Privacy notice - Insurance customers
This is the privacy notice of Glasgow Housing Association (GHA) and Wheatley Solutions Limited ("Wheatley Solutions"), together ("we"), part of Wheatley Group. We are companies incorporated in Scotland and share a registered office at Wheatley House, 25 Cochrane Street, Glasgow, G1 1HL.
GHA and Wheatley Solutions deliver excellent services, day-in, day-out, to customers across central Scotland. We are proud to be part of Wheatley Group - Scotland's leading housing, care and property-management group.
GHA and Wheatley Solutions are committed to maintaining the accuracy, confidentiality and security of your personal information. This privacy notice describes the personal information that GHA and Wheatley Solutions collect from or about you as an insurance customer, and how we use and to who we disclose that information.
Our Data Protection Officer is Ranald Brown who can be contacted on firstname.lastname@example.org
What information we collect
Where factoring services includes the provision of insurance, GHA passes data to Wheatley Solutions, who acts as a data controller in relation to the administration and arrangement of that insurance. This also applies to tenants of Wheatley Group's Registered Social Landlords (RSLs). We need to hold personal information about you, as an insurance customer, in order to fulfil our obligations as your factor.
We may collect, use and store the following information through a variety of sources: (i) directly from you; or (ii) via RSLs. including:
- your full name;
- your date of birth;
- your contact details (phone, email or correspondence address);
- other personal information that will vary on a case by case basis to assist us in fulfilling your insurance services;
- your bank details - if you pay by direct debit;
- correspondence with or about you, for example letters or emails from you;
- details of anyone authorised to act on your behalf, if applicable;
- your payment history, and
- historic complaint information.
The information we may collect from you includes:
- your date of birth to allow you to register for our web self-service and make a buildings insurance claim if required;
- proof of identify, for example if a representation mandate is being set up.
We collect your personal information from you via a variety of sources, including when you complete one of our forms, when you call, write, email or meet with us or respond to a survey. We may collect information when you use our social media sites and our web self-service portal, ‘My GHA’.
Our landline phone calls to our Customer Service Centre and Group Debt Recovery Team are recorded for training and monitoring purposes and our recordings are usually held for a period of six months.
Where we are providing insurance services, information will be shared between GHA and Wheatley Solutions for the purposes of providing those services. We may transfer information about you to other Wheatley Group companies for purposes connected with the management of GHA and Wheatley Solutions' business.
We do not usually process children’s information as part of your insurance services, as all insurance customers are adults.
Why we need your personal information - Contractual purposes and legal obligation
We collect and use the above personal data in order to:
- check insurance applications and forward on to the insurer;
- manage the insurance contract;
- investigate and respond to complaints;
- receive insurance charges payments through rent accounts;
- process requests from third parties;
- collect personal information for example telephone numbers, email address, date of birth, correspondence address if different from factored property, and
- to provide information requested by customers or their representatives as part of a property sale or purchase.
We are under a legal obligation to process certain personal information relating to our insurance customers for the purposes of complying with our legal obligations under:
- Property Factors (Scotland) Act 2011; and
- Regulations and FCA guidance that apply to Wheatley Solutions as an insurance intermediary.
If you do not provide the information we need then we will not be able to provide insurance services to you.
Why we need your personal information – legitimate purposes
We also process your personal information in pursuit of our legitimate interests to:
- undertake research and statistical analysis to help improve our business processes and the services offered to our customers, as well as to evaluate our performance against other benchmarks. Where possible, statistical information is anonymised or pseudonymised;
- carry out customer segmentation research to allow us to help us better understand our customers’ characteristics and prioritise, tailor and target services to you; and
- we may also conduct surveys regularly and periodically relating to our services in order to gauge satisfaction and make improvements based on feedback.
We request that you provide your date of birth to allow us to offer you access to our web self-service portal and also to make a buildings insurance claim. You may choose not to provide this information to us but this may impact on your ability to access these services.
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If you wish to object to any of the above processing, please contact us on InformationRequests@wheatley-group.com. If we agree and comply with your objection, this may affect our ability to undertake the tasks above for your benefit.
Other uses of your personal information
We may ask you if we can process your personal information for additional purposes. For example, we may share your information with a language translation service if it is necessary to translate any information into or from a foreign language for you.
Where we do so, we will provide you with an additional privacy notice with information on how we will use your information for these additional purposes.
Who we share your personal information with
We share limited personal data with our contractors who are carrying out services on our behalf including:
- to provide a language translation service if it is necessary to translate any information into or from a foreign language for you;
- with our professional and legal advisors for the purposes of taking advice;
- with our building insurance provider, Ageas, who will also act as a controller of your personal data, if this service is required as part of our insurance duties;
- with our home contents provider, Aviva, who will also act as a controller of your personal data if this service is required as part of our insurance duties;
- to carry out research, survey and segmentation on our behalf to help us to improve the services we offer to you, and
- with companies who provide our Direct Debit service.
Our contractors are required to comply with the law and our own Data Processing Agreement or Data Processing Clauses within our contracts to ensure data is managed appropriately and for specified purposes.
We may need to share personal information with local authorities, government departments and agencies, with our regulator and auditors, with utility companies or with other organisations and agencies where we are legally required to do so.
We will only share information on the basis of your consent or in accordance with another lawful basis under UK data protection legislation.
In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.
How we will communicate with you
As our insurance customer we need to communicate with you. This will usually be in writing or by telephone, but is more commonly becoming electronic and paperless. We are moving many of our services online as this is usually more convenient for you and more efficient for us.
If you use ‘Web self-service’ it is important that you keep your password secure and do not share your details with any other person. The privacy of your information, as with any online service, depends on you keeping your account username and password details to yourself, as well as setting a suitably complex password that cannot be guessed or calculated. In the case of a joint insurance account both parties can have their own account.
We will only discuss or communicate your insurance details with those named on the insurance account or those authorised (temporarily or permanently) by you.
How long we keep your personal information
We will only keep your personal information for as long as necessary to fulfil our insurance duties to you and to safeguard the Wheatley Group in the event of any claims, complaints, litigation, enquiries or investigations during or following the termination of that insurance relationship. Unless you ask us not to, we will review and possibly delete your personal information seven years after our insurance relationship with you terminates.
We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods for all information we hold about your insurance account. You can request a copy by contacting us at InformationRequests@wheatley-group.com
We review our data retention periods regularly and will only hold your personal information for as long as is necessary for the relevant activity or as required by law (we may be legally required to hold some types of information).
You can exercise any of the following rights by writing to us at InformationRequests@wheatley-group.com
Your rights in relation to your personal information are:
- access to your information - you have a right to request access to the personal information that we hold about you by making a Subject Access Request;
- correcting your information - if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
- restricting how we use your information - you have a right to request that we restrict the processing of your personal information for specific purposes;
- deletion of your information – if you wish us to delete your personal information, you may request that we do so where:
- you consider that we no longer require the information for the purposes for which it was obtained;
- we are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below;
- you have validly objected to our use of your personal information – see Objecting to how we may use your information below;
- our use of your personal information is contrary to law or our other legal obligations.
- objecting to how we may use your information – you have the right at any time to require us to stop using your personal information for direct marketing purposes;
- withdrawing consent using your information - where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Any requests received by Lowther and/or Wheatley Solutions will be considered under applicable UK Data Protection Legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office
The accuracy of our information is important to us - please help us keep our records updated by informing us of any changes to your personal details.
Changes to our privacy notice
Our privacy notice is regularly kept up to date and this version was updated on 11 November 2020. The latest full version is always available from our website at www.gha.org.uk
If you wish to get in touch, or raise a complaint, you can contact our DPO at email@example.com.
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office: