Privacy notice - Subject Access Requests
Subject Access Requests - Collecting and retaining personal information.
Loretto will be the "data controller" of the personal information that you provide to us in respect of your Subject Access Request.
Our Data Protection Officer is Ranald Brown who can be contacted on firstname.lastname@example.org
What we need
The personal information we need to process your Subject Access Request may include but is not limited to:
- your full name and proof of your identity/photo ID
- your date of birth
- your contact details (phone, email or correspondence address)
- your previous address
- details of anyone authorised to act on your behalf if applicable
- length of time at your property address and rent reference number if applicable
- your photograph if you are requesting CCTV footage.
You are giving us your personal information to allow us to process your Subject Access Request and provide you with a response. We will also need to process your personal information if you ask us to review the way that we have handled your Subject Access Request or if you make a complaint to the UK Information Commissioner. We also use your information to verify your identity where required, contact you by post, email or telephone and to maintain our records.
Why we need your personal information - legal obligation
You are entitled to make a Subject Access Request for information that we hold about you. Processing your personal information is necessary for the compliance with our legal obligations under the General Data Protection Regulations and the Data Protection Act 2018. Where you provide us with more sensitive personal information about you we will process this information for reasons of substantial public interest as set out in the Data Protection Act 2018.
Other uses of your personal information
We may ask you if we can process your personal information for additional purposes.
Where we do so, we will provide you with an additional privacy notice with information on how we will use your information for these additional purposes.
How we will communicate with you
As you have requested information from us we need to communicate with you. This will usually be in writing or by telephone, but is more commonly becoming electronic.
We will only discuss your request with those authorised (temporarily or permanently) by you.
How we protect your personal information
Your personal information is stored on our paper and IT filing systems which may be copied for testing, backup, archiving and disaster recovery purposes. Access to your information is limited to those who require it to provide services to you. All data is held within the UK.
If any of your personal information is transferred out with the European Union or the European Economic Area by any of our contractors we will ensure that there are adequate safeguards in place to protect your personal information in accordance with the General Data Protection Regulations and the Data Protection Act 2018.
How long we keep your personal information
We only keep your personal information for the minimum period amount of time necessary. Sometimes this time period is set out in the law, but in most cases it is based on the business need.
We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. You can request a copy by contacting us at InformationRequests@wheatley-group.com
You can exercise any of the following rights by writing to us at InformationRequests@wheatley-group.com
Your rights in relation to your personal information are:
- you have a right to request access to the personal information that we hold about you by making a "Subject Access Request"
- if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information
- you have a right to request that we restrict the processing of your personal information for specific purposes
- if you wish us to delete your personal information, you may request that we do so.
Any requests received by Loretto will be considered under applicable UK Data Protection Legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office at www.ico.org.uk
The accuracy of our information is important to us - please help us keep our records updated by informing us of any changes to your email address, telephone numbers and other details.
Changes to our privacy notice
Our privacy notice is regularly kept up to date and this version was updated on 14 December 2018. The latest full version is always available from our website.