We at Taff Housing Association are registered as a ‘data controller’ and “data processor” under the Data Protection Act.  We collect, hold and process a considerable amount of information, including some personal information about you that allows us to manage housing tenancies and provide services effectively. 

Your information is important to us and we take our responsibilities seriously, and we ensure that any personal information we collect about you and use is done so proportionately, correctly and safely.  This privacy notice tells you what to expect when Taff collects personal information.  It applies to information we collect about: 

  • Tenants and management of their tenancies 
  • Service Users accessing Support Services 
  • Maintenance support 
  • Publications and communication 
  • Visitors to our websites 
  • Surveys conducted by Taff 
  • Community Support delivery 
  • Complainants 
  • CCTV usage 
  • Job applicants and our current and former employees, volunteers and Board Members 

How will Taff process information they collect about me? 

We will use your personal data for a limited number of purposes within the rules set out in the Data Protection Act 2018.  We will process personal data: 

  • For the purpose for which you provided the information i.e. the management of your tenancy and/or delivery of support services provided and, to monitor our performance in responding to your request 
  • To allow us to be able to communicate and provide services appropriate to your needs 
  • To contact you to update you with any additional information or reminders, or for you to participate in surveys that will help improve our services. We may contact you through one or more of the following;  by post, email, telephone, text message and social media messaging platforms including WhatsApp.
  • To ensure that we meet our legal requirements, including obligations imposed under the Equality Act 2010 and Health and Safety Acts 
  • For law enforcement where we are legally obliged to undertake such processing 
  • To process financial transactions including grants, payments and benefits involving us or third parties or where we are acting on behalf of other government bodies, for example, the Department for Works and Pensions 
  • Where you have consented to the processing 
  • Where necessary to protect individuals from harm or injury 
  • Where otherwise permitted under the Data Protection Act 2018. (For further information on the Data Protection Act refer to the Information Commissioner’s website) 
  • We may also use your personal data, after it has been anonymised, to allow the statistical analysis of data to allow us to effectively plan the provision of future services. 

At no time will your information be passed to organisations external to the Association for marketing or sales purposes.

Using your personal data  

In deciding what personal data to collect, hold and use we have committed to ensuring that we will: 

  • Recognise we have responsibility for any personal data handled by us 
  • Adopt and maintain high standards in respect of the handling and use of that personal data 
  • Only collect, hold and use personal data where it is necessary and proportionate to do so 
  • Securely delete any personal data when no longer needed 
  • Keep your personal data safe and secure 
  • Consider and address privacy first when planning to use or hold personal information in new ways, such as when introducing new systems 
  • Be open with you about how we use your information and who we give it to 
  • Make it easy for you to access and correct your personal information 
  • Ensure that there are effective safeguards and systems in place to make sure your personal information is kept securely and does not fall into the wrong hands 
  • Provide training to staff who handle personal information 
  • Put appropriate financial and human resources into looking after your personal information 

We may disclose personal data to third parties, this may include local authorities, support services and our contractors, but only where it is necessary to deliver the service or manage the tenancy, to comply with a legal obligation, or where permitted under the Data Protection Act, for example where the disclosure is necessary to allow a third party working for or on our behalf to provide a service.  This may be providing maintenance to the property, gas surveys and or property surveys.  

We will strive to ensure that any personal data in our care will be kept safe and where your information is disclosed to a third party we will seek to ensure that the third party has sufficient systems and procedures in place to prevent the loss of personal data. 

Where we seek to disclose sensitive personal data, such as medical details, to third parties, we will do so only with your prior express consent or where we are legally required to do. 

Visitors to our websites 

Taff does not capture or store any personal information about individuals who browse this website, except where you voluntarily choose to give us your personal details via email or an online form to enquire or apply for any of our services.  We will only do this when we require that information for specific purposes, for example, to answer an enquiry you have submitted or send information that you have requested. 

What about Cookies  

Cookies are files which are sent to your computer or other access device from a web site which can be accessed at a later time by the same web site.  Cookies do not contain any personal information about you and cannot be used to identify an individual user.  We use cookies to provide us with anonymous information on how people use our website and to help us to know what they find interesting and useful on our website. 

Most web browsers accept cookies by default.  However, if you are uncomfortable with cookies, you may be able to set your web browser to refuse all cookies or to let you know when a cookie is sent to your computer – you can then choose whether to accept the cookie, or not. 

People who make a complaint to us 

When we receive a complaint from a person we make up a file containing the details of the complaint.  This normally contains the identity of the complainant and any other individuals involved in the complaint. 

We will only use the personal information we collect to process the complaint and to check on the level of service we provide.  We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone. 

We usually have to disclose the complainant’s identity to whoever the complaint is about.  If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that.  However, it may not be possible to handle a complaint on an anonymous basis. 

We will keep personal information contained in complaint files in line with our retention policy.  It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. 

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues, and to check on the level of service we provide. 

Detection and Prevention of crime, fraud and data matching  

We are required by law to protect the funds we administer.  We process and share the information provided to us to prevent and/or detect potential fraud and crime, by both conducting our own data matching as well as sharing this information with other public bodies, such as the Department for Work and Pensions, Local Authorities, HM Revenues, Customs, the Police, as well as utility companies, credit reference agencies, service providers, contractors and/or partner bodies, where the disclosure of such information is either: 

a)necessary for the purposes of the prevention and/or detection of crime; and/or  

b)is otherwise necessary to comply with any other legal obligation 

c)assisting in emergency response management 

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match.  This is usually personal information.   


We have installed CCTV systems in some of our locations used by staff, residents and members of the public, for the purposes of public and staff safety, crime prevention and detection and business related functions.  In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information about the scheme. 

We will only disclose CCTV images to others who intend to use the images for the above-described purposes.  CCTV images will not be released to the media for entertainment purposes or placed on the internet.  Images captured by CCTV will not be kept for longer than necessary.  However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated.  You have the right to see CCTV images of yourself and be provided with a copy of the images. 

Job applicants, current and former Taff employees, Volunteers and Board Members 

Taff is the Data Controller for the information you provide during the process unless otherwise stated.  If you have any queries about the process or how we handle your information please contact us at hr.mailbox@taffhousing.co.uk. 

What will we do with the information you provide to us? 

All of the information you provide during the process will only be used for the purpose of progressing your application or to fulfil legal or regulatory requirements if necessary. 

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area.  The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format. 

We will use the contact details you provide to us to contact you to progress your application.  We will use the other information you provide to assess your suitability for the role you have applied for. 

What information do we ask for, and why? 

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. 

The information we ask for is used to assess your suitability for employment.  You don’t have to provide what we ask for but it might affect your application if you don’t. 

Application stage 

If you use our online application system, this will be collected directly by Taff.  We ask you for your personal details including name and contact details.  We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for.  Our recruitment team will have access to all of this information. 

You will also be asked to provide equal opportunities information.  This is not mandatory information – if you don’t provide it, it will not affect your application.  This information will not be made available to any staff outside of our recruitment team, including hiring managers, in a way which can identify you.  Any information you do provide will be used only to produce and monitor equal opportunities statistics. 


Our hiring managers’ shortlist applications for interview.  They will not be provided with your name or contact details or with your equal opportunities information if you have provided it. 


We might ask you to participate in assessment days; complete tests or occupational personality profile questionnaires; and/or to attend an interview – or a combination of these.  Information will be generated by you and by us.  For example, you might complete a written test or we might take interview notes.  This information is held by Taff. 

Conditional offer 

If we make a conditional offer of employment we will ask you for information so that we can carry out pre-employment checks.  You must successfully complete pre-employment checks to progress to a final offer.  We are required to confirm the identity of our staff, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability.  

You will therefore be required to provide:  

  • Proof of your identity – you will be asked to attend our office with original documents, we will take copies 
  • Proof of your qualifications – you will be asked to attend our office with original documents, we will take copies 
  • You will be asked to complete a criminal records declaration to declare any unspent convictions and make an application for criminal record verification to verify your declaration 
  • We will contact your referees, using the details you provide in your application, directly to obtain references 
  • We may ask you to complete a questionnaire about your health.  This is to establish your fitness to work 

If we make a final offer, we will also ask you for the following: 

  • Bank details – to process salary payments 
  • Emergency contact details – so we know who to contact in case you have an emergency at work 

Post start date   

Our Code of Conduct requires all staff to declare if they have any potential conflicts of interest, or if they are active within a political party.  If you complete a declaration, the information will be held by the Governance Officer.  This declaration is required to be completed annually and will be reviewed and exemptions will be reported on an anomalised basis to Welsh Government as it is a regulatory requirement.  

Use of data processors 

Data processors are third parties who provide elements of our recruitment service for us.  We have contracts in place with our data processors.  This means that they cannot do anything with your personal information unless we have instructed them to do it.  They will not share your personal information with any organisation apart from us.  They will hold it securely and retain it for the period we instruct.  

Criminal conviction data 

We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us.  This data will usually be collected at the recruitment stage, however, may also be collected during your employment should you be successful in obtaining employment.  We use Atlantic Data  

Here is a link to their Privacy Notice.  



The online application is processed using iTrent HR information system and if you accept a final offer from us, some of your personnel records will be held on I-Trent. 

Here is a link to their Privacy Notice. 


Psytech International 

Psychometric testing is processed through an online system called Psytec. 

Here is the link to their Privacy Policyhttp://www.psytech.com/About/Privacy 


Likewise, your details will be provided to SHPS who are the administrators of Taff’s Pension Scheme, of which Taff is a member organisation.  You will be auto-enrolled into the pension scheme and details provided to SHPS will be your name, date of birth, National Insurance number and salary.  

Here is a link to their Privacy Notice. 


Simply Health 

Simply Health provides our Employee Assistance Service which includes face to face and telephone counselling support 

Here is a link to their Privacy Notice. 


Occupational Health Providers 

If we make you a conditional offer, we may ask that you complete a questionnaire which will help to determine if you are fit to undertake the work that you have been offered, or if any adjustments are needed to the work environment or systems to enable you to work effectively. 

During the course of employment there may be the need to refer you to our Occupational Health providers in order that they can assess the impact of health matters that may affect your ability to perform effectively in the workplace.  The information you provide as part of the referral process will be held by the provider who will provide us with a report with recommendations. You are able to request to see the report before it is sent to us.  If you decline for us to see it, then this could affect any actions taken regarding your ongoing employment.  If an occupational health assessment is required, this is likely to be carried out by Fusion or Health and Work Consultancy. 

Here is a link to their Privacy Notice. 



Learning Pool 

Taff’s e-Academy is a web based learning platform which is used for training and development purposes.  

Here is a link to their Privacy Notice. 


Recruitment Agencies 

On occasion we may advertise through a Recruitment Agency.  They will provide us with information collected from you and might ask you to complete a work preference questionnaire which is used to assess your suitability for the role you have applied for, the results of which are assessed by recruiters.  Details relating to privacy will be the responsibility of the agency and you should refer to them on registration with them. 

 How long is the information retained for? 

If you are successful in your application, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus 6 years following the end of your employment.  This includes your criminal records declaration, fitness to work, records of any security checks and references. 

If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 6 months from the closure of the campaign. 

Information generated throughout the assessment process, for example interview notes, is retained by us for 6 months following the closure of the campaign. 

Equal opportunities information is retained for 6 months following the closure of the campaign whether you are successful or not. 

How we make decisions about recruitment? 

Final recruitment decisions are made by hiring managers and members of our People Services team.  All of the information gathered during the application process is taken into account. 

You are able to ask about decisions made about your application by speaking to your contact within our People Services team or by emailing hr.mailbox@taffhousing.co.uk.  

Tenants and management of their tenancies 

Taff is the Data Controller for the information you provide during the process unless otherwise stated.  If you have any queries about the process or how we handle your information please contact us at info@taffhousing.co.uk. 

What will we do with the information you provide to us? 

All of the information you provide will only be used for the purpose of progressing your application for housing, to fulfil our duty as a Landlord, as set out in the Tenancy Agreement and to improve our services.  Where you have given your permission, we will also provide you with information on events, activities and opportunities that may be relevant to you.  

In rare occasions we may share the information you provide to us for the purposes of detection or prevention of crime or anti-social behaviour, or where we believe that sharing the information could prevent harm to an individual or in the case of public protection – for example in cases of domestic violence, mental health concerns or children at risk.  We also share the information you give us with software providers in order to host tenancy related information.  We do not share your information with third parties for marketing purposes or store any of your information outside of the European Economic Area.  The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format. 

Offer and Commencement of Tenancy 

In order to offer you a property Taff will request some information from you.  This information is required for us to offer you a property and without it; we would not be able to do so. These are: 

  • Name 
  • Address 
  • Gender 
  • DOB 
  • Contact details 
  • Other occupants or family members moving with you 
  • Health or disabilities relevant to you housing needs 
  • Some income details, including current welfare benefits 
  • Information relation to any previous tenancies you may have held via a reference from a previous landlord 
  • Relevant criminal convictions pertinent to your tenancy application and where it is legal to do so (you would have supplied this information as part of your initial application with Cardiff Council) 

We will also ask you for other information which you do not have to give, but which assists us in improving services and ensuring they are fair and equal.  These are: 

  • Ethnicity 
  • Nationality 
  • Preferred language 
  • Religion 
  • Gender 
  • Sexual orientation 
  • Marital status 
  • Name of support worker (if relevant) 
  • Internet access 
  • Next of Kin (NOK) 
  • Preferred method of communication 
  • Agreement to send you information on events/activities 

During your Tenancy with us: 

The following information is collected and retained while you hold a tenancy with us or in order for us to meet our obligations as a Landlord, as set out in the tenancy agreement.  

  • Your tenancy agreement 
  • Details about any benefit claim you may have in relation to Housing (Housing Benefit or Universal Credit) 
  • Your rental payments and balance  
  • Current occupants in your home 
  • All details relating to any tenancy breaches 
  • All appointment and communication with you, either in verbal or written form 
  • Any reports of anti-social behaviour against you or made by you, including CCTV footage, photos and noise recordings.  
  • All repairs carried out on your home 
  • Applications to move home 
  • Any money advice we provide you 

When you end your Tenancy and retention of data 

If you have held a Tenancy with us all the information we have collected about you is retained on file for a maximum period of 6 years after the tenancy has ended, after which it is destroyed.  


Use of third party data processorsas part of the tenancy management service 

Some information you provide to us before and during your tenancy is shared with third party organisations for the purposes of  

a)helping us deliver services or  

b)for the detection and prevention of crime or ASB or  

c)where we are obliged to provide it by law 


We have contracts or data sharing agreements in place with our data processors.  

Locality SolutionsWe use Locality Solutions to provide us with case management software in order to manage reports of Anti-Social Behaviour.  All information pertaining to Anti-Social Behaviour reports are logged on this third party system.  Below is a link to their privacy policy. 


The Noise App: The Noise App is a service to enable tenants to upload noise nuisance from their smart phones directly.  We use the noise app to manage cases of noise nuisance.  

All-PayAll Pay is an online system to enable tenants to pay rent on-line.  Below is a link to their privacy policy. 


In addition, we share information with the Police and Law Enforcement Agencies as well as Cardiff Council. 

Dwr Cymru: We are obliged by law to provide all details of new tenants moving into our property to Dwr Cymru.  Below is a link to their privacy policy.  


Maintenance Contractors: We share certain personal details with contractors who provide maintenance services on behalf of Taff.  Details shared will include name, address and any other information pertinent to the performance of the service required.  Data is shared under a Data Sharing Agreement. 

Glamorgan ArchivesWe use this company to archive old tenancy information in line with our Data Retention Policy.  It is then destroyed securely in line with our policy.  Information on their policies around storage of data can be found below: 


Housing Insight host our app and portal solution ‘My Taff’. Housing insight does not manage your data but may use some information for reporting purposes only.

Support Services Delivery 

Taff is both a Data Controller and a Data Processer of personal information received and shared during the delivery of support services agreed to by Service Users. 

What will we do with the information you provide to us? 

All of the information you provide will only be used for the purpose of providing the support service agreed to, including multi agency data sharing, to fulfil any statutory duty required of us and to improve our services.  

Taff collects both personal and sensitive data as part of the service delivery process.  We will receive information from referral agencies and will share information with relevant agencies.  All data shared is done so with data sharing agreements between Taff and the relevant agency.  All Service User personal data is restricted to the team that is supporting you. 

On occasions we may also share the information you provide to us for the purposes of detection or prevention of crime or anti-social behaviour, or where we believe that sharing the information could prevent harm to an individual or in the case of public protection – for example in cases of domestic violence, mental health concerns or children at risk.  

We also share the information you give us where required to do so Local Authorities and use software providers to host service related information.  We use Discovery software as our case management system.  

During your service delivery 

We will continue to collect personal and sensitive data throughout the delivery of the service which you have signed up to.  This will include but is not limited to: 

  • Background information on you and your family to build up a picture of your circumstance 
  • Income and financial expenditure  
  • Tenancy information including rent arrears 
  • Substance/alcohol use 
  • Risk assessments from referring agency and prepare new assessments 
  • Prior housing history 
  • Work/skills information 
  • Support Plans 

Where support is also provided to children or parenting support is being provided additional information will be collected in order to be able to deliver full support.  This will include information on children as well as parents.  We will also be provided information on family members by the referring agency. 

If you are also a tenant we will also refer to tenancy data which we hold in line with this policy to fulfil our obligations under that agreement. 

When your service delivery comes to an end 

We will retain your data for the minimum period required of Taff by law or by the referring contract.  We will continue to hold your data safely and will dispose of it in accordance with our Data Retention Policy. 

Publications and Communication 

If you hold a tenancy with Taff Housing Association, there will be times we need to contact you. Some of these are described below (the list is not exhaustive): 

  • To get access to your home to carry out essential maintenance work or inspect your home 
  • To inform you of your rent balance 
  • Regarding any complaints that have been made against you 
  • In other instances where we must contact you to carry out essential functions as a Landlord 
  • To provide you with information relevant to the good management of your tenancy 
  • To consult on matters of relevance to you as a tenant 
  • To obtain your feedback on the quality of service delivery and 
  • To engage with you to design our services and delivery to better support us 

There are other instances where we may wish to contact you to tell you about events, activities, opportunities and local news.  This is optional and we will always ask your permission before we send you this information.  If you have not given us your permission you will not receive information on events, activities or opportunities in your vicinity.  

We will never pass on your details to any third party for the purposes of marketing of services.  

Your rights 

Under the Data Protection Act, you have rights as an individual which you can exercise in relation to the information we hold about you. 

You have the right to request that we cease processing your personal data in relation to any of our services.  Where possible, we will seek to comply with your request but there may be some situations where we will not legally be able to do this.  However, ceasing to process this data may cause delays or hinder our ability to provide services to you. 

You are legally entitled to request access to and receive a copy of any information that we hold about you.  We will seek to comply with your request but there may be some situations where it will not be able to do this in full, for example where information held was given in confidence, this may include information given to us by a third party. 

For further information about either requesting access to your personal data or to cease processing personal data please contact us. 

We try to ensure that any personal data we hold about you is correct but there may be situations where the information we hold is no longer accurate.  If this is the case, please contact the department holding the information so that any errors can be investigated and corrected.  If you are unsure which department to contact, please contact the Data Protection Officer on: DPO@Taffhousing.co.uk 

We may monitor and record electronic transactions (website, email and telephone conversations).  This will be used, for example, to help improve our service to you, to prevent or detect a crime, or investigate or detect the unauthorised use of the telecommunications system and only as permitted by the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 or for related business purposes. 

Complaints or queries 

Taff tries to meet the highest standards when collecting and using personal information.  For this reason, we take any complaints we receive about this very seriously.  We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.  We would also welcome any suggestions for improving our procedures. 

This privacy statement was drafted with brevity and clarity in mind.  It does not provide exhaustive detail of all aspects of Taff’s collection and use of personal information.  However, we are happy to provide any additional information or explanation needed.  Any requests for this should be sent to the address below. 

If you want to make a complaint about the way we have processed your personal information, you can contact us on: DPO@Taffhousing.co.uk 

Changes to the Privacy Notice  

We will continually review and update this privacy statement to reflect changes in our services and feedback from Service Users, as well as to comply with changes in the law. 

Further Information  

We will comply with the legal requirements set out by the Data Protection Act in relation to the collection, holding and processing of personal data.  If you would like to know more or have any concerns about how your information is being processed please contact us on 029 2025 9100 or email us on: DPO@Taffhousing.co.uk 

Or in writing to: 

Data Protection Officer 

Taff Housing Association 

Alexandra House 

307 – 315 Cowbridge Road East 


CF5 4JD 


If you require general information about the data protection act, information is available on the Information Commissioner Website