Privacy Notice

How we use your Personal Information

Introduction

At Ayrshire Housing, we are committed to protecting and respecting your privacy. This Privacy Notice explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others, how we keep it safe and secure and your rights and choices in relation to your information.

We have a separate Privacy Notice for our employees and for our Board members, which are available on request.

Who are we?

Ayrshire Housing is a social landlord and factor having their Registered Office at:

119 Main St, Ayr, KA8 8BX.

Ayrshire Housing takes the issue of security and data protection very seriously. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.

We are registered with the Information Commissioner’s Office (ICO). Our registration reference is Z777739.

How do we collect information from you?

We obtain information about you in the following way:

Information you give us directly

We collect information from you:

  • when you apply for housing with us, become a tenant, request services/repairs, enter into a factoring agreement with ourselves howsoever arising or otherwise provide us with your personal details;
  • when you become a member;
  • from your arrangements to make payment to us (such as bank details, payment card numbers, employment details, benefit entitlement and any other income and expenditure related information);
  • during office appointments or visits to your home;
  • when you use our website, through the use of Cookies and website analytics;
  • when you enter information on our website or attend an online virtual meeting in platforms such as Zoom and Teams;
  • from your use of any of our other online services, whether to report any tenancy/factor related issues, works repair request, make a complaint, or otherwise.

If you apply for a job with us, we collect information about you from your job application. If you are successful in joining our team, we will also collect information from you in relation to your employment.

We will also collect contact details from our business partners, suppliers and contractors when we begin our business relationship with you.

Information we receive indirectly

  • Your information may be shared with us by third parties, which might include subcontractors acting on our behalf who provide us with technical, payment or repairs services and our business partners;
  • we may collect your image from our CCTV cameras which are located on our premises;
  • when you visit our website we place Cookies on your device to run the website. For more information about Cookies and how we use them please see our Cookie Notice;
  • when we are contacted by local authorities and law enforcement in relation to ongoing investigations;
  • during our employment process, we may receive your personal data from an applicant in relation to carrying out an employee reference check;
  • when you are noted as the emergency contact or next of kin of an employee, we may contact you when a situation arises;
  • when you interact with us on social media platforms such as Facebook or LinkedIn, we may obtain information about you (for example, when you like or post on our Facebook page). The information we receive will depend on the privacy preferences you have set on those types of platforms. You should check any privacy policy/notice provided to you where you give your data to a third party, for example, when you post to our Facebook page.

What type of information is collected from you?  Why do we need it and how will it be used?

The personal information we collect, store and use depends on your relationship with us.  We may collect the following information about you:

If you are our tenant, shared owner, or have a factoring agreement with us:

  • your name, address (including previous addresses), date of birth, national insurance number, email address, phone number(s), bank account details;
  • your date of entry, date of termination and rent charge;
  • details of other occupants in the property and their relationship to you (their name, relationship, date of birth);
  • any medical information you have given us to support your application for rehousing;
  • your emergency contact’s name, address and phone number(s) and relationship to you;
  • your employer and details of your employment;
  • protected characteristics data, as defined by the Equality Act 2010 (Age, Disability, Gender reassignment, Marriage and civil partnership, Pregnancy and maternity, Race, Religion or belief, Sex and Sexual orientation);
  • health and medical details;
  • how much rent you pay and any arrears you might have;
  • details of any claim you might have with local authority Housing Benefit Department and/or Discretionary Housing Payments;
  • details, including your National Insurance Number, of any claim you might have or Universal Credit with the Department of Work and Pensions;
  • details of any repairs requested and any access arrangements you have provided regarding this;
  • details of any incident(s) which may have occurred which may pose a risk to our colleagues;
  • details of any legal action we have taken relating to when a condition of your tenancy has been breached;
  • any complaint made by you.

We may receive the following information from third parties:

  • previous landlords’ name and address;
  • benefits information, including awards of Housing Benefit, Discretionary Housing Benefit and Universal Credit;
  • homeless referrals are made by the local authority so we will receive all the personal information that comes with the referral;
  • payments made by you to us via bank transfer or a payment card provider, in respect of rent, rechargeable repairs, service charges, factoring fees and membership fees;
  • complaints or other communications regarding behaviour or other alleged breaches of the terms of your Scottish Secure Tenancy (SST), Short SST, Occupancy Agreement, Lease, Shared Ownership Agreement with us, including information obtained from Police Scotland, the local Health and Social Care Partnership, the local authorities Community Safety and Anti-Social Behaviour Teams, and other residents;
  • reports as to the conduct or condition of your tenancy, including references from previous tenancies, and complaints of anti-social behaviour and any arrears balances;
  • support needs of vulnerable customers, including medical reports for medical adaptations and Social Work reports for applications. This includes when we are contacted by local authorities and other related functions / bodies for the provision of adaptations to be made to your home;
  • new homeowner details;
  • employment details.

We receive this information from:

  • Local Authorities
  • Health professionals
  • Charities
  • Other registered social landlords
  • Legal Advisors
  • Contractors and suppliers who have undertaken works on our behalf
  • MPs, MSPs and councillors
  • Utility companies
  • Household members
  • Debt collection agencies
  • Department of Work and Pensions
  • HMRC

We need and will use your information:

  • to undertake and perform our obligations and duties to you in accordance with the terms of our contract with you set out in your agreement (SST, Short SST, Occupancy Agreement, Lease, Shared Ownership Agreement, Title Deeds);
  • to enable us to supply you with the services and information which you have requested;
  • to enable us to respond to your repair request, housing application (including assistance with benefit applications, Universal Credit and Housing Benefit applications) and complaints made;
  • to refer you to, or signpost you to other organisations that may support you;
  • to analyse the information we collect so that we can administer, support, improve and develop our business and the services we offer;
  • to contact you and send you details of any changes to our services which might affect you;
  • to contact you for your views on our services;
  • for all other purposes consistent with the proper performance of our operations and business.

If you apply for a job with us:

  • your contact details, previous employment history and qualifications;
  • we may collect details of ethnicity and disability – for equalities monitoring and so that we can make any appropriate adjustments to your workplace;
  • we may collect references from third parties whose details you have provided.

We require this information as part of our recruitment process. If your application is unsuccessful, we will keep your application for six months from the date of notifying you of the outcome of the recruitment exercise.  Following this period, we will delete your personal data. Successful applicants’ documents will transfer to their employee file.

If you are a business contact, such as a supplier or contractor:

  • we may collect your business contact details such as your name, business address and business e-mail, and your company’s bank account and insurance details. If you are a sole trader this may be your personal details.

We need these details to provide our services and pay/invoice suppliers and contractors.

If you are a potential business contact, proposing to offer services to us, we may process your personal data in relation to entering into a contract with you or your organisation

When you visit our website:

  • if you allow the relevant Cookies, we may collect information about your activities on our website and about the device used to access it, for instance your IP address, website activity and behaviours, etc. For more information, please see our Cookie Notice;
  • any other personal information shared with us via our website forms and portals, such as our customer App. We will use this to help provide the service you have requested, or respond to any queries or complaints you have.

Links to other websites:

Our website may contain links to other websites run by other organisations. This Privacy Notice applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other websites even if you access those using links from our website.

In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the privacy notice of that third party site.

When you visit our premises or housing developments:

  • your image may be captured by our CCTV cameras. Notices are available where the cameras are in operation.

CCTV images may be used for security of our colleagues, customers and any other visitors to our premises, and to assist with the prevention and detection of crime, as evidence in a complaint.

If you do not wish to provide your personal data

Where we ask you for personal information because it is required by law or is necessary to enter into or perform a contract with you, we will explain this where appropriate. If you do not provide information that is necessary for that purpose, we may be unable to provide the relevant service or enter into or continue the relevant agreement with you.

Who has access to your information?

The information you provide to us will be treated in accordance with data protection law. Depending on your type of contract or other business relationship with us, we may disclose your personal data to any of our employees, officers, contractors, insurers, professional advisors (including legal advisers and our Data Protection Officer), agents, suppliers or subcontractors, selected third parties, government agencies and regulators and healthcare providers for the purposes set out in this notice, or for purposes approved by you, including the following:

  • if we enter into a joint venture with, or merge with, another business entity, your information may be disclosed to our new business partners or owners;
  • if we instruct adaptations, repair or maintenance works, your information may be disclosed to contractors we use;
  • if we are investigating a complaint, information may be disclosed to Police Scotland, the local authority (Anti-social behaviour, neighbour dispute and community safety) departments, Scottish Fire & Rescue Service, the association’s Solicitor, 1st tier tribunal solicitors, independent investigators such as auditors, the Scottish Housing Regulator, SPSO, and other regulatory body and others involved in any complaint, whether investigating the complaint or otherwise;
  • if we are updating tenancy details, your information may be disclosed to third parties (such as utility companies and the local authority);
  • if we are investigating payments made or otherwise, your information may be disclosed to payment processors, the local authority and the Department of Work & Pensions, Allpay, Worldpay and Bank of Scotland;
  • if utility companies are pursuing outstanding debt, we may share your details with them or debt collection agencies acting on their behalf;
  • if we need to protect our finances when you have vacated a property, we may disclose your personal data (name and forwarding address only) to utility companies, or debt collection agencies;
  • if your personal data is required by an emergency service;
  • if required by law, we will disclose your information to statutory bodies such as the police;
  • if we are conducting a survey of our services, your information may be disclosed to third parties assisting in the compilation and analysis of the survey results;
  • if you are using an advice or advocacy service, such as a solicitor or advice agency, we will share relevant information with them where it is necessary to progress your case;
  • if you work with a support provider, we will share relevant information to help with that support work;
  • if your household is threatened with homelessness, your information may be shared between us and Local Health Authority and Social Care Partnership(s) and social work;
  • if you request that we share your information with other RSLs who may assist in re-housing you;
  • if we are pursuing debt recovery, your information may be disclosed to our solicitors and the local authority, or a third party agency to assist in the recovery of those debts;
  • if we are making an insurance claim following an incident we may share your information with our insurers;
  • if we need to facilitate the payment of any benefits, your information may be disclosed to the Department of Work and Pensions, local authority or any other relevant department;
  • if the local authority is processing information about your council tax or relating to the electoral register, your information may be disclosed to them;
  • if required by a regulatory body, such as the Scottish Housing Regulator, Financial Conduct Authority or the Office of the Scottish Charity Regulator;
  • we may pass your information to our third-party service providers, suppliers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example software providers and IT Technical services, including – IT systems providers, telecoms providers, etc). However, when we use these third parties, we disclose only the personal information that is necessary to deliver the services and we have a contract in place that requires them to keep your information secure and prevents them from using it for their own direct marketing or any other purposes.

We do not sell your personal information. We will only share personal information where we have a lawful basis to do so and where the sharing is necessary and proportionate for the relevant purpose.

Lawful Processing

Data protection law requires us to have one or more lawful bases for processing your personal information. Depending on the purpose, we may rely on the following lawful bases:

  • Performance of a contract

Where we are entering into a contract with you or performing our obligations under it, such as your tenancy or factoring contract.

  • Consent

Where you have given us consent to process your personal data for a specific purpose, for example where consent is required for optional electronic marketing. You can withdraw your consent at any time. This will not affect the lawfulness of processing carried out before you withdraw it.

  • Public task

Where processing is necessary for us to perform a task in the public interest or exercise official authority that has a basis in law. This can include specific statutory functions relating to social housing and homelessness. We will only rely on this basis where the relevant function has a sufficient legal foundation.

  • Legal obligation

Where necessary so that we can comply with a legal or regulatory obligation to which we are subject, for example where we are ordered by a court or regulatory authority like HMRC.

  • Vital Interests

Where it is necessary to use your data to protect your own, or someone else’s, life.

  • Legitimate interests

Where it is reasonably necessary for our legitimate interests, or those of a third party, and those interests are not overridden by your rights and interests. We assess the purpose, necessity and impact of the processing before relying on this basis.

We consider our legitimate interests to be:

  • protecting our colleagues and customers and assisting with the prevention and detection of crime through the use of CCTV recordings;
  • enhancing, modifying, personalising or otherwise improving our website via analytics;
  • holding next of kin details as emergency contacts;
  • carrying out surveys and provision of informational newsletters;
  • managing our void properties in the event of outstanding tenant debts;
  • maintenance of disaster recovery plans.

When we legitimately process your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information where our interests are overridden by the impact on you, for example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).

Processing special category personal data

Special category personal data includes personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data used for the purpose of uniquely identifying you; data concerning health; and data concerning your sex life or sexual orientation. Criminal offence data is not special category data and is subject to separate rules, as explained below.

The special categories of personal information require higher levels of protection. We need to meet additional legal requirements for collecting, storing, and using this type of personal information.

The Article 9 condition we rely on depends on why we need to use special category data. Conditions that may apply to our activities include:

explicit consent;

employment, social security and social protection, where authorised by law;

vital interests, where you are physically or legally incapable of giving consent;

personal data which you have manifestly made public;

the establishment, exercise or defence of legal claims;

substantial public interest, where an applicable condition in Schedule 1 of the Data Protection Act 2018 is met. Where the law requires an Appropriate Policy Document, we will maintain one.

Criminal offence data

Criminal offence data includes personal information about criminal allegations, proceedings, convictions, offences or related security measures. Where we process criminal offence data, we will have an Article 6 lawful basis and meet the requirements of Article 10 UK GDPR and the Data Protection Act 2018, including an applicable Schedule 1 condition where required.

How long is your information kept for?

We will only retain your personal information for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting or reporting requirements. We will keep your information in line with our Retention Policy and schedule, and we will destroy or anonymise it when it is no longer required for the reasons it was obtained.

Where do we keep your data? 

Where personal information is transferred outside the United Kingdom, we will ensure that the transfer is permitted under UK data protection law, for example because the destination is covered by UK adequacy regulations or appropriate safeguards are in place. You can ask us for more information about the safeguards used for a particular transfer.

 How do we keep your data safe?

When we are provided with personal data, we take steps to make sure that your personal information is kept secure and safe. All data is held in accordance with Ayrshire Housing’s data protection policies and procedures. Our electronic filing systems are password protected, and all electronic data is stored securely, with encryption and appropriate access controls in place. All paper files are kept in secure locked cabinets behind locked doors.

Keeping your information up to date

We take reasonable steps to ensure your information is accurate and up to date; however please help us keep our records updated by informing us of any changes to your email address and other contact details.

Your Rights

Under UK data protection law, you have certain rights over the personal information that we hold about you.

  • Right of access

You have a right to request access to the personal data that we hold about you and to request a copy of it, and we will provide you with this unless legal exceptions apply. If you want to access your information, please send a description of the information you would like to see to the contact details at the bottom of this Privacy Notice. We may ask for proof of your identity before proceeding with your request.

  • Right to have your inaccurate personal information corrected

You have the right to have inaccurate personal information corrected and, taking account of the purpose of the processing, to have incomplete personal information completed.

  • Right to restrict use

You have the right to ask us to restrict the processing of your personal information in certain circumstances, for example while we consider a challenge to its accuracy or an objection to processing.

  • Right of erasure

You can ask us to erase your personal information in certain circumstances. This right is not absolute and does not apply where we need to keep the information for a lawful reason.

  • Right for your personal information to be portable

Where processing is carried out by automated means and is based on your consent or a contract with you, you may have the right to receive personal information you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller.

  • Right to object

You have the right to object to processing based on legitimate interests or public task, subject to the circumstances set out in data protection law. You have an absolute right to object to processing for direct marketing. You may also object in certain circumstances to processing for scientific or historical research or statistical purposes.

If you want to exercise any of the above rights, please contact our Data Protection Lead using the details at the bottom of this Privacy Notice. We may ask for further information where this is reasonably required to identify you or understand your request. We will respond without undue delay and within one month, unless data protection law permits an extension. If an extension applies, we will tell you and explain why.

Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office.

Queries and Complaints

You have the right to make a data protection complaint to Ayrshire Housing if you think we have not handled your personal information in accordance with data protection law. Please contact our Data Protection Lead by emailing info@ayrshirehousing.org.uk or telephoning 01292 880120. We will acknowledge a data protection complaint within 30 days of receiving it and, without undue delay, take appropriate steps to investigate it, keep you informed and tell you the outcome.

Our Data Protection Officer is provided by RGDP LLP, who can be contacted either via info@rgdp.co.uk or 0131 222 3239.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, about our use of your personal information.

The ICO contact details are noted below:

Telephone: 0303 123 1113

Online:  ICO | Make a Complaint

Changes to this Privacy Notice

Any changes we may make to this Privacy Notice in the future will be posted on this website so please check this page occasionally to ensure that you’re happy with any changes. If we make any significant changes to the way we process your personal data, we’ll make this clear on this website.

This Privacy Notice was last updated in September 2026.