Privacy Policy
Last reviewed: June 2026 · Applies to all service users, tenants, staff and visitors
About this policy
We at Taff Housing Association are registered as a ‘data controller’ and ‘data processor’ under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). We collect, hold and process a considerable amount of information, including some personal information about you that allows us to manage housing tenancies and provide services effectively.
Your information is important to us and we take our responsibilities seriously, ensuring that any personal information we collect about you is done so proportionately, correctly and safely. This privacy notice tells you what to expect when Taff collects personal information. It applies to information we collect about:
- Tenants and management of their tenancies
- Service Users accessing Support Services
- Maintenance support
- Publications and communication
- Visitors to our websites
- Surveys conducted by Taff
- Community Support delivery
- Complainants
- CCTV usage
- Job applicants and our current and former employees, volunteers and Board Members
Lawful basis for the collection and use of your data
Our lawful basis for collecting or using personal information to provide services and goods, including delivery and third-party referrals, are:
- Consent – we have permission from you after we give you all the relevant information. All your data protection rights may apply, except where collection and processing are required to fulfil our contractual obligations.
- Contract – we must collect or use the information so we can enter into or carry out a contract with you. All your data protection rights may apply except where collection and processing are required to fulfil our contractual obligations.
- Legal obligation – we must collect or use your information so we can comply with the law. All your data protection rights may apply except where collection and processing are required to fulfil our contractual obligations.
Our Legitimate Interests
- Taff is a Social Housing Provider and collects data on our service users to fulfil our duties as a responsible landlord and comply with legislation in relation to Social and Supporting Housing services in Wales.
- Vital interests – collecting or using information needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life-sustaining food, water, clothing, or shelter.
- Public task – we must collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours.
How will Taff process information they collect about me?
We will use your personal data for a limited number of purposes within the rules set out in the Data Protection Act 2018 and UK GDPR. We will process personal data:
- For the purpose for which you provided the information i.e. the management of your tenancy and/or delivery of support services provided, and to monitor our performance in responding to your request
- To allow us to be able to communicate and provide services appropriate to your needs
- To contact you to update you with any additional information or reminders, or for you to participate in surveys that will help improve our services. We may contact you by post, email, telephone, text message and social media messaging platforms including WhatsApp
- To ensure that we meet our legal requirements, including obligations imposed under the Equality Act 2010 and Health and Safety Acts
- For law enforcement where we are legally obliged to undertake such processing
- To process financial transactions including grants, payments and benefits involving us or third parties or where we are acting on behalf of other government bodies, for example, the Department for Work and Pensions
- Where you have consented to the processing
- Where necessary to protect individuals from harm or injury
- Where otherwise permitted under the Data Protection Act 2018
We may also use your personal data, after it has been anonymised, to allow the statistical analysis of data to allow us to effectively plan the provision of future services.
At no time will your information be passed to organisations external to the Association for marketing or sales purposes.
What personal data do we hold?
We only hold information that concerns our relationship with you. Examples of data include:
- Identity and contact details
- Financial and transaction data
- Benefit status and history
- Communication preferences and interactions
- Behavioural data
- Special categories of personal data (race, ethnicity, religion, health, sexual orientation, etc.)
- Criminal convictions and offences (where appropriate)
We process this information so we can deliver the best services to you. Generally, the information we hold will have been provided by you, but we may also hold information provided by third parties (e.g., social workers, health professionals, government agencies).
Collection of protected characteristic data
As part of our commitment to equality, diversity and inclusion, Taff Housing Association collects information about your protected characteristics (for example: ethnicity, disability, gender, religion, sexual orientation, and age) as defined by the Equality Act 2010.
Why do we collect this information?
We collect this data to help us monitor and improve our services and ensure we can adapt the way we provide services to meet your needs, ensuring nobody is disadvantaged, and to fulfil our legal and regulatory obligations. Providing this information is voluntary and you are not required to disclose it, except where required to make appropriate decisions about the allocation of housing or service adaptation (for example: age, disability).
How do we use and protect this information?
Protected characteristics information is required for mandatory statistical and monitoring purposes and is handled in strict confidence. We store your information securely and restrict access to authorised staff. All processing is carried out in accordance with the UK GDPR and the Equality Act 2010.
Who do we share this information with?
We may share anonymised, aggregated data with regulators or funding bodies to demonstrate compliance with equality legislation. We do not share your individual protected characteristics with third parties unless required by law, or to carry out our contractual obligations.
Using your personal data
In deciding what personal data to collect, hold and use we have committed to ensuring that we will:
- Recognise we have responsibility for any personal data handled by us
- Adopt and maintain high standards in respect of the handling and use of that personal data
- Only collect, hold and use personal data where it is necessary and proportionate to do so
- Securely delete any personal data when no longer needed
- Keep your personal data safe and secure
- Consider and address privacy first when planning to use or hold personal information in new ways, such as when introducing new systems
- Be open with you about how we use your information and who we give it to
- Make it easy for you to access and correct your personal information
- Ensure that there are effective safeguards and systems in place to make sure your personal information is kept securely and does not fall into the wrong hands
- Provide training to staff who handle personal information
- Put appropriate financial and human resources into looking after your personal information
We may disclose personal data to third parties, this may include local authorities, support services and our contractors, but only where it is necessary to deliver the service or manage the tenancy, to comply with a legal obligation, or where permitted under the Data Protection Act 2018 and UK GDPR.
We will strive to ensure that any personal data in our care will be kept safe and where your information is disclosed to a third party we will seek to ensure that the third party has sufficient systems and procedures in place to prevent the loss of personal data.
Where we seek to disclose sensitive personal data, such as medical details, to third parties, we will do so only with your prior express consent or where we are legally required to do so. We will ensure that no personal data is disclosed without a valid lawful basis under the Data Protection Act 2018, and only the minimum data is shared with validated partners.
Sharing your personal data
We may share your data with:
- Care providers
- Organisations we need to share information with for safeguarding reasons
- Emergency services
- Legal bodies or authorities
- Local authorities or councils
- Relevant regulatory authorities
- Organisations we are legally obliged to share personal information with
- Contractors and suppliers (e.g. your contact details)
- Credit reference and debt collection agencies
Security measures
Taff maintains electronic and physical security measures to protect your data. Only authorised personnel have access, and all staff are bound by confidentiality and data protection policies.
Visitors to our website
Taff does not capture or store any personal information about individuals who browse this website, except where you voluntarily choose to give us your personal details via email or an online form to enquire or apply for any of our services. We will only do this when we require that information for specific purposes, for example, to answer an enquiry you have submitted or send information that you have requested.
What about cookies?
People who make a complaint to us
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.
We usually have to disclose the complainant’s identity to whoever the complaint is about. If a complainant does not want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues, and to check on the level of service we provide.
Detection and prevention of crime, fraud and data matching
We are required by law to protect the funds we administer. We process and share the information provided to us to prevent and/or detect potential fraud and crime, by both conducting our own data matching as well as sharing this information with other public bodies, such as the Department for Work and Pensions, Local Authorities, HM Revenue and Customs, the Police, as well as utility companies, credit reference agencies, service providers, contractors and/or partner bodies, where the disclosure of such information is either:
- Necessary for the purposes of the prevention and/or detection of crime; and/or
- Is otherwise necessary to comply with any other legal obligation; or
- Assisting in emergency response management
Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information.
CCTV
We have installed CCTV systems in some of our locations used by staff, residents and members of the public, for the purposes of public and staff safety, crime prevention and detection and business related functions. In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information about the scheme.
We will only disclose CCTV images to others who intend to use the images for the above-described purposes. CCTV images will not be released to the media for entertainment purposes or placed on the internet. Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. You have the right to see CCTV images of yourself and be provided with a copy of the images.
Job applicants, current and former Taff employees, volunteers and board members
Taff is the Data Controller for the information you provide during the process unless otherwise stated. If you have any queries about the process or how we handle your information please contact us at hr.mailbox@taffhousing.co.uk.
What will we do with the information you provide to us?
All of the information you provide during the process will only be used for the purpose of progressing your application or to fulfil legal or regulatory requirements if necessary. We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area.
What information do we ask for, and why?
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t.
Application Stage
We ask for your personal details including name and contact details, previous experience, education, referees and answers to questions relevant to the role. You will also be asked to provide equal opportunities information, which is not mandatory and will only be used to produce and monitor equal opportunities statistics.
Shortlisting
Our hiring managers shortlist applications for interview. They will not be provided with your name, contact details or equal opportunities information.
Assessments
We might ask you to participate in assessment days, complete tests or occupational personality profile questionnaires, and/or attend an interview. Information generated is held by Taff.
Conditional Offer
If we make a conditional offer of employment we will ask you for information to carry out pre-employment checks. You will be required to provide:
- Proof of identity – original documents at our office, we will take copies
- Proof of qualifications – original documents at our office, we will take copies
- A criminal records declaration and verification application
- References from referees named in your application
- A health questionnaire to establish your fitness to work
If we make a final offer, we will also ask for bank details (to process salary payments) and emergency contact details.
Post Start Date
Our Code of Conduct requires all staff to declare any potential conflicts of interest or active involvement in a political party. This declaration is completed annually and exemptions are reported on an anonymised basis to Welsh Government as a regulatory requirement.
Use of Data Processors
Data processors are third parties who provide elements of our recruitment service for us. We have contracts in place with our data processors. They cannot do anything with your personal information unless we have instructed them to do so, and will hold it securely for the period we instruct.
Criminal Conviction Data
We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits. We use Atlantic Data for criminal record verification.
Third-Party Processors – Recruitment
Atlantic Data – Used for criminal record verification checks.
Cezanne HR – Our online application and HR information system. If you accept a final offer, some of your personnel records will be held on Cezanne HR.
SHPS – Social Housing Pension Scheme – Administrators of Taff’s Pension Scheme. You will be auto-enrolled and details provided will include your name, date of birth, National Insurance number and salary.
Simply Health – Provides our Employee Assistance Service, including face-to-face and telephone counselling support.
Occupational Health Providers (Fusion OH / Health and Work Consultancy) – May be used to assess your fitness to work, either at conditional offer stage or during employment. You may request to see any report before it is sent to us.
Learning Pool – Taff’s e-Academy web-based learning platform, used for training and development purposes.
Recruitment Agencies
On occasion we may advertise through a Recruitment Agency. Details relating to privacy will be the responsibility of the agency and you should refer to them on registration.
How long is the information retained for?
- Successful applicants: employee file retained for the duration of employment plus 6 years
- Unsuccessful applicants: information retained for 6 months from closure of the campaign
- Interview notes and assessment information: retained for 6 months from closure of the campaign
- Equal opportunities information: retained for 6 months from closure of the campaign
How we make decisions about recruitment
Final recruitment decisions are made by hiring managers and members of our People Services team. You can ask about decisions made about your application by emailing hr.mailbox@taffhousing.co.uk.
Tenants and management of their tenancies
Taff is the Data Controller for the information you provide. If you have any queries please contact us at info@taffhousing.co.uk.
Lawful basis for processing
- Performance of a contract (your tenancy agreement)
- Consent
- Legitimate interests
- Legal obligations
What will we do with the information you provide to us?
All of the information you provide will only be used for the purpose of progressing your application for housing, to fulfil our duty as a Landlord as set out in the Tenancy Agreement, and to improve our services. We do not share your information with third parties for marketing purposes or store any of your information outside of the European Economic Area.
Offer and commencement of tenancy
In order to offer you a property Taff will request the following information:
- Name, address, gender, date of birth and contact details
- Other occupants or family members moving with you
- Health or disabilities relevant to your housing needs
- Some income details, including current welfare benefits
- Information relating to any previous tenancies held
- Relevant criminal convictions pertinent to your tenancy application (where it is legal to do so)
We will also ask for the following, which you do not have to give, but which assists us in improving services:
- Ethnicity, nationality, preferred language, religion, gender, sexual orientation, marital status
- Name of support worker (if relevant), internet access, next of kin, preferred method of communication
- Agreement to send you information on events/activities
During your tenancy
The following information is collected and retained while you hold a tenancy with us:
- Your tenancy agreement
- Details about any benefit claim in relation to housing (Housing Benefit or Universal Credit)
- Your rental payments and balance
- Current occupants in your home
- All details relating to any tenancy breaches
- All appointments and communications with you, either verbal or written
- Any reports of anti-social behaviour, including CCTV footage, photos and noise recordings
- All repairs carried out on your home
- Applications to move home
- Any money advice we provide
When you end your tenancy
All information we have collected about you is retained on file for a maximum period of 6 years after the tenancy has ended, after which it is destroyed.
Third-Party Processors – Tenancy Management
We have contracts or data sharing agreements in place with all our data processors. Information is shared only for the purposes of helping us deliver services, preventing crime or ASB, or where we are obliged to do so by law.
Rubixx Housing Solution – Our housing management system used to support the management of tenancies, properties and related services. All relevant tenancy and housing management data is held and processed within this system.
All-Pay – An online system to enable tenants to pay rent online.
Dwr Cymru (Welsh Water) – We are obliged by law to provide all details of new tenants moving into our property to Dwr Cymru.
Maintenance Contractors – We share certain personal details (name, address and information pertinent to the service required) with contractors who provide maintenance services on behalf of Taff. Data is shared under a Data Sharing Agreement.
Glamorgan Archives – Used to archive old tenancy information in line with our Data Retention Policy. Information is then destroyed securely in line with our policy.
In addition, we share information with the Police and Law Enforcement Agencies as well as Cardiff Council where required.
Support Services delivery
Taff is both a Data Controller and a Data Processor of personal information received and shared during the delivery of support services agreed to by Service Users.
What will we do with the information you provide to us?
All of the information you provide will only be used for the purpose of providing the support service agreed to, including multi-agency data sharing, to fulfil any statutory duty required of us and to improve our services. All Service User personal data is restricted to the team that is supporting you.
On occasions we may share information for the purposes of detection or prevention of crime or anti-social behaviour, or where we believe sharing could prevent harm to an individual – for example in cases of domestic violence, mental health concerns or children at risk.
We use Discovery software as our case management system.
During your service delivery
We will continue to collect personal and sensitive data throughout the delivery of the service. This will include but is not limited to:
- Background information on you and your family
- Income and financial expenditure
- Tenancy information including rent arrears
- Substance/alcohol use
- Risk assessments and support plans
- Prior housing history and work/skills information
Where support is also provided to children or parenting support is being provided, additional information will be collected. We will also be provided information on family members by the referring agency.
When your service delivery comes to an end
We will retain your data for the minimum period required by law or by the referring contract and will dispose of it in accordance with our Data Retention Policy.
Publications and Communication
If you hold a tenancy with Taff Housing Association, there will be times we need to contact you, including:
- To get access to your home to carry out essential maintenance work or inspect your home
- To inform you of your rent balance
- Regarding any complaints that have been made against you
- To carry out essential functions as a Landlord
- To provide you with information relevant to the good management of your tenancy
- To consult on matters of relevance to you as a tenant
- To obtain your feedback on the quality of service delivery
- To engage with you to design our services and delivery to better support us
There are other instances where we may wish to contact you to tell you about events, activities, opportunities and local news. This is optional and we will always ask your permission before we send you this information.
We will never pass on your details to any third party for the purposes of marketing of services.
Privacy Notice for attending Taff events or site visits
Why we collect your information
When you attend our site or event, we may collect your name, contact details, and photographic images for the purposes of event management, safety, and promotion.
What information we collect
- Name and contact details (such as email address or phone number)
- Proof of identification (where required for entry or security)
- Photographs and/or video recordings taken during the event (for security or promotional purposes)
How we use your information
- To ensure the security of Taff residents, colleagues and service users
- To manage event attendance and ensure safety
- To contact you about event updates or emergencies
- For promotional purposes, such as sharing event photos on our website or social media (you may opt out of this at any time)
How we store your information
Your information is stored securely and only accessible to authorised staff. We will not share your details with third parties unless required by law or with your explicit consent, and will not retain this information after it has served its purpose.
Your Rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to the information we hold about you:
- The right to access your personal information
- The right to correct erroneous information
- The right to request erasure of your data in certain circumstances
- The right to request that we cease processing your personal data in relation to any of our services
- The right to object to the use of your image or details for promotional purposes
- The right to withdraw your consent at any time
Where possible, we will seek to comply with your request but there may be some situations where we will not legally be able to do this. You are legally entitled to request access to and receive a copy of any information that we hold about you.
If you are unsure which department to contact, please contact the Data Protection Officer on: DPO@Taffhousing.co.uk.
We may monitor and record electronic transactions (website, email and telephone conversations) only as permitted by the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 or for related business purposes.
Changes to the Privacy Notice
We reserve the right to update or amend this privacy notice at any time to reflect changes in our services and feedback from Service Users, as well as to comply with changes in the law. If we make significant changes, we will notify you by appropriate means. The latest version will always be available on our website at www.taffhousing.co.uk.
Please note: The information contained in this policy regarding third-party suppliers and services may not always reflect the most current arrangements, as these can change from time to time. However, where any such changes affect the way in which your personal data is collected, used, shared or protected, we are committed to communicating those changes to you. Tenants and service users will be informed of any material updates to our data processing arrangements by appropriate means, which may include written communication, notices on our website or direct notification.
Further Information & Contact Us
Taff tries to meet the highest standards when collecting and using personal information. If you want to make a complaint about the way we have processed your personal information, or if you would like to know more about how your information is being processed, please contact us:
Data Protection Officer
Alexandra House
307–315 Cowbridge Road East
Cardiff, CF5 4JD
Helpline: 0303 123 1113