Introduction
At Cunninghame Housing Association, we are committed to protecting and respecting your privacy. This privacy notice explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others, how we keep it safe and secure and your rights and choices in relation to your information.
We have separate privacy notices for employees, job applicants and board/shareholding members. These are available on request and, where published, on our website.
Who are we?
Cunninghame Housing Association is a social landlord and factor having their Registered Office at Quayside Offices, Marina Quay, Dock Road, Ardrossan, KA22 8DA.
Cunninghame Housing Association takes the security and protection of personal data seriously. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.
We are registered with the UK data protection regulator, the ICO, as a data controller. Our registration number is Z6489501.
How do we collect information from you?
We collect information from you:
- when you apply for housing with us, become a tenant, request services/ repairs, enter into a factoring agreement with ourselves howsoever arising, or otherwise provide us with your personal details;
- when you apply to become a member;
- from your arrangements to make payment to us (such as bank details, payment card numbers, employment details, benefit entitlement and any other income and expenditure related information);
- during office appointments or visits to your home;
- when you engage with us for the provision of our Fuel Poverty Advisory Service, known as ‘Lemon Aid’;
- when you use our website, through the use of Cookies and website analytics;
- when you enter information on our website or attend an online virtual meeting in platforms such as Zoom and Teams;
- from your use of any of our other online services, whether to report any tenancy/ factor related issues, works repair request, make a complaint, or otherwise.
If you apply for a job with us, we collect information about you from your job application. If you are successful in joining our team, we will also collect information from you in relation to your employment.
We will also collect contact details from our business partners, suppliers and contractors when we begin our business relationship with you.
Information we receive indirectly
- Your information may be shared with us by third parties, which might include subcontractors acting on our behalf who provide us with technical, payment or repairs services and our business partners;
- we may collect your image and audio from our CCTV cameras which are located on our premises and housing estates;
- when you visit our website we place Cookies on your device to run the website. For more information about Cookies and how we use them please see our Cookies policy;
- when we are contacted by local authorities and law enforcement in relation to ongoing investigations;
- from any public bodies, charities, local authorities who you have consented to sharing your personal data, in order for us to contact you regarding our ‘Lemon Aid’ service;
- during our employment process, we may receive your personal data from an applicant in relation to carrying out an employee reference check;
- when you are noted as the emergency contact or next of kin of an employee, we may contact you when a situation arises;
- when you interact with us on social media platforms such as Facebook, YouTube or X (formerly Twitter), we may obtain information about you (for example, when you like or post on our page). The information we receive will depend on the privacy preferences you have set on those platforms. You should also check the privacy information provided by the relevant platform where you give your data to a third party;
What type of information is collected from you?
Why do we need it and how will it be used?
The personal information we collect, store and use depends on your relationship with us. We may collect the following information about you:
If you are our tenant, shared owner, have a factoring agreement with us, or have requested our ‘Lemon Aid’ service:
- your name, address (including previous addresses), date of birth, national insurance number, email address, phone number(s), bank account details;
- your Shareholding Membership Number, if you have one;
- your date of entry, date of termination and rent charge;
- details of other occupants in the property and their relationship to you (their name, relationship, date of birth);
- any medical information you have given us to support your application for rehousing;
- your emergency contact’s name, address and phone number(s) and relationship to you;
- your employer and details of your employment;
- equality monitoring information about protected characteristics, as defined by the Equality Act 2010 (Age, Disability, Gender reassignment, Marriage and civil partnership, Pregnancy and maternity, Race, Religion or belief, Sex and Sexual orientation), some of which is special category personal data;
- health and medical details;
- how much rent you pay and any arrears you might have;
- details of any claim you might have with the local Council’s Housing Benefit Department and/or Discretionary Housing Payments;
- details, including your National Insurance Number, of any Universal Credit claim you may have with the Department for Work and Pensions;
- details of any repairs requested and any access arrangements you have provided regarding this;
- fuel poverty support information, including details of your energy supplier and landlord;
- your property type and household composition;
- details of any incident(s) which may have occurred which may pose a risk to our staff;
- details of any legal action we have taken relating to when a condition of your tenancy has been breached;
- any complaint made by you.
We may receive the following information from third parties:
- previous landlords; name and address;
- benefits information, including awards of Housing Benefit, Discretionary Housing Benefit and Universal Credit;
- homeless referrals are made by the local Council so we will receive all the personal information that comes with the referral;
- payments made by you to us via bank transfer or a payment card provider, in respect of rent, rechargeable repairs, service charges, factoring fees and membership fees;
- complaints or other communications regarding behaviour or other alleged breaches of the terms of your Scottish Secure Tenancy (SST), Short SST, Occupancy Agreement, Lease, Shared Ownership Agreement with us, including information obtained from Police Scotland, the local Health and Social Care Partnership, the local Council’s Problem Solving Unit and Anti-Social Behaviour Team, and other residents;
- reports as to the conduct or condition of your tenancy, including references from previous tenancies, and complaints of anti-social behaviour and any arrears balances;
- support needs of vulnerable tenants, including medical reports for medical adaptations and Social Work reports for applications;
- new homeowner details;
- employment details.
We receive the information from :
- Local Authorities
- Health professionals
- Charities
- Other registered social landlords
- Legal Advisors
- Contractors and suppliers who have undertaken works on our behalf
- MPs, MSPs and councillors
- Utility companies
- Household members
- Debt collection agencies
- Department of Work and Pensions
- HMRC
We need and will use your information:
- to undertake and perform our obligations and duties to you in accordance with the terms of our contract with you set out in your agreement (SST, Short SST, Occupancy Agreement, Lease, Shared Ownership Agreement, Title Deeds, etc);
- to enable us to supply you with the services and information which you have requested;
- to enable us to respond to your repair request, housing application and complaints made (including assistance with benefit applications and Universal Credit and Housing Benefit applications);
- to refer you to, or signpost you to other organisations that may support you;
- to analyse the information we collect so that we can administer, support, improve and develop our services;
- to contact you and send you details of any changes to our services which might affect you;
- to assess your fuel poverty situation, and assess eligibility for fuel vouchers;
- to contact you for your views on our services;
- for other purposes that are compatible with the purpose for which the information was collected, where permitted by data protection law. If we intend to use your personal data for a new purpose that is not compatible, we will provide you with further privacy information before doing so where required.
If you apply for a job with us:
-
- your contact details, previous employment history and qualifications
- we may collect details of ethnicity and disability – for equalities monitoring and so that we can make any appropriate adjustments to your workplace
- we may collect references from third parties whose details you have provided.
We require this information as part of our recruitment process. If your application is unsuccessful, we will keep your application for six months so that we can contact you if a similar job becomes available. Following this period, we will delete your personal data.
When you visit our website:
- If you allow the relevant Cookies, we may collect information about your activities on our website and about the device used to access it, for instance your IP address, website activity and behaviours, etc. For more information, please see our Cookies policy;
- we utilise analytics and tracking tools in order to resolve website issues or make improvements to the usability and layout of our website. To do this, we analyse your interaction with the website;
- any other personal information shared with us via our website forms. We will use this to help provide the service you have requested, or respond to any queries or complaints you have.
Links to other websites:
Our website may contain links to other websites run by other organisations. This privacy notice applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other websites even if you access those using links from our website.
In addition, if you linked to our website from a third party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the privacy notice of that third party site.
When you visit our premises or housing estates:
- your image may be captured by our CCTV cameras. Notices are available where the cameras are in operation.
CCTV images may be used for security of our staff, tenants and any other visitors to our premises or housing estates, and to assist with the prevention and detection of crime, as evidence in a complaint.
If you do not wish to provide your personal data
Some personal data is necessary for us to enter into or perform a contract with you, provide a service you have requested, or meet a legal or regulatory requirement. Where information is required, we will make this clear. If you do not provide required information, we may be unable to enter into or continue a contract with you, or provide the relevant service. Other information is optional, and we will explain this where relevant.
Who has access to your information?
The information you provide to us will be treated in accordance with data protection law. Depending on your type of contract or other business relationship with us, we may disclose your personal data to any of our employees, officers, contractors, insurers, professional advisors (including legal advisers and our Data Protection Officer), agents, suppliers or subcontractors, selected third parties, government agencies and regulators and healthcare providers for the purposes set out in this notice, or for purposes approved by you, including the following:
- if we enter into a joint venture with, or merge with, another business entity, your information may be disclosed to our new business partners or owners;
- if we instruct adaptations, repair or maintenance works, your information may be disclosed to contractors we use;
- if we are investigating a complaint, information may be disclosed to Police Scotland, the local Council (ASSIST Team and Problem Solving Unit) departments, Scottish Fire & Rescue Service, the Association’s Solicitor, 1st tier tribunal solicitors, independent investigators such as auditors, the Scottish Housing Regulator, SPSO, and other regulatory body and others involved in any complaint, whether investigating the complaint or otherwise;
- when we apply for fuel poverty grants, funding, discounts, or vouchers on your behalf as part of our service offering. These applications are typically assessed on a case-by-case basis, and therefore we must provide full and accurate information about you to ensure an accurate assessment can be made;
- in order to efficiently and effectively assist in resolving issues such as metering, billing, or debt issues, we may share your information with your energy supplier;
- if we are updating tenancy details, your information may be disclosed to third parties (such as utility companies and the local Council);
- if we are investigating payments made or otherwise, your information may be disclosed to payment processors, the local Council and the Department of Work & Pensions, Allpay, Elavon and Santander;
- If utility companies are pursuing outstanding debt, we may share your details with them directly. Alternatively, we may share your details with Citrus Energy – a subsidiary company of Cunninghame Housing Association – in order to finalise changes of tenancy information with the utility companies, and/or debt collection agencies who are acting on behalf of the utility companies;
- if we need to protect our finances when you have vacated a property, we may disclose your personal data (name and forwarding address only) to utility companies, or debt collection agencies;
- if your personal data is required by an emergency service;
- if required by law, we will disclose your information to statutory bodies such as the police;
- if we are conducting a survey of our products and/ or service, your information may be disclosed to third parties assisting in the compilation and analysis of the survey results;
- if you are using an advice or advocacy service, such as a solicitor or advice agency, we will share relevant information with them where it is necessary to progress your case;
- if you work with a support provider, we will share relevant information to help with that support work;
- if your household is threatened with homelessness, relevant information may be shared between us and the relevant local authority, health body or Health and Social Care Partnership where this is lawful and necessary;
- if you request that we share your information with other RSLs who may assist in re-housing you;
- if we are pursuing debt recovery, your information may be disclosed to our solicitors and the local Council, or a third party agency to assist in the recovery of those debts;
- if we are making an insurance claim following an incident we may share your information with our insurers;
- if we need to facilitate the payment of any benefits, your information may be disclosed to the Department of Work and Pensions, Local Authority or any other relevant department;
- if the Local Authority is processing information about your council tax or relating to the electoral register, your information may be disclosed to them;
- if required by a regulatory body, such as the Scottish Housing Regulator, Financial Conduct Authority or the Office of the Scottish Charity Regulator;
- we may pass your information to our third-party service providers, suppliers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example Software providers and IT Technical services, including, IT systems providers, telecoms providers, etc). However, when we use these third parties, we disclose only the personal information that is necessary to deliver the services and we have a contract in place that requires them to keep your information secure and prevents them from using it for their own direct marketing or any other purposes.
We do not sell your personal data. We will only share personal data where this is lawful and necessary for the purposes described in this notice, where you have asked us to do so, or where sharing is otherwise required or permitted by law.
Lawful Processing
Data protection law requires us to have a lawful basis for each use of your personal data. The basis we rely on depends on the purpose and circumstances of the processing. We may rely on one or more of the following lawful bases:
Performance of a contract
Where processing is necessary to enter into a contract with you or to perform a contract with you, such as a tenancy or factoring agreement.
Consent
Where you have given valid consent for a specific purpose, for example where consent is required for electronic direct marketing. You can withdraw your consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent. Where PECR applies, we will also comply with its requirements.
Public task
Where processing is necessary for us to perform a task carried out in the public interest or to exercise official authority vested in us.
We will rely on this basis only where the relevant task or authority has a basis in UK law, including, where applicable, certain statutory housing and homelessness functions.
Legal obligation
Where processing is necessary for us to comply with a legal obligation to which we are subject, including relevant statutory, court, tax and regulatory requirements.
Vital Interests
Where it is necessary to use your data to protect your own, or someone else’s, life.
Legitimate interests
Where processing is necessary for our legitimate interests, or those of a third party, except where those interests are overridden by your interests, rights or freedoms.
We consider our legitimate interests to be:
- protecting our staff, residents and visitors, and assisting with the prevention and detection of crime through CCTV where legitimate interests is the appropriate lawful basis;
- improving our website and services using analytics where legitimate interests is the appropriate lawful basis and any PECR requirements are met;
- holding next of kin details as emergency contacts;
- carrying out surveys and sending service-related or other informational communications where legitimate interests is the appropriate lawful basis;
- managing our void properties in the event of outstanding tenant debts;
- maintaining appropriate business continuity and disaster recovery arrangements;
- managing our relationships with suppliers, contractors and professional business contacts where legitimate interests is the appropriate lawful basis.
When we rely on legitimate interests, we assess the purpose, whether the processing is necessary, and the impact on you. We will not rely on legitimate interests where your interests, rights or freedoms override the interests being pursued.
Processing special category and criminal offence data
Special category personal data includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to uniquely identify a person, data concerning health, and data concerning a person’s sex life or sexual orientation. Criminal conviction and offence data is not special category data and is subject to separate rules.
These types of information require additional protection. We only process them where this is necessary for the relevant purpose and where the additional legal requirements are met.
When we process special category data, we identify an Article 6 lawful basis and an applicable condition under Article 9 of the UK GDPR. Where Article 9 requires a condition in Schedule 1 of the Data Protection Act 2018, we also identify and document that condition.
The purposes described in this notice can include assessing housing or support needs, making reasonable adjustments, safeguarding, handling legal claims, and meeting relevant legal or regulatory requirements.
Some conditions under the Data Protection Act 2018 also require an Appropriate Policy Document setting out how the relevant processing complies with data protection principles and retention requirements.
Criminal offence data includes information about criminal convictions and offences, alleged offences, and related proceedings or security measures.
We only process criminal offence data where Article 10 of the UK GDPR and the Data Protection Act 2018 permit us to do so and the required safeguards are in place.
This can include relevant information used in anti-social behaviour matters, staff safety and risk management, tenancy enforcement, fraud prevention or detection, and legal claims, depending on the circumstances.
We take care to distinguish allegations from established facts, limit access to those who need the information, and retain it only for as long as necessary.
How long is your information kept for?
We will only retain your personal information for as long as necessary for the purposes for which we collected it, including to meet legal, accounting or reporting requirements. We keep information in line with our Data Retention Policy and retention schedule and securely delete, destroy or anonymise it when it is no longer required.
We review our retention periods on a regular basis.
Where do we keep your data?
If we transfer personal data outside the United Kingdom, we will do so only where permitted by data protection law and using an appropriate transfer mechanism and safeguards where required. You can contact us for further information about the safeguards used for any relevant international transfer.
How do we keep your data safe?
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, disclosure or access. These measures include access controls, secure systems and storage, staff confidentiality requirements and encryption where appropriate. We review our security measures in line with risk and our data protection and information security policies.
Keeping your information up to date
We take reasonable steps to ensure your information is accurate and up to date; however please help us keep our records updated by informing us of any changes to your email address and other contact details.
Your Rights
Under UK data protection law, you have rights over your personal information. Which rights apply depends on the lawful basis, the type of processing and the circumstances.
Right of Access
You have the right to ask whether we process your personal data and to receive a copy of your personal data and other information required by law, subject to applicable exemptions. We may ask for information to verify your identity where this is necessary and proportionate. If a request is unclear or we hold a large amount of information about you, we may ask for clarification where this is reasonably required to identify the information or processing activity concerned.
Right to have your inaccurate personal information corrected
You have the right to ask us to correct inaccurate personal data and, taking account of the purposes of the processing, to complete incomplete personal data.
Right to restrict use
You have the right to ask us to restrict processing in certain circumstances, including while we consider a challenge to accuracy or an objection, where processing is unlawful and you prefer restriction to erasure, or where you need the data for a legal claim even though we no longer need it for our own purposes.
Right of erasure
You have the right to ask us to erase your personal data in certain circumstances. This right is not absolute and does not apply where we have a lawful reason to continue to retain or use the data.
Right for your personal information to be portable
Where we process personal data by automated means on the basis of your consent or because it is necessary for a contract with you, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller.
Right to object
You have the right to object to processing based on public task or legitimate interests in certain circumstances. You also have an absolute right to object at any time to the use of your personal data for direct marketing. Where your objection relates to direct marketing, we will stop using your personal data for that purpose.
Right to withdraw consent
Where we rely on your consent, you have the right to withdraw it at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
Right to withdraw consent
Where we rely on your consent, you have the right to withdraw it at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
Automated decision-making
If we make a significant decision about you based solely on automated processing, we will provide the information and safeguards required by law, including an opportunity to make representations and obtain human intervention in the decision.
If you want to exercise any of your data protection rights, please contact us using the details below. We may ask for further information or evidence of identity where this is necessary and proportionate. We will respond without undue delay and normally within one month. Where the law permits an extension, or where the time limit is paused because clarification is reasonably required for a subject access request, we will tell you and explain the revised timeframe.
Exceptions and limitations apply to a number of these rights, and not every right applies in every circumstance. If we cannot comply with a request, we will explain the reason and tell you about your right to complain.
Queries and Complaints
You have the right to make a data protection complaint to Cunninghame Housing Association if you are concerned about how we have handled your personal data. You can contact us by emailing [email protected] or telephoning 01294 606 040. We will acknowledge a data protection complaint within 30 days of receiving it. We will then take appropriate steps to investigate it, keep you informed and provide an outcome without undue delay.
Our Data Protection Officer is provided by RGDP LLP and can be contacted via [email protected] or 0131 222 3239.
You also have the right to complain to the UK data protection regulator, the ICO, at any time. The ICO recommends giving us an opportunity to complete our complaints process first where appropriate. The ICO’s contact details are:
Telephone: 0303 123 1113
Online: ico.org.uk/make-a-complaint/
Changes to this privacy notice
Any changes we may make to this Privacy Notice in the future will be posted on this website so please check this page occasionally to ensure that you’re happy with any changes. If we make any significant changes to the way we process your personal data, we’ll make this clear on this website.
This Privacy Notice was last updated in September 2026.