Privacy Policy

Introduction

First Choice Housing Association (FCHA) values your trust and is committed to safeguarding your personal information. This Privacy Policy explains what personal data we collect, how we use it, and what rights you have. All data is processed in accordance with the UK General Data Protection Regulation (UK GDPR), and we adhere to the seven principles for the lawful processing of personal data:

Lawfulness, fairness, and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality (security)
Accountability

By accessing or using our website at www.fcha.org.uk or otherwise providing us with personal information, you acknowledge the practices described in this policy.

Contact Details

If you have any questions or requests regarding your personal data, please contact us at:

Email: customerservices@fcha.org.uk

Telephone: 02920 703 758

Mail: First Choice Housing Association, 10 Village Way, Tongwynlais, Cardiff, CF15 7NE

Information We Collect and How We Collect It

Information You Provide

We receive, collect, and store any information you enter on our website or provide us in any other way (e.g., via email, post, telephone, or forms). This may include:

Names and contact details (e.g., email address, phone number, postal address)

Correspondence or communications (e.g., messages you send us or forms you complete)

Details you provide when raising queries, complaints, or claims (e.g., witness statements, relevant information from previous investigations)

Information We Collect Automatically

We also collect certain technical information automatically when you visit our website, such as:

Internet Protocol (IP) address used to connect your computer to the internet

Browser type, version, and connection information

Session information (page response times, length of visits, page interaction, methods used to browse away from pages)

We may use software tools (including cookies) to measure and collect session information, which helps us improve our website and deliver our services more efficiently.

Why We Collect Personal Information

We collect and use both non-personal and personal information for the following purposes:

To Provide and Operate Our Services
- Ensuring efficient and secure services (e.g., troubleshooting technical issues)
Delivering our website’s functionality and dealing with user queries, complaints, or claims
To Provide Ongoing Customer Assistance and Technical Support
- Responding to your enquiries and requests promptly and accurately
- Keeping a record of communication to improve our future interactions
To Improve and Develop Our Services
- Creating aggregated statistical data (or inferred non-personal data) for analytics
- Refining content, tailoring user experience, and enhancing website performance
To Comply with Applicable Laws and Regulations
- Meeting legal, regulatory, or contractual requirements
- Establishing, exercising, or defending legal claims
To Safeguard Our Legal and Business Interests
- Protecting against fraud, unauthorised access, or other harmful activities
- Ensuring the continuity and legal compliance of our organisation

Our Lawful Bases for Processing Under UK GDPR

We rely on different lawful bases depending on the nature of our processing:

Consent
- Where we specifically ask for your permission (for example, to send certain marketing communications).
- Your Right to Withdraw Consent: If we rely on consent as our lawful basis, you can withdraw it at any time by contacting us.
Legitimate Interests
- We collect and use your personal information where it benefits you, our organisation, or others without causing an undue risk of harm.
- Examples of Our Legitimate Interests:
  - Ensuring efficient and secure services: Monitoring website performance, detecting security threats.
  - Improving and developing our services: Collecting analytics on pages visited, session duration, etc.
  - Providing effective customer support: Managing queries or complaints.
  - Safeguarding legal and business interests: Complying with law, responding to audits, or defending legal claims.
- Your Right to Object: You have the right to object to processing based on legitimate interests. If you wish to object, please contact us.

How Long We Keep Information

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

Data Retention

We keep your personal data only for as long as is necessary to fulfil the purposes outlined in this Privacy Policy—such as delivering our services, meeting legal or accounting requirements, and handling any disputes. When your personal data is no longer needed for these purposes, we securely delete, destroy, or anonymize it in accordance with our internal data retention policies and applicable laws.

We review our retention periods on a regular basis to ensure we do not keep data longer than required. If you would like more information about our specific retention schedules or if you believe that we are unlawfully retaining your personal information, please contact us.

Who We Share Personal Information With

We do not sell your personal data to third parties. However, we may share certain information with:

Service Providers and Contractors: Companies who perform services on our behalf.
Organisations for Safeguarding Reasons: Where necessary to protect individuals at risk or in vulnerable situations.
Financial or Fraud Investigation Authorities: If required for fraud prevention or detection.
Professional or Legal Advisors: For advice or legal support when needed.
External Auditors or Inspectors: To meet regulatory or contractual obligations.
Emergency Services: In cases of immediate risk or harm.
Councils and Public Sector Organisations: If they have a legal basis to request your information (e.g., to provide support services to you).
Other Relevant Third Parties (with your knowledge or where legally required).
Organisations We Are Legally Obliged to Share Data With: Such as regulatory bodies or law enforcement agencies.

Your Data Protection Rights

Under UK GDPR, you have rights regarding your personal data, including:

Right of Access
- Request copies of your personal information and additional details (e.g., where and why we collected it, and who we share it with).
Right to Rectification
- Ask us to correct any inaccuracies or complete incomplete data.
Right to Erasure (Right to be Forgotten)
- Request the deletion of your personal data, subject to certain exceptions.
Right to Restrict Processing
- Ask us to limit our use of your personal data in certain circumstances.
Right to Object
- Object to certain types of processing, especially where it’s based on our legitimate interests.
Right to Data Portability
- Request we transfer the personal information you gave us to another organisation or directly to you, where feasible.
Right to Withdraw Consent (where processing is based on consent)
- You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

If you make a request, we will respond without undue delay and in any event within one month. To exercise your data protection rights, please contact us using the details above.

How to Complain

If you have concerns about our use of your personal data, we encourage you to contact us first so that we can address your concerns. You may contact us at:

Email: customerservices@fcha.org.uk
Mail: First Choice Housing Association, 10 Village Way, Tongwynlais, Cardiff, CF15 7NE

Changes to This Policy

We reserve the right to modify this Privacy Policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon posting on our website. If we make material changes, we will notify you here so that you are aware of what information we collect, how we use it, and under what circumstances we disclose it.

Last Updated: 3rd January 2025