Privacy & Cookies Policy

Last updated: [Date to confirm] Version: 1.0 (Draft)

1. Who we are

Diverse Supported Accommodation CIC is the data controller responsible for the personal information described in this policy. We are a Community Interest Company registered in England and Wales (company number 14181585), with our registered office at 71-75 Shelton Street, London WC2H 9JQ.

For any questions about how we handle personal data, you can email us at info@dsacic.co.uk.

2. What personal data we collect

We collect different categories of personal data depending on your relationship with us:

Residents

Name, date of birth, contact details
Identification documents (where required for tenancy)
Tenancy and rent payment records
Information about the property (repair records, inspection notes)
Limited information about support needs as shared by referrers or the resident — used only for matching and tenancy-management purposes
Safeguarding information where relevant to property-related risks

Referrers, commissioners and support partners

Name, role, organisation, work email, work phone
Correspondence with us
Information about residents you have referred or commissioned

Job applicants and people registering interest in roles

Name and contact details
Career history, references, right-to-work documentation
DBS check outcomes for roles requiring them

Website visitors

Information you provide via web forms or email
Standard technical data your browser sends (IP address, browser type, pages visited) — used in aggregate to understand site usage
Cookie data (see section 7)

3. Why we collect it & lawful basis

Under UK GDPR we must have a lawful basis for processing personal data. Our processing typically relies on:

Contract — to deliver our tenancy and housing services to residents.
Legal obligation — to meet our duties as a landlord, employer and CIC (statutory compliance, Housing Benefit verification, safer recruitment, etc.).
Legitimate interests — to communicate with referrers, commissioners and support partners; to run our website; to manage our business effectively.
Vital interests — in safeguarding situations where someone's life or safety is at risk.
Consent — where we ask you to opt in to specific things (e.g. a newsletter).

For special category data (such as health or mental health information), we rely on additional Article 9 conditions where appropriate, typically substantial public interest or the provision of social care/health-related services.

We do not sell personal data. We share it only where it's necessary, proportionate, and on a lawful basis. The main parties we may share data with are:

Approved support providers operating in our properties (under a written data-sharing agreement)
Local authority and NHS bodies for safeguarding, commissioning, or Housing Benefit purposes
Our regulators (Companies House, the CIC Regulator, the Information Commissioner's Office)
Service providers acting on our behalf — such as our repair-reporting platform (Fixflo), accountants, IT providers — all under written contract
Law enforcement or other bodies where we are legally required to disclose

5. How long we keep data

We keep personal data only for as long as we need it for the purpose it was collected, or as required by law. Typical retention periods are:

Resident records — for the duration of the tenancy plus 6 years afterwards (in line with limitation periods)
Job applicant records — 12 months for unsuccessful candidates, or longer if they consent to be retained on file
Employment records — duration of employment plus 6 years
Statutory compliance records (gas, electrical, fire, etc.) — minimum periods set by relevant regulations, typically 6 years
Email correspondence — typically up to 3 years unless retained for a specific reason

6. Your rights

Under UK GDPR you have the following rights:

Right to be informed — this policy is part of how we do that
Right of access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — in certain circumstances, you can ask us to delete data
Right to restrict processing — in certain circumstances
Right to data portability — for data you have provided where processing is based on consent or contract
Right to object — to processing based on legitimate interests
Rights related to automated decision-making — we do not currently use any solely automated decision-making

To exercise any of these rights, email info@dsacic.co.uk. We will respond within one month.

7. Cookies

Our website uses cookies sparingly. We do not currently use third-party advertising or tracking cookies. We may use:

Strictly necessary cookies — needed for the site to function
Analytics cookies — to understand how the site is being used, in anonymous, aggregated form. These are only set with your consent.

You can refuse or remove cookies through your browser settings at any time.

8. How to complain

If you're unhappy with how we've handled your data, please contact us first at info@dsacic.co.uk. We'll always try to put things right.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk · 0303 123 1113

9. Contact us

For any data protection question, including subject access requests:

Diverse Supported Accommodation CIC
71-75 Shelton Street, London WC2H 9JQ
info@dsacic.co.uk