Your Personal Data and Your Privacy

Havebury believes in being open and transparent with everyone about how we process your personal data, so we have produced this notice to tell you:

• How we store your personal and sensitive personal information,
• What we use your personal information for,
• What information we may collect about you,
• Who (if anyone) we pass it on to and how they use it,
• Your rights and how to use them.

As a user of MyHavebury, we will tell you how we use your personal data and we promise to use it only in connection with your MyHavebury account, keeping your account secure and monitoring purposes. We will always make sure that we collect and store your personal data securely.

MyHavebury account

In order to set up a MyHavebury account for you, we will collect and keep a little data about you, such as your surname, date of birth and an email address which will be used as your username so that we can identify you. If you have an agreement with Havebury (such as a tenancy), then this data will be used to confirm your identity during the signup process.

It may also be necessary to share your personal data under strict conditions of confidentiality with our auditors and we may be compelled to share personal data with organisations that have a legitimate right to it.

Keeping your account secure

As part of our security arrangements for MyHavebury, we may use your data to identify you or your activity (for example, if we see something suspicious we may look at the way that you are using the system).

Monitoring

We are interested in how MyHavebury is being used and we may look at identifying trends and patterns in that usage which may allow us to improve the service to you or for us to make decisions about future investment in the service.

1. Who is responsible for your personal data?

For the personal data that Havebury collects and uses about you, Havebury is the Data Controller. When we refer to Havebury, we mean The Havebury Housing Partnership which is a charitable registered society under the Co-operative and Community Benefit Societies Act 2014 (7648) regulated by the Regulator of Social Housing (LH4339) and whose registered office is Havebury House, Western Way, Bury St Edmunds, Suffolk, IP33 3SP.

As the Data Controller, Havebury controls the way your personal data is collected and the purposes for which your personal data is used. We are registered as a Data Controller with the Information Commissioner’s Office (ICO) and our registration number is ZA295927.

2. Personal data we collect about you

Personal data is information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

If you have a relationship with us already (such as a tenancy or other type of contract or lease), please refer to the specific Privacy Notice relating to your relationship with us. The table below only shows specific data processing for MyHavebury rather than general data processing.

Categories of data we collect

Categories	Purpose	Legal basis for processing	Sharing with other organisations
Name Email address	To identify you as a user of MyHavebury	This is to provide access to MyHavebury under our terms and conditions	None
Date of birth	To confirm your identity if you have an existing relationship with Havebury	This is to provide access to MyHavebury under our terms and conditions	None
Usage IP address	To provide anonymised usage statistics and occasionally to diagnose problems	This is to provide access to MyHavebury under our terms and conditions	None

If you make a card payment on myHavebury, you will be asked to enter a billing address that matches the address linked to your card. This is to satisfy a requirement for card payment processing.

3. Your rights

You have rights granted to you by the Data Protection Act 2018. You can find out more by visiting the ICO website at: https://ico.org.uk/for-organisations/guide-to-the-general-dataprotection-regulation-gdpr/individual-rights/

You have the right to access your personal data at any time. The reason for allowing access is so that you can verify the lawfulness of the processing and to ensure that it is accurate. It will be provided within one month of your request and is free of charge, except where the request is unfounded, excessive or repetitive. We reserve the right in some rare cases not to respond, but we will always explain why.

You have the right to have incorrect or incomplete data rectified. If we have disclosed the personal data to others, we will inform them of the rectification unless this proves impossible or involves disproportionate effort.

You have the right to request erasure of your personal data or object to processing. If we agree with you, we will comply. You have the right to refuse processing of your data for marketing purposes.

If you would like to exercise any of your rights of your personal data, please visit the Information Governance site on The Hub for assistance.

4. Security of your personal data

We are committed to taking appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage to personal data.

5. Sharing your personal data

Whilst your personal data may be shared with our subsidiaries from time to time, Havebury will remain the Data Controller responsible for your data.

We will also share personal data with organisations that have a legitimate right to it. In such situations, those organisations will need to demonstrate that they have the legitimate right to your data and they can receive the data in a secure way.

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. These organisations are audited by Havebury to ensure compliance.

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

6. Further information

If you have any questions about how your personal data is processed by Havebury or you need any part of this document explaining, please email data.protection@havebury.com

If you are not satisfied with the response you receive you have the right to lodge a formal complaint to:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Email: casework@ico.org.uk

We keep our privacy notices under annual review, and we will update them if we undertake any new or amended processing. This privacy notice was last updated in December 2021.