this category are subject to additional safeguards.

For subscribers we collect:

Your basic contact details, including your name, address, telephone number, email address.

Your online identification information, including details of whether you have visited our site before, which pages you visit on our site and how you navigated to our site.

Your social media information, including your username, personal data you have shared on your profile and engagement information (your likes, shares and retweets).

Service management and monitoring information, including CCTV images from our offices and developments, if you have visited and recordings of calls made to our customer contract centre, if you have called.

We collect your personal data directly from you via our forms, surveys, telephone calls (including recording of calls made to our customer contact centre), videos (provided in the course of property maintenance), including images captured via customer-operated repair diagnostic, written communications including email and via cookies on our website. Our Policy relating to the use of cookies can be found on this website.

Cobalt also collects personal data about you from third parties, including credit reference agencies, courts and tribunals, and previous landlords. Cobalt may also collect personal data where you are resident in a property but are not leaseholders or housing applicants, via Cobalt’s tenants or leaseholders.

We operate a continuous CCTV system at all our office premises for the detection and prevention of crime.

When we collect your information, we will:

• tell you why we need it and how it will be used;
• collect only as much as we need for the relevant purpose;
• take steps to ensure that we record your personal data accurately and keep it up to date;
• make sure that we do not keep it longer than necessary; and
• keep it secure and confidential

In return, we ask that you:

• provide accurate information; and
• tell us as soon as possible about any change in your circumstances

If any of your personal information or circumstances do change, then please let us know using the contact details at the beginning of this policy.

How we use your personal data

We will only use your personal data when the law allows us to. The law says that we must identify a lawful basis for each use of your personal data. We rely on a number of lawful bases, including:

1. Where we have obtained freely given, specific, informed and unambiguous consent from you to use your personal data in certain ways
2. Where we need to perform a contract that we have entered into
3. Where we need to comply with a legal obligation
4. Where we need to protect your vital interests
5. Where it is necessary in the public interest for us to use the personal information
6. Where it is necessary for us to use personal data to pursue our legitimate interests (or those of a third party) and we believe that using personal data in that way is not overridden by the interests or fundamental rights of the person to whom the information relates.

Below, we have set out the purposes for which we use personal data and the lawful bases which are relevant to those purposes.

Special categories of personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data.

Below we have identified where the collection of special category personal data is relevant and listed the further justification on which we are relying to process your special category personal data.

We have also put in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

Managing your tenancy or leasehold

For tenants and leaseholders only, we use your personal data to manage your tenancy or leasehold agreement or other contract between you and Cobalt Housing.

The processing activities we conduct can be summarised as:

• Managing your account charges and payments, including arrears. Our lawful basis for this is that it is necessary for the performance of our contract with you.
• Managing the repairs, maintenance and adaptations of our properties.  Our lawful basis for this is that it is necessary for the performance of our contract with you. We may use special category personal data such as information about your physical or mental health for this purpose and our further justification for that is that we either have your explicit consent or where it is necessary for the provision of health or social care.
• Ensuring tenancy (or contract) conditions are complied with, such as dealing with anti- social behaviour or fraud. Our lawful basis for this is that it is necessary for the performance of our contract with you. We may use special category personal data such as information about actual or alleged criminal offences for this purpose and our justification for that is that it is necessary for the establishment, exercise or defence of legal claims.

Managing our properties

For residents that are not tenants or leaseholders only, we use your personal data to properly manage our properties.

The processing activities we conduct can be summarised as:

• Managing the repairs, maintenance and adaptations of our Our lawful basis for this is that it is necessary to pursue the legitimate interests of Cobalt and our residents in ensuring that our properties are maintained, accessible and fit for purpose. We may use special category personal data such as information about your physical or mental health for this purpose and our further justification for that is that it is necessary for the provision of health or social care.
• Ensuring tenancy (or contract) conditions are complied with, such as dealing with anti- social behaviour or fraud. Our lawful basis for this is that it is necessary to pursue the legitimate interests of Cobalt and our residents in maintaining a welcoming environment in and around our properties. We may use special category personal data such as information about actual or alleged criminal offences for this purpose and our justification for that is that it is necessary for the establishment, exercise or defence of legal claims.
• Cobalt does not normally process children’s information as part of a tenancy, as all tenants are adults. However, we record children’s basic information if they live in one of our properties, including their name and date of birth. This is required for checking the property is not overcrowded and to assess other tenancy management issues where all householders and ages are required to be known.  Our lawful basis for this is that we either have your explicit consent or where it is necessary for the provision of health or social care.

Processing your housing application

For housing applicants only, we use your personal data to process your application and to administer our waiting lists. Our lawful basis for this is that it is necessary for the purposes of entering into a contract with you at your request.

Ensuring equality of treatment or opportunity

For tenants, leaseholders, housing applicants and other residents only, we use special category personal data relating to your health including any disability or vulnerability, ethnicity, religion, race, philosophical beliefs and sexual orientation for equal opportunities monitoring. Our lawful basis for this is our legitimate interest in ensuring that we treat everyone equally. Our further justification is that it is in the public interest to ensure meaningful equal opportunities monitoring and reporting.

Complying with our legal obligations

For tenants, leaseholders, housing applicants and other residents only, we use your personal data to comply with our legal obligations under housing legislation. This includes conducting checks and reporting to regulators in line with relevant legislation. Our lawful basis for this is that it is necessary to comply with our legal obligations.

Complaints and disputes

We use your personal data (including recordings of calls made to our customer call centre) to manage and resolve any complaints or disputes that may arise over the course of our relationship with you. Our lawful basis for this is that it is necessary to pursue the legitimate interests of Cobalt in ensuring that any complaints or disputes are resolved effectively. We may use special category personal data such as information about actual or alleged criminal offences and information about your physical or mental health for this purpose and our further justification for that is that it is necessary for the establishment, exercise or defence of legal claims.

Reviewing and improving our services

We also use your personal data (including recordings of calls made to our customer call centre) to continuously review and improve our processes, procedures and training. Our lawful basis for this is that it is necessary to pursue the legitimate interests of Cobalt in ensuring that it has effective and efficient processes, procedures and training in place.

Running our website

We use your personal data to track the performance of our website and measure engagement with it. Our lawful basis for this is that it is necessary to pursue our legitimate interest in operating a functioning and useful website. For more information, please see our Cookie Policy.

Providing additional services

We offer additional, optional services including:

• Organising and assisting community events;
• Offering opportunities to be involved; and
• Providing welfare, benefits and debt advice

We use your personal data in the course of delivering these services. Our lawful basis for this is your consent.

We also offer an optional service to make adaptations to your house to ensure its accessibility and suitability for your particular needs. We use special category personal data, including your physical and mental health, including any disabilities or vulnerabilities, when making these adaptations. Our lawful basis and further justification for this is your explicit consent to us using your data for this purpose.

We will ask for your consent when you indicate that you would like to take advantage of these optional services or property adaptations. You do not have to give your consent and may withdraw it at any time. If you do not consent, or you withdraw your consent, we may not be able to make the relevant adaptations or offer these additional services.

We use your personal data when we communicate with you. This includes when we send you newsletters and bulletins, when you engage with us on social media and when you give us feedback about our service. Our lawful basis for this is our legitimate interest in building a meaningful and informed relationship with our tenants, leaseholders, applicants, residents and subscribers. Where you are giving feedback on our services, our lawful basis is our legitimate interest in improving our services.

Where we need to communicate with tenants and leaseholders regarding your contract with us this will usually be in writing or by telephone but is more commonly becoming electronic and paperless. Many of our services will be moving to digital platforms (online) over time to allow convenient access such as a self-service portal.

Our tenants receive our newsletter with information about what is going on within the organisation. We are required by our Regulator to keep our tenants informed and to offer opportunities for involvement, but you may opt-out of receiving this newsletter by emailing [email protected].

We will only discuss or communicate your tenancy or lease details with those named on the agreement or those authorised (temporarily or permanently) by you. You can authorise someone temporarily verbally over the phone or permanently in writing. Cobalt will wish to establish that the individual has consented to their details being shared so you will need to obtain their consent (signature) to share their details if the contact is to be in writing or ask them to speak directly to Cobalt if it is for verbal consent.

From time to time, Cobalt may use your personal data to send direct marketing communications. Cobalt strives to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. Cobalt’s lawful basis for this is that it is necessary to pursue the legitimate interests of Cobalt and Cobalt’s residents in communicating with you or where you have consented to receive marketing emails.

If you have given your consent to receive marketing emails you can withdraw this at any time, or if Cobalt is relying on Cobalt’s legitimate interests to send you marketing you can object to withdraw consent or object to direct marketing please email [email protected].

Cobalt uses text messages and may contact you via telephone to contact and share information with you about the services Cobalt can deliver to you. If you provide your telephone number, Cobalt may keep in contact with you by text.

Examples of operational text messages include:

• Confirming a repair and/or a time and date for a repairs contractor to visit
• Confirming a home visit
• Sending a reminder about an appointment
• Asking you to contact a named person
• Satisfaction surveys

If you fail to provide personal information

If you fail to provide certain personal data when we request it, we may not be able to perform our contract with you properly (such as entering into a lease or tenancy agreement) or we may be prevented from achieving our legitimate interests (such as running our website).

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose and that purpose is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.

Automated decision-making

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We may use automated decision-making where permitted by law and where appropriate safeguards are in place.

We will not make automated decisions based solely on special category personal data where there is a legal or other significant effect unless strict legal conditions are met and additional practices are in place, including where we have a lawful basis for doing so and we have put safeguards in place to allow you to make representations, challenge the decision and obtain human intervention.

Cobalt sometimes shares your personal data with trusted third parties.

The reasons we may share your data with third parties are:

• to provide you with Cobalt’s services
• if Cobalt is under a legal or regulatory duty to do so
• if it is necessary to do so to enforce Cobalt’s terms of use or other contractual rights
• to lawfully assist the police with the prevention and detection of crime
• where such disclosure is necessary to protect the safety or security of any persons, and/or
• otherwise as permitted under applicable law.

Cobalt requires anyone that Cobalt shares your personal data with to respect the security of your data and to treat it in accordance with the law.

Cobalt share details with certain third parties that provide services on behalf of Cobalt. All these third parties are required to take appropriate security measures to protect your personal data in line with Cobalt policies. Cobalt do not allow third parties to use your personal data for their own purposes. Cobalt only permits them to access your personal data for specific purposes and in accordance with Cobalt’s instructions.

Listed below are examples of the categories of third parties we may share some of your personal data with:

• Advocacy partner organisations.
• Banks and Financial Service providers to process secure payments.
• Charities and Voluntary Organisations.
• Choice Based Letting Partners.
• Contractors and suppliers who provide services to you, or who provide services on Cobalt behalf.
• Debt Collection Agencies.
• External Auditors.
• Insurance companies.
• Mediation partner organisations.
• Organisations that support Cobalt and the services Cobalt provide, such as Local Authorities, other housing providers, statutory agencies, and support organisations.
• Probation Services.
• Professional Advisors and Consultants.
• Solicitors.
• Social welfare organisations.
• Survey and Research organisations.
• Training providers or learning institutions.
• Utility companies.
• Tenant benefit and rewards platforms which provide offers bespoke to tenants. Tenants opt-in directly, and Cobalt shares only limited information.

In some cases we may also have a duty to disclose your information by law to:

• Central Government Departments.
• Courts and Tribunals.
• Statutory agencies.
• Local Authorities.
• Organisations who support crime prevention or detection, the prevention and detection of fraud, and for the purposes of the National Fraud Initiative.
• Other Registered Providers of Social Housing.
• Regulators.

Regardless of the circumstances, if we find ourselves in a situation where we need to share your data with another organisation and we can’t rely on the terms of your tenancy agreement or a legitimate interest and you haven’t already given your consent for us to do this, then we will ask for it before releasing any personal data about you.

Under no circumstances will Cobalt ever sell or pass on your personal data or other information to businesses or organisations so they can get in touch with you directly, either by phone, email or in writing in order to sell you their products or services.

Cobalt do not usually transfer your personal data outside the UK. If, exceptionally, Cobalt do, you can expect a similar degree of protection in respect of your personal information.

When Cobalt transfers your personal data outside of the UK, Cobalt will take organisational, contractual and legal measures to ensure that your personal data will always be subject to adequate safeguards. Cobalt’s safeguards ensure that your personal data receives the same protection as if it were being processed inside the UK.

These safeguards may take the form of an adequacy decision. Adequacy decisions are made by the UK Government in respect of certain countries. An adequacy decision means that the countries to which Cobalt transfer your data are deemed to provide an adequate level of protection for your personal data.

In the absence of an adequacy decision and to ensure that your personal data does receive an adequate level of protection, Cobalt will put in place an international data transfer agreement, or the UK Addendum to the EU Standard Contractual Clauses or use Binding Corporate Rules as a transfer mechanism to ensure that your personal data is treated in a way that is consistent with and respects the UK laws on data protection.

Any transfer of your personal data will follow applicable laws, and Cobalt will follow the guiding principles of this Privacy Notice.

For more information about how your personal data may be shared, please contact our DPC using the details at the top of this policy.

Data security

We store personal information both electronically and in paper form.

We implement security policies, processes and technical security solutions to protect the personal information we hold from:

• Unauthorised access
• Improper use or disclosure
• Unauthorised modification
• Unlawful destruction or accidental loss

When you contact us, we may ask you to provide us with some information so that we can confirm your identity. If other people (e.g. family members, support workers, solicitors) act on your behalf we will take steps to ensure that you have agreed for them to do so. This may include asking them to provide us with supporting information to indicate your consent. We do this to protect you and to make sure that other people cannot find things out about you that they are not entitled to know.

Employees and third parties who have access to, or are associated with the processing of, your personal data are obliged to make reasonable efforts to safeguard it.

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

Information relating to a tenancy or lease agreement will be kept for a period not exceeding Cobalt Housing’s retention period, as defined by National Housing Federation retention of documents schedule. The basic history of who held a tenancy at which property and when will be held indefinitely.

In addition, we may retain personal data about former tenants to comply with national laws, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigation, and take other actions.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes during your working relationship with us. If your personal data changes, please let us know using the contact details at the top of this policy.

Your rights

In certain circumstances, you have the following rights over your personal data:

Right of access: You have the right to obtain confirmation from Cobalt as to whether or not personal data concerning you is being processed, and, where that is the case, access to that personal data (see ‘Requesting a copy of your personal information’ below).

Right to rectification: You have the right to request Cobalt to rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.

Right to erasure (right to be forgotten): You have the right to request Cobalt to erase personal data concerning you.

Right to restriction of processing: You have the right to request Cobalt to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.

Right to data portability: You have the right to request Cobalt to provide you with the personal data about you which you have provided to Cobalt in a structured, commonly used and machine- readable format. You also have the right to request Cobalt to transmit the data to another controller.

Right to withdraw consent: If the lawful basis for processing is consent, you have the right to withdraw that consent which you can exercise by writing to the DPC using the contact details outlined in item 1.8 of this Policy.

Right to object to direct marketing: Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing.

Rights in relation to automated decision making and profiling: You have the right to not be subject to solely automatic decisions (i.e. decisions that are made about you by computer without any human input). Cobalt do not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.

You can find more information about your rights, and Data Protection in general, on the website of the Information Commissioner’s Office here: https://ico.org.uk

If you would like to exercise any of your rights as detailed above, including to request a copy of the data Cobalt hold about you, please contact the DPC by emailing [email protected] or write to the Data Protection Co-Ordinator, Cobalt Housing Limited, 199 Lower House Lane, Liverpool, L11 2SF.

You will not have to pay a fee to exercise any of the rights listed above. However, Cobalt may charge a reasonable fee if your request is clearly unfounded or excessive, including where requests are repetitive. Alternatively, Cobalt could refuse to comply with your request in these circumstances.

Cobalt may need to request specific information from you to help Cobalt confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. Cobalt may also contact you to ask you for further information in relation to your request to speed up Cobalt’s response. Save for where the request is manifestly unfounded or excessive, Cobalt will respond within one calendar month of receiving your request. It will always help if you can be as specific about what personal data you want to see, what it relates to and within what timeframe, as that will assist Cobalt’s search.

If you have any questions or comments, please contact Cobalt’s Customer Services team on 0330 303 2222 or e­mail [email protected].

If you wish to complain about how your personal data has been handled, this Policy, or any of the procedures set out in it, Cobalt kindly asks that you contact it in the first instance. Cobalt operates a formal data protection complaints process and will acknowledge receipt of your complaint within 30 days. Cobalt will take appropriate steps to investigate and respond without undue delay. We will keep you informed of progress and notify you of the outcome as soon as reasonably possible.

For further information on data protection, please visit the Information Commissioner’s Office (ICO) website  https://ico.org.uk.

The Information Commissioners Office regulates data protection. If you are unhappy with Cobalt’s response to any requests you have made to Cobalt or have concerns regarding the use of your personal information, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113 or visiting the website on the link outlined above..