Privacy Notice

Summary

This Privacy Notice is a public document available to anyone and applies to customers of bdht ltd. (Bromsgrove District Housing Trust Ltd.) to explain how the organisation collects and processes personal information in order to conduct normal business activities as a UK charitable housing association.

Controller Details

Bromsgrove District Housing Trust Ltd (bdht) is a housing association and is a controller of personal information for the purposes of the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and the Data Use and Access Act 2025. Our contact details for data protection purposes are:

Data Protection Lead
Bromsgrove District Housing Trust Ltd
Buntsford Court
Buntsford Gate
Bromsgrove
B60 3DJ

Email: data.protection@bdht.co.uk

Bdht is registered with the Information Commissioner as a Data Controller and our registration number is: Z8411774.

UK GDPR sets out the rules and guidelines we must follow when handling your information. These are more commonly referred to as Data Protection Principles.

How we use and store your personal information

This privacy notice explains how bdht collects and stores personal and sensitive information. It also explains the purposes for which we will process your personal information and the legal basis for the processing.

How your personal information is collected

bdht collects information from you via a variety of sources, including when you apply for one of our properties or services, complete one of our forms, when you call, write, e-mail or meet with us or respond to a survey. We may collect information when you use our social media sites, websites or self-service portal ‘mybdht’.

We may also take photographs at our events, at our properties and in our communities to use for general marketing and publicity. Photographs of individuals are taken at the point of signing a new tenancy and will be held on our Housing Management System, will only be used these for other purposes with your consent.

We may receive information about you from third parties including: ? Your council or benefits office relating to your housing.

Prior landlords and credit agencies when you apply for housing. ? Police, welfare or support organisations dealing with you.
Councillors, MPs, relatives or other representatives acting on your behalf/instruction.
Financial institutions when you apply for our services

What information we collect

The personal information we collect will depend on our relationship with you and the services we are providing. We will only collect the information necessary to fulfil our obligations to you and in accordance with the legal bases set out below.

The information we require from you, the tenant(s) or leaseholder(s), and other household members include:

Full name (and proof of your identity / photo ID).
Date of birth.
National Insurance number (your unique identifier).
Contact details (phone, e-mail or correspondence address).
Details of anyone authorised to act on your behalf if applicable.
Basic details (name, DOB and relationships) of all household residents.
Banking details if you pay your rent by Direct Debit.
Card details if you pay by card (however card details are not stored).
Proof of housing eligibility, any interest or equity in other property.
Other personal information that will vary on a case by case basis to help us resolve breach of tenancy, alleged anti-social behaviour or fraud.
Health information where we need to adapt our services to ensure access to services
Disabilities or vulnerabilities. We use this information to tailor our service to better meet your particular circumstances and needs. We may use this information for safeguarding of staff.

The information we may collect from you includes:

Financial information. We may use this to help resolve arrears payments and optionally to provide welfare, benefits and debt advice as a free service to help you budget and pay your bills. We may use this to apply for funding on your behalf.
Health information when we require this to support funding for adaptations made to the property you are living in. More specific details are provided if you use this service.
Photo ID, bank statements, payslips or income details when we require this information for processing a house sale or purchase.

If you do not provide the information we need then we may not be able to provide all our services to you, and ultimately you may not be able to hold a tenancy or lease with us, or sell or purchase a property through us.

WHY DO WE COLLECT PERSONAL INFORMATION?

Tenants

The information we require from you is used to manage your tenancy agreement between you and bdht ltd. Please read your tenancy agreement carefully for specific details regarding processing your information and carrying out our activities.

The processing activities we conduct can be summarised as:

Assist in letting a home or property to you (lawful basis: contractual).
Managing your account charges and payments, including arrears (lawful basis: contractual).
Managing the repairs, maintenance, improvements and adaptations of our properties (lawful basis: contractual).
Ensuring tenancy conditions are complied with (lawful basis: contractual). ? Help prevent fraud (lawful basis: legal obligation, recognised legitimate interest).
Conduct annual gas safety check (lawful basis: contractual).
Manage complaints, instances of anti-social behaviour and safeguarding issues (lawful basis: contractual, legal obligation, recognised legitimate interest).
Conduct mandatory safety check (lawful basis: legal obligation).
Monitor, identify, and deliver support for special needs to you or any member of your household including financial advice and wellbeing support (lawful basis: contractual, consent).
Facilitate tenancy transfers (lawful basis: contractual).
Process insurance claims, and council enquiries (lawful basis: legal obligation, contractual).
Provide and assist in mutual exchanges (lawful basis: contractual).
Consult with you about service improvements (lawful basis: legitimate interest).
Share information with other agencies where we have your agreement or another legal basis (lawful basis: legal obligation, contractual or consent).
Conduct transactional surveys, research or analysis to monitor and improve our services (lawful basis: legitimate interest).
Monitor anonymised equality and diversity statistics (lawful basis: legitimate interest).
Provide information about our performance and services through newsletters (lawful basis: legitimate interest).
Provide information about additional services we offer, including opportunities to participate in meetings, training and events (lawful basis: consent).

Personal information is stored on our IT systems. It is held securely and we have security measures in place to protect it.

Leaseholders and Shareholders

The processing activities we conduct can be summarised as:

Assist you in looking for shared ownership properties (lawful basis: contractual obligation).
Manage and uphold our contract with you and comply with our legal obligations (lawful basis: contractual obligation).
Manage your tenancy and/or lease including the collection of rent, management of rent arrears and service charge, validate your right to rent, assess whether the home is affordable for you and to respond to any queries or problems which you may have (lawful basis: contractual obligation).
Manage and respond to repairs (lawful basis: contractual obligation).
Help protect and safeguard you (lawful basis: contractual obligation/vital interest, recognised legitimate interest).
Provide consultation on estimated cost of works for statutory purposes (lawful basis: contractual obligation).
Verify customer satisfaction through surveys following work carried out on repairs and emergency response repairs (lawful basis: legitimate interest).
Carry out work on defect repairs and inspections (lawful basis: contractual obligation).
Conduct a stock condition survey (lawful basis: legal obligation).
Manage your service charge and rent arrears (lawful basis: contractual obligation).
Conduct a yearly gas safety check (lawful basis: legal obligation).
Perform a lease extension (lawful basis: contractual obligation).
Manage your staircasing requests if made (lawful basis: contractual obligation).
? Facilitate the resale of a property (lawful basis: contractual obligation).

Personal information is stored on our IT systems. It is held securely and we have security measures in place to protect it.

Supported Tenants

The processing activities we conduct can be summarised as:

Provide support and assistance to customers and residents (lawful basis: contractual obligation, vital interest or recognised legitimate interest).
Help them maintain their home and independence (lawful basis: legal obligation).
Meet our regulatory and contractual requirements (lawful basis: contractual obligation/legal obligation).

Personal information is stored on our IT systems. It is held securely and we have security measures in place to protect it.

Contractors, Suppliers, Partners or Agents

We will collect relevant information from you in accordance with our contracts or data sharing agreements. This may include names and qualification information relating to your employees. The purpose is to enable you to provide services to our customers on our behalf.

Information will be held centrally by our Asset Management and Development Directorate on our IT system and by the relevant team/department in line with our retention periods. It is held securely and we have security measures in place to protect it.

Board Members and Involved Customers

Throughout your appointment as a Board and/or Committee member, or engagement as an involved customer, we will collect and process personal information about you.

The processing activities we conduct can be summarised as:

Contact you in relation to your role as a Board or Committee Member (lawful basis: legitimate interest, contractual).
Monitor compliance with the terms of your Agreement for Services, Terms of Appointment (lawful basis: legitimate interest, legal obligation).
Deliver tailored training and support (lawful basis: legitimate interest).
Provide information to third parties for legal and regulatory purposes e.g. Financial Conduct Authority, Regulator for Social Housing and lenders (lawful basis: legal obligation).
Monitor equality and diversity (the information provided is anonymised and used only for statistical monitoring purposes which help us make improvements).

Information is held centrally by our Governance Team or Customer Insight Team on our IT system and relevant contact information is held by the above two teams in line with our retention periods. It is held securely and we have security measures in place to protect it.

Applicants and Employees

This section contains a summary of the information bdht processes in relation to our employees. We have separate privacy notices for applicants and employees containing further information and are provided at the start of the recruitment process and when you sign your employment contract. Should you require a copy of these notices, please contact: data.protection@bdht.co.uk.

We collect personal and sensitive information relating to our workforce, this includes employees, contractors, temporary workers and volunteers. The processing activities we conduct can be summarised as:

Recruitment and appointment purposes.
Administration purposes (e.g. to operate payroll, pensions etc.) ? Conduct performance reviews, manage performance and determine performance requirements.
Offer any necessary support requirements in your role (training, lone working arrangements).
Compliance with legal or industry standards.
Conducting transactional surveys to monitor and improve our services, for example following training courses.
Monitor equality and diversity (the information provided is anonymised and used only for statistical monitoring purposes which help us make improvements).

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

Where we need to perform the contract we have entered into with you.
Where we need to comply with a legal obligation.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

Where we need to protect your interests (or someone else’s interests); and
Where it is needed in the public interest or for official purposes.

Information is held centrally by the HR Team on our computer system. Individuals and line managers can access certain personal information. Information is held securely and we have security measures in place to protect it.

We do share your data with third parties, including third-party service providers, for example payroll, pension administration, training and support. We require third parties to respect the security of your data and to treat it in accordance with data protection legislation. Unless we advise you otherwise, we’ll only collect and process personal information to carry out these functions.

Children

bdht does not normally process children’s information as part of a tenancy, as all tenants are adults. However, we record children’s basic information if they are resident in one of our properties, including their name and date of birth and any health related information. In such cases, we process that information based on our legitimate interests and to fulfil our legal and regulatory obligations.

This is required for checking the property is not overcrowded and to assess other tenancy management issues where all householders and ages are required to be known. This information can be used to adapt services to meet the needs of the household.

We may receive children’s information if we are involved in the housing and tenancy aspects of a welfare case as part of a multi-agency working solution.

Special Category Data

Where bdht processes special category personal data, it does so in accordance with Article 9 UK GDPR and the relevant Schedule 1 conditions of the Data Protection Act 2018.

Special category data is high-risk data, which essentially covers particularly sensitive information such as: racial or ethnic origin, political opinions, religious beliefs or philosophical beliefs, trade union membership, genetic data and biometric data for the purpose of identifying a natural person, health data, sex data, sexual orientation and/or criminal convictions and offences or related security measures.

This type of information require higher levels of protection and we therefore need to have further justification for collecting, storing, and using this type of personal information. We have in place safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in one or more of the following circumstances:

In limited circumstances, with your explicit written consent.
Where we need to carry out our legal obligations e.g. to safeguard your and others’ wellbeing and safety in our accommodation.
Where there are reasons of substantial public interest (with a basis in law).
Where it is needed in relation to legal claims.
Where it is needed to protect your vital interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public (e.g. if you are unwell and we need to inform a third party so that they may provide you with treatment).

We do not need your consent if we use special categories of your personal information in accordance with our appropriate policy document. In limited circumstances, we may approach you for your written consent to allow us to process certain sensitive data, but we are not required to obtain consent for all special category data we process. If we do ask for consent, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

Information about Criminal Conditions

bdht may only use information relating to criminal convictions where the law allows. This will usually be where such processing is necessary to carry out our obligations in accordance with our Data Protection Policy.

We may hold information about criminal convictions or alleged criminal offences. We only collect information about criminal convictions and alleged criminal offences if it is appropriate given the nature of the offence, your contract with us and where we are legally able to do so. We will use information about criminal convictions and offences in the following ways:

To assess whether it is appropriate for us to provide you or continue to provide you with accommodation.
To report incidents to third parties such as a university, law enforcement or other agencies.

We are allowed to use your personal information in this way where it is in the substantial public interest. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

How we manage your personal information

All personal data is processed in accordance with UK GDPR principles and the Data Protection Act 2018. We are committed to ensuring your data is treated fairly and lawfully to ensure information is processed for limited purposes, kept up to date, accurate, relevant and not excessive, not kept for any longer than necessary and kept secure.

Data integrity and security

bdht operates a range of information and communications systems and technologies for efficient operation of the business. We take our data protection responsibilities seriously and want to keep you informed about how we use your data. As such:

Maintains policies and procedures to ensure information is secure when stored and used internally, or when sharing data with a third party.
Personal data is only shared with other organisations or agencies under appropriate contractual arrangements, or with an individual’s consent, unless there are exceptional circumstances.
Third parties to have adequate organisational and technological security measures in place to ensure data integrity and confidentiality.
Regular training for all employees in their responsibilities in relation to data protection and security of data.
Verify the identity of all customers and their designated representatives when they contact us.
We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so.
Has a clear data breach procedure in place.
Wherever possible we use anonymised data (where you can no longer be identified as an individual). In this instance, the data no longer falls within the scope of UK-GDPR (2021) and the DPA (2018).
? Our servers and databases are protected by industry standard security technology.

We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate.

Who we may share your personal information with

Normally only bdht employees will be able to see and process your personal data. There may be times however where we will share your personal data with third parties for purposes where we are legally required to do so. This may include the following third parties:

Local authorities
Language translation services
Utility companies
Social services
Debt collection agencies
Benefit agencies
Repairs and maintenance contractors and sub-contractors
Health providers
Previous landlords
Emergency services
Insurers
Employment check services
IT support services
Out of hours service
And any other company or organisation you would reasonably expect us to share information with.

When sharing personal information, we will comply with all aspects of the UK-GDPR. We do not rely on consent to share your personal data, including special category data unless we specifically ask for it. We also ensure that we have appropriate data sharing and data processing agreements in place, these agreements specify the purpose of sharing data and how that data will be used.

We collect and share information on behalf of Bromsgrove District Council for the purpose of housing related activities. For details relating BDC’s Privacy Notice follow this link: bromsgrove.gov.uk/council/corporate/your-access-to-information/data-protection-and-information-management/privacy-notices

We collect and process information in relation to MARAC (Multi Agency Risk Assessment Meeting) please follow this link for more information regarding MARAC: www.westmidlands.police.uk/hyg/fpnwestmids/privacy-notice

How long we keep your personal information

Bdht has a data retention policy in place which sets out how long we keep different types of information, in accordance with legal requirements and best practice.

Please contact the Data Protection Team if you would like a copy.

Fraud Detection

There may be occasions where bdht will use data disclosed to us for the purpose of preventing and detecting fraud. This includes data provided on the website, ‘mybdht app’, or in any other way provided to us.

Data collected may be used for data matching and/or investigations. This could include comparing data we hold about you with third parties to prevent and detect fraud. The third parties may include but are not limited to Land Registry, local authorities, banks, schools and utility companies.

Call Recordings

Calls made to and from bdht call centre and certain direct lines are recorded for training and monitoring purposes and our recordings are usually held for a period of twelve months on our 8×8 call system. Not all calls are recorded, and the system may not always be operational. You can request a copy of call recordings if we hold it via a Subject Access Request.

Use of CCTV

We operate a CCTV system at our office premises for monitoring purposes, including for the prevention and detection of crime, prevent and tackle anti-social behaviour, protect customers, staff, homes, offices and assets. It operates continuously and recordings are held for one month.

There are signs in place to inform you where cameras are in use. Data is held in accordance with our Retention Policy. Further information can be found in our CCTV Policy.

Our legal bases for processing personal data captured by CCTV is to meet a legal obligation, perform tasks in public interest, contractual obligation and legitimate interest. Occasionally our cameras may capture special category personal data. Our basis for processing special category personal data is that there is a substantial public interest in processing this information, for the purposes of detecting and preventing crime.

We will provide copies of CCTV recordings to third parties (e.g. police and insurance companies) where we have an appropriate lawful basis to do so.

YOUR RIGHTS UNDER UK GDPR

Under UK GDPR individuals have eight rights in relation to the way we handle their personal data. These include:

Right to be Informed

Under UK GDPR individuals have the right to be informed about the collection and use of their personal data. Information about the data we collect and why is included within this Privacy Notice.

Right to Access

Under UK GDPR individuals have the right to access and receive a copy of their personal data, and other supplementary information. This is know as a Subject Access Request (SAR).

To make a subject access request please email the Data Protection Team at: data.protection@bdht.co.uk or call us on: 0800 0850160. We may request up to two forms of identification to verify your identity together with proof of address.

It will always help if you can be as specific about what personal data you want to see, what it relates to and within what timeframe, as that will assist our search. You have the right to correct information that we hold.

Your right to certain information may be restricted. For example, information relating to a third person or information relating to a police investigation and therefore this information will be redacted.

In most instances we will not charge for this service and will respond within one month of receiving your request, this timescale will be paused to confirm your identity. Should your request require an extension we will inform you of this.

Right to Rectification

The UK GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete. If you notice any incorrect or mistakes in the information we hold on you please email the Data Protection Team at: data.protection@bdht.co.uk or call us on: 0800 0850160.

Right to Erasure (to be forgotten)

The UK GDPR introduces a right for individuals to have personal data erased. This right is conditional on various factors including where the data is no longer necessary for bdht.

You can do this where:

The information is no longer necessary in relation to the purpose for which we originally collected/processed it.
We process your information via ‘consent’ legal basis, and you can withdraw consent.
You object to the processing and there is no overriding legitimate interest for us continuing the processing.
We unlawfully processed the information.
The personal information has to be erased in order to comply with a legal obligation.

We can refuse to erase your personal information where the personal information is processed for the following reasons:

To exercise the right of freedom of expression and information.
To enable functions designed to protect the public to be achieved.
To comply with a legal obligation or for the performance of a public interest task or exercise of official authority.
For public health purposes in the public interest.
Archiving purposes in the public interest, scientific research historical research or statistical purposes.
The exercise or defence of legal claims.
Where we have an overriding legitimate interest for continuing with the processing.

Right to Restrict Processing

Under UK GDPR individuals have the right to request the restriction or suppression of their personal data. When processing is restricted, we are still allowed to store your information but not do anything with it. You can do this by:

Challenging the accuracy of the information (we must restrict processing until we have verified its accuracy).
Challenging whether we have a legitimate interest in using the information. ? If processing is a breach of UK GDPR or is unlawful.
If we no longer need the personal data but you need the information to establish, exercise, or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

Right to Data Portability

Under UK GDPR the right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. You can request a copy of their data in a .csv / excel file from the Data Protection Team if the:

Legal basis for processing the data is consent or performance of a contract, and
Processing is carried out using automated means.

Please review the ICO’s advice here: Your right to data portability | ICO and contact the Data Protection Team for further guidance.

Right to Object

The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances. You can object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which overrides your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

Rights related to Automated Decision-Making (including profiling)

The UK GDPR has provisions on:

automated individual decision-making (making a decision solely by automated means without any human involvement); and
profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision making process.

bdht may analyse personal data to create profiles about individuals. We use profiling to improve how we deliver our services, to better understand demand, and to ensure our communications are relevant and effective.

Profiling does not produce decisions that have legal or similarly significant effects on you. Where we use profiling for service improvement or analytics, it is carried out using a combination of human review and automated tools. You have the right to object to this type of processing at any time.

Under the Data Use and Access Act 2025, We are permitted to use limited personal data (not special category data) to make automated decisions that may have a significant effect on individuals, where we consider we have a valid reason. There are currently no solely automated decision-making processes, but this will continually be monitored.

Withdrawal of Consent

If the basis on which we are using your personal information is your consent, we will seek your consent to contact you for non-essential services. Examples of this include marketing information about our services, community development activities, or employment support.

You have the right to withdraw your consent to us processing your information at any time. We must stop using the information. We can refuse if we can rely on another reason to process the information such as our contractual obligations or legitimate interests.

Data Analytics

We use secure cloud-based analytics services provided by Microsoft to store, manage and analyse data. These services act as data processors on our behalf, and data is hosted within the UK in accordance with Microsoft’s contractual and security commitments.

Use of Artificial Intelligence (AI)

We use Artificial Intelligence (AI) technologies within the business to support and improve the efficiency, accuracy, and consistency of our internal processes. These AI tools are used solely to assist employees in carrying out administrative, operational, and analytical tasks and are not used to make fully automated decisions with legal or similarly significant effects on individuals.

Where personal data is involved, AI is used in a controlled and proportionate manner, aligned with our lawful bases for processing under data protection legislation.

Data Protection and Security

All AI systems used by the organisation are subject to appropriate validation, governance, and security controls, including:

Assessment of data protection and privacy risks before use.
Restrictions on access to authorised personnel only.
Technical and organisational measures to protect data confidentiality, integrity, and availability.
Ongoing monitoring to ensure outputs are accurate, appropriate, and free from bias where reasonably possible.

Personal data processed using AI tools is handled in accordance with our information security policies and is not used to train public or unrestricted AI models, nor is it shared with third parties except where appropriate safeguards and contractual protections are in place.

Human Oversight

AI-supported outputs are reviewed by trained personnel, and meaningful human oversight is maintained at all times. Decisions affecting individuals are not made solely by AI without appropriate human involvement.

If you have any questions about how AI is used within our organisation or how your personal data is protected, please contact us using the details provided in this privacy notice.

Transferring information outside the EU

All data is held within the UK.

Website Visitors

We collect the following information from visitors to our website and our online resident portal:

Details collected through forms.
Surveys and polls about the website.
Site usage information from session cookies and log files.

Site Usage Information

You can read more about how we use cookies in our Cookies Policy.

Links to other websites

This Privacy Notice doesn’t cover links within our website to other websites. We encourage you to read the privacy statements on the other websites you visit.

Changes to the Privacy Policy

We keep our Privacy Notice under regular review. We’ll update it if we undertake any new or amended processing. This Privacy Notice was last updated in April 2026.

Further information

This Privacy Notice does not provide detail on all aspects of bdht’s collection and use of personal information. We’re happy to provide any further information or explanation needed. Please contact us using the information below.

How to contact us

If you want to get in touch, you can do so online or on the phone: 0800 0850160.

Write to us at:

Data Protection Lead
Bromsgrove District Housing Trust Ltd
Buntsford Court
Buntsford Drive
Bromsgrove
B60 3DJ

Complaints

Bdht is committed to meeting the highest standards when collecting and using personal information. We take any complaints we receive seriously. Please notify us if you think that our collection or use of information is unfair, misleading, inaccurate, or inappropriate.

If you wish to make a formal data protection complaint you can contact us at data.protection@bdht.co.uk and we will respond within 30 days.

If you remain unhappy with our response you’ve the right to complain to the Information Commissioner via their website at www.ico.org.uk or by writing to: Information Commissioner

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

This policy was reviewed April 2026.