Privacy & Your Right to Know

When we say ‘we’ or ‘us’ in this document we’re generally referring to those companies which are landlords or service providers to our customers and form part of the Abri Group of Companies, of which Abri Group Limited is the parent company, namely:

• Abri Group Ltd
• The Swaythling Housing Society Ltd
• Radian Developments Ltd
• Yarlington Homes Ltd

These organisations are data controllers and in this Privacy Notice are collectively known as Abri.

We collect and process a range of data about you. Depending on the relationship we have with you, this may include:

• Name,
• Date of birth
• Current, previous and forwarding addresses and the types of tenancy you have previously had
• Telephone numbers and email addresses,
• Next of Kin details (for use in emergencies)
• The number and age of people in your household
• Car registration details (where a managed parking scheme is in force)
• Your contact details (email, mobile phone number and landline number)
• Employment details and state benefit entitlements
• Information about your employment status and income levels
• National Insurance number
• Records of anti-social behaviour (for more information please contact us and ask for a copy of our Anti-Social Behaviour Policy)
• Records relating to your interactions with our staff (including telephone recordings) and how you prefer to communicate with us
• Information concerning your obligations to us as our tenant or lessee, including rent payments and arrears, or service charges, and compliance with your tenancy contract or lease agreement
• Information concerning your care needs, welfare and ability to live independently at home
• Particular additional needs (‘reasonable adjustments’) or conditions that our staff should be aware of when visiting your home, communicating with you by other means, or providing services to you
• Other agencies involved with your household, where these have relevance to Abri’s role as landlord
• Details of safeguarding risks to children or vulnerable adults (for more information please contact us and ask for a copy of our Anti-Social Behaviour Policy)
• Financial details – bank or building society account details to enable Direct Debit payments; credit ratings
• Information and proof regarding household income, expenditure and debts
• Proof of local connection
• Rent statement from previous landlord (when applying to rent an Abri home)
• Responses to surveys, whether fact based or concerning your opinions (though in most cases these will be anonymised)
• Photos (either for use in identifying you as our tenant or occupier; or with your consent for promotional purposes)
• Copies of ID documents
• Whether you are related to, or are yourself an Abri employee
• Your immigration status and whether you have a right to reside in the United Kingdom
• Your previous tenancy history including whether you have been evicted for anti-social behaviour (ASB) or had complaints made about you for ASB
• What household items you have that will enable you to furnish and use your new home comfortably and to meet your basic needs
• Whether you drive a commercial vehicle
• Whether you have pets
• Information about your use of the property let to you, that allows us to determine whether you may be in breach of your tenancy agreement with us
• Information about your ability to use digital communication channels
• Your dietary requirements or preferences

We also process special categories of information (sometimes called ‘sensitive information’) that enable us to provide services and accommodation that will meet your needs, protect your interests and those of others who live in Abri homes and nearby communities, and also to comply with our legal obligations under Equalities Legislation. These special categories may include:

• Physical or mental health and disability information, any special adaptation needs you may have as a result of these, and your role as a carer for others in the household.
• Whether you are pregnant
• Criminal offences, alleged criminal offences, and unspent convictions, including details regarding domestic abuse, harassment and illegal drug usage
• Equalities data, including ethnic origin, religious belief, sexual orientation and transgender status

We collect the personal data of the children who live in Abri homes so that we know who all our customers are, tenants and occupants alike, and can fulfil our obligations as landlord to everyone who lives there. We rarely collect more information than name and age of these children but to the extent that they may occasionally be mentioned in our customer contact or case records (because of information we have been given by our adult customers) we do also have this information on our records too. Sometimes we also invite customers to apply to participate in Abri funded community activities or services, or to take advantage of our careers related services. If children in your household wish to take part we will

then collect data that is relevant to these activities/services too. This may include: details of their school, education, hobbies and sporting interests, and any medical conditions, disabilities or impairments that may affect their ability to participate, or require us to make appropriate adjustments to improve access.

If it comes to our attention that any children living in our homes are at risk we will also process the data necessary to provide a referral to Children’s Social Services.

Incidental inclusion of children’s data in our records will sometimes occur as a result of our use of CCTV in the communal areas of our estate and by use of noise recording apps which are provided to customers who have complained of sustained noise disturbance. In all of these cases customers in the locality (including those who are parents or guardians of the children whose data may be captured) will have been given notice of the recording (by signage for CCTV or by letter for neighbours likely to be affected by the noise recording apps) The lawful basis for such recording is the legitimate interests of Abri, as a social landlord, in maintaining residential space that is safe, secure and as free from unreasonable disturbance as possible for the customers that live there.

The CCTV systems installed across our buildings and sites are for safety as well as anti-social behaviour and crime prevention and detection . Clearly visible notices are provided where CCTV is used in public or communal areas. If we deploy dummy CCTV devices for deterrence only, we will not post signage that gives the false impression that the device is used to record images. In rare instances operational CCTV may be deployed in private areas (eg private gardens and porches , directed away from public or communal spaces) without signage for legitimate legal reasons i.e. in cases of ongoing serious ASB, domestic violence or other criminal actions perpetrated against a particular household. In the latter case the customer is loaned a device and is in control of the footage collected. As a private individual the customer does not need to use signage whn collecting CCTV only from their own private space.

The reception area and interview rooms of certain Abri corporate buildings have CCTV and optional voice recording facilities which will only be activated with your knowledge (usually by use of notices).

CCTV images can be shared with lawyers, police and other agencies working to prevent or investigate crime, improve public safety or resolve antisocial behaviour.

CCTV images may also be shared with insurance companies for the purpose of determining liability for damage or harm caused by an incident involving those shown in the footage.

Abri has a CCTV policy which can be accessed on request.

Vehicle dashcams

Abri vehicles are equipped with forward facing dashcams that record movement in front of our vehicles when the motor is turned on. These cameras are intended to help us manage insurance claims and allegations of poor driving made against any Abri colleague driving one of our vehicles.

We collect information about you throughout our relationship. This includes:

• When you apply for a home
• When you sign a tenancy, shared ownership, lease or tenancy exchange agreement
• Through ongoing contact with you during a tenancy or lease
• When you access services by logging onto our website or customer portal
• Recording information from calls, on-line chats and direct face to face contact with us
• When you terminate a tenancy or the resale process
• If you make a complaint
• When dealing with anti-social behaviour (ASB) issues, which you or one of your neighbours has raised
• When we provide welfare & benefits advice or support
• When you respond to our surveys
• If you enrol as a member of our Community Pantry or Good Grub Club schemes
• If you sign up for meal delivery services
• If you get involved with residents’ scrutiny discussions
• If you consent to your contact details being referred to us from third parties you engage with
• Open Source channels – public websites, and social media channels when researching digital capability

In some cases, we may collect information about you from third parties, such as your next of kin or authorised contacts, local authorities (e.g. social services or occupational therapists), other landlords, medical and health services, third party websites (e.g. AirBnB) the police or neighbours (in the case of complaints or concerns raised about you).

We process personal information to enable us to manage our business of providing social and affordable housing, accommodation and services, which may include any of the following:

• Letting, renting, leasing and selling properties (including shared ownership, right to buy and right to acquire)
• Managing tenancies and leases
• To facilitate tenant mobility by enabling mutual exchange of rented properties
• To facilitate your access to third party financial credit services eg. hire purchase of household goods
• Maintaining and repairing our rented or leased properties
• Ensuring our properties meet all applicable build and maintenance standards, and are equipped to meet appropriate telecommunications and energy efficiency standards.
• Collecting and receiving rent (including arrears), service charges and charges for additional services;
• Administering waiting lists
• Providing certain welfare and benefit related services, advice and support
• Maintaining our accounts and records
• Provision of customer service
• Ensuring that our properties are kept in good order
• Training and monitoring service provision
• Monitoring and resolution of anti-social behaviour and disputes
• Safeguarding of children and vulnerable adults who live in or nearby our properties
• Ensuring the protection of our staff, contractors and those other tenants or visitors to our properties who may be affected by criminal or anti-social behaviour
• Investigating complaints and allegations of breach of tenancy
• Providing independent and supported living services
• Providing/facilitating access to community based activities eg sports and fitness
• Fraud and money laundering prevention.
• Processing requests from third parties dealing with e.g. council tax, shelter, homelessness
• Better understanding your needs and those of our other tenants or people who will live in proximity to you
• For ensuring that our staff are always properly informed and equipped to provide the services you are entitled to receive, in a way that addresses both your needs and theirs.
• Making organisational improvements
• Engaging with our customers to get feedback on our current services and any improved or expanded service offers which we may provide or procure from others for your benefit in future
• Providing details of promotions, opportunities and special offers which may be of interest to you (with your consent, where appropriate)
• Signposting you to services that may help you meet your tenancy commitements to us, including specialist employment and training services
• Getting in touch with you via phone, SMS, email, post or the customer portal
• Receiving contact from you regarding our cafes, venues and food pantries via social media messenger apps
• Complying with our legal obligations, including health and safety.
• Providing optional additional safety and wellbeing services to those who live in our properties
• Managing legal risk and obtaining legal advice/representation where necessary
• Responding appropriately to public health emergencies
• Making strategic decisions based on evidence regarding levels of affordability among our customer-base
• Tailoring our communication channels to balance customer contact preferences with Abri’s need to communicate effectively with customers.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research, surveys or statistical purposes in which case we may use this information indefinitely without further notice to you.

Who may provide us with information about you

Occasionally we are provided with information about you by third parties. These may include:

• The Fire Service – in relation to safe and well visits, or after attendance at an emergency call-out at your home
• The Police – in relation to anti-social behaviour, criminal offences, or to verify/check details of unspent convictions or sex offender registration at time of letting a property or extending a tenancy
• Local authority social services – in relation to care needs or safeguarding matters
• Local authority home-finder services – in relation to applications for an Abri home
• Local authority housing services – in relation to threatened homelessness
• Specialist tenancy support service providers – Housing First – if your tenancy is supported by them
• Credit reference agencies
• Letting agencies – in relation to allegations of unlawful sub-letting
• Agencies involved in providing specialist support services for employment and career advice, and related training
• Neighbours or other members of the public - who are reporting alleged anti-social behaviour or other issues affecting your tenancy
• Private investigation agencies, whom we have commissioned to help us with the collection of evidence relevant to legal proceedings
• Any person that has been appointed by you under the Abri ‘Authority to Discuss’ procedure – allowing them to speak on your behalf about matters designated by you
• Any person who is designated under a Power of Attorney to speak or act on your behalf

Occasionally we are provided with information about you by third parties. These may include:

• The Fire Service – in relation to safe and well visits, or after attendance at an emergency call-out at your home
• The Police – in relation to anti-social behaviour, criminal offences, or to verify/check details of unspent convictions or sex offender registration at time of letting a property or extending a tenancy
• Local authority social services – in relation to care needs or safeguarding matters
• Local authority home-finder services – in relation to applications for an Abri home
• Local authority housing services – in relation to threatened homelessness
• Specialist tenancy support service providers – Housing First – if your tenancy is supported by them
• Credit reference agencies
• Letting agencies – in relation to allegations of unlawful sub-letting
• Agencies involved in providing specialist support services for employment and career advice, and related training
• Neighbours or other members of the public - who are reporting alleged anti-social behaviour or other issues affecting your tenancy
• Private investigation agencies, whom we have commissioned to help us with the collection of evidence relevant to legal proceedings
• Any person that has been appointed by you under the Abri ‘Authority to Discuss’ procedure – allowing them to speak on your behalf about matters designated by you
• Any person who is designated under a Power of Attorney to speak or act on your behalf

Where it is necessary to share information about you, we will always comply with all aspects of Data Protection Legislation. Set out below are examples of when this may occur.

Some of your information will be accessible by colleagues who need to see that information in order to carry out their roles, and with those parts of our organisation that are involved in supporting our services to you. Sometimes, we appoint third parties to do work for us which may involve them processing your data on our behalf.

Occasionally we need to share personal information we hold about you with others, including next of kin (particularly in emergencies or when we urgently need to carry out gas safety inspections and are struggling to fix an appointment with you), or with anyone who has been designated by you as authorised to receive information in specific circumstances, or to help you manage your account with us.

Sometimes, we may need to share your information with other organisations. We will only do so when reasonably necessary, and when we have a lawful basis, either because you have consented, or the Data Protection Legislation enables us to do so for another reason, for example because we need to do so in performing our landlord obligations or because it is on our legitimate interests to do so in running our business effectively and efficiently. Occasionally we share your information because we are compelled to do so, for example, because a court has ordered it, or because we have to do so under law.

Where reasonably necessary and lawful, we may share certain information with:

• Contractors (who carry out repairs and maintenance, safety work, surveys, inspections and property improvement assessment and works,)
• Specialist IT service providers that help us to safely store, process and back-up our data
• Providers of residential building security systems
• Archiving and data management service providers
• Out of hours emergency customer contact services
• Local authorities (including homelessness units, social services, occupational therapists and council tax depts)
• Organisations providing specialist tenancy support services eg Housing First.
• Agencies involved with benefits and tax credits (including the DWP and Pensions service)
• Organisations which provide educational and career-based training (always with your consent)
• Other registered providers of social housing providing tenancy in respect of support services (always with your consent)
• Other registered providers of social housing or landlords in the context of a stock disposal or acquisition, sale, acquisition or partnership agreement in respect of some or all of our business
• Other leaseholders in the block where you live when required to do so as part of our obligations under the Building Safety Act 2022
• Support service providers with whom you have contracted directly
• Organisations that provide community-based sports, fitness or wellbeing activities to adult or child customers (always with the consent of the participant or their parent, if under 16)
• Charities and voluntary agencies (always with your consent)
• Health services (including GP) (always with your consent, unless in case of a life-threatening emergency)
• Police and law enforcement agencies eg in respect of anti-social behaviour or suspected crimes
• Parking enforcement service providers
• The Financial Conduct Authority and HMRC
• Probation services
• Emergency services
• Anyone you have appointed as your authorised contact for management of your tenancy (under your standing consent), or who is formally registered (by the Office of the Public Guardian) as your lawful attorney under a Lasting Power of Attorney
• Designated Tenant Panel for review and resolution of formal complaints (always with your consent)
• Home service and care providers
• The NHS Trust which employs you if you rent accommodation from us connected to your work with the NHS.
• Other landlords (always with your consent, where a reference is being provided)
• Utilities companies eg where you have ended your tenancy but failed to pay your bill
• Insurance companies
• Courts and tribunals eg. where we are filing or defending a claim, or where an order is issued for disclosure to the court
• The Regulator of Social Housing
• The Housing Ombudsman in the context of complaints you have raised
• Central government departments (eg. the Department for Energy Security and Net Zero)
• Auditors
• Debt collection agencies
• Credit reference agencies, to facilitate social housing fraud checks
• Survey and research organisations
• Press and the media (always with your consent)
• Financial service providers and advisors
• Mortgage administrators and lenders
• Solicitors
• The Land Registry

In some cases these third parties are simply carrying out work on our behalf and to do this they need certain personal information of customers. In such cases we appoint them to do this under contracts that contain data processing clauses which safeguard the data rights of our customers.

We collect, use and occasionally share your information for reasons which are recognised as lawful. These include:

1. The performance of our landlord’s obligations under your tenancy, lease or shared ownership contract with us; or other service contracts we may have with you.
2. Compliance with obligations imposed by law on us as landlords and as an organisation that processes financial payments.
3. Protecting the vital interests of our customers, staff or contractors when their life, health or well-being are seriously at risk.
4. The performance of a task carried out in the public interest e.g. safeguarding of children and vulnerable adults.

5. Our legitimate interest in:

• Preparing to enter into a contract with you (tenancy, shared ownership or lease) including all necessary due diligence and disclosure which is made at the time of your application for an Abri home.
• Ensuring that we are able to meet any specialist housing or support needs that you reasonably require.
• Growing our business through new housing stock acquisition or merger, or reshaping and refocusing our business through housing stock disposal.
• Taking due care of our housing stock.
• Making improvements to the energy efficiency of our properties.
• Ensuring that payment due for rent, service charges, utility bills or council tax incurred while living in our housing is paid by our tenants, former tenants, lessees and former lessees.
• Ensuring that payment due for rent is covered by Universal Credit payments to the extent of the customer’s entitlement.
• Prevention of fraud or other criminal activities that might cause harm to our business or to our customers or contractors, e.g. by using photos to identify our customers.
• Helping to make the communities where our tenants or lessees live, safe and secure environments, reducing the impact and incidence of anti-social behaviour and noise nuisance.
• Protecting the viability of our business, so that we can continue providing affordable and social housing to people who need it.
• Contributing to the government’s and local authority’s efforts to reduce homelessness within our communities.
• Taking legal advice or bringing/defending legal proceedings.
• Ensuring that our properties are not sub-let in breach of tenancy.
• Facilitating the wellbeing of our colleagues and customers.
• Enabling others (e.g. our customers or contractors) who have sustained damage or harm to take lawful action to recover damages or other forms of compensation and to seek other legal redress for their loss.
• Ensuring that our staff are always properly informed and equipped to provide the services you are entitled to, in a way that addresses both your needs and theirs.
• Making strategic or operational decisions that are based on survey, consultation or other forms of evidence (that sometimes requires profiling techniques to be undertaken) regarding customer preferences, levels of affordability or need among our customer-base.
• Providing Shared Ownership customers with information about their options to ‘Staircase’ upwards the proportion of their share in the value of the property they own.
• Providing incentives to customers to consider taking tenancies in locations that are harder to let for various practical reasons.
• Communicating efficiently and effectively with our customers on all routine matters that are essential to the running of our business and the provision of landlord services.
• Enabling customers to access grants, specialist advice on welfare benefits and debt management so they can better manage their income and pay their rent and service charges.
• Assisting customers to manage and where necessary challenge the accuracy of their utility bills so they can better manage their income and pay their rent and service charges.
• Running events and setting up services in our communities that are intended to improve levels of wellbeing among our customer-base.
• Ensuring we have contact details for use in emergency situations of a person (the next of kin of the customer) who may be informed of the emergency.
• Keeping copies of call recordings for training and quality monitoring, and to allow customers to access those recordings (for a limited time).
• Making appropriate compensation payments when a customer complaint has been upheld.
• Managing the physical security of our corporate buildings and running an efficient pre-booked parking arrangement, and ensuring that untaxed or abandoned cars that are found in or around our properties are reported to the police or local authorities as appropriate.
• Ensuring that controlled parking schemes in/around our estates are run efficiently.
• Ensuring that our properties meet reasonable standards of energy efficiency and working with third party experts and fund administrators to enable required improvement work to be carried out.
• Keeping our customers informed about important events in their communities, service changes, opportunities to become involved in our business; eliciting engagement in initiatives that are intended to promote wellbeing and inclusion in our communities.
• Responding to enquiries regarding our café, venue and food pantry services.

In some cases above the interest is recognised as legitimate under the Data Use and Access Act 2025; in other cases however, Abri makes a legitimate interest assessment that documents our finding that the processing is legitimate when balanced against the interests of the data subject.

6. when you have provided us with your consent (verbal or in writing) , eg. to allow us to send you information about non-essential services and opportunities that might interest you. For more information on consent see page 15 of this Notice.

When we have collected sensitive information, we need additional special reasons for doing so and these might include:

7. Your express written consent.

8. It is necessary for social protection, being intended to reduce risk to customers which flow from old age, ill-health or disability.

9. It is necessary for bringing or defending a legal claim.

10. It is in the substantial public interest, for example in respect of measuring and monitoring performance against equalities standards.

Abri has a Special Category Data Processing Policy that sets out in greater detail how we justify using sensitive data in specific situations. Please contact us at abridataprotection@abri.co.uk if you would like to know more about this.

Use of AI Tools

Abri, like most organisations, has begun to use AI tools to improve services and optimize the cost efficiency of our business. The AI which we (and our contractors) use does not process customer personal data unless unless these tools are:

• Enterprise versions (where model training is disabled by default).
• Local AI models (where data will not go beyond our and/or our supplier’s network).

The software used in our customer survey feedback analyses sentiment by natural language processing techniques to focus on indicators in use of language to determine how customers feel about our services. By understanding grammatical structures, verbs and nouns and the sequences in which they appear, the Sentiment Engine provides an ‘emotional response indicator’.

We will always keep your information in accordance with the law and any applicable regulation, and we’ll never keep your information for longer than is reasonably necessary.

Your basic tenancy or lease information (i.e. your name, date of birth and address while a tenant of any landlord within the Abri Group) will be stored permanently against any tenancies you have had with us but once your tenancy has ended, we aim to delete all other information between six and seven years after your tenancy has ended, although certain data will be deleted sooner than this, for example:

• Rent and service charge records will be deleted after 7 years from their creation.
• Anti-social behaviour files will be deleted 6 years from the closure of the case
• Resident consultation surveys are kept for 5 years from the survey

Recordings of certain telephone conversations are held for a period of time which will not exceed six weeks unless they are deemed abusive or threatening, or if they contain content which is relevant to an ongoing investigation, in which case they will be kept until all relevant investigation actions are complete.

CCTV footage is usually kept for no more than 8 weeks, unless we have been asked by the police, or by others who have an interest in viewing the footage for the purposes of a legal or insurance claim, to keep the footage for longer so that it can potentially be used as evidence in the determination of a claim. In this case we will retain a copy of the footage until the police prosecution , legal or insurance claim has concluded.

Dashcam footage is only retained for 24 hours unless an accident or incident has been logged to which the footage is relevant, in which case it will be kept for a period of time that allows us, our insurers or the police, to conclude any investigation, and/or to resolve any legal claim made by or against us in respect of the accident or incident, plus an additional 6 years.

Back-Ups

All our data is backed up regularly as part of our measures to ensure compliance with your right to have your data kept secure and protected against any threat to its integrity. Data held in our back-ups may exceed the retention period set for the same data when it is part of our live systems. This is because our back-ups are kept for 7 years, no matter what the particular retention period applicable to individual records held within them. However, acting in accordance with ICO advice, we believe that these comply with our legal obligations towards our customers because:

• While held as back-up this data is deemed ‘beyond use’; and
• If the back-up files are ever restored to live systems (e.g. in the case of a cyber incident affecting the integrity of our live records) we will undertake sanitization of the restored data to delete from it any data which is either beyond its retention period, or should be deleted because it formed part of a customer record that was erased under the customer’s right of erasure (see below).

We take the security of your data seriously, and we have internal policies, controls (electronic, physical and managerial) and procedures in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed unlawfully to others, and is only accessed by our colleagues in the proper performance of their duties. These security measures include:

• Limiting access to our building to those we believe are entitled to be there (by the use of key card passes and ID Badges)
• Implementing access controls to our technology and devices, such as firewalls, ID verification, and encryption.
• Implementing strict procedures which limit access to your data only to those staff or contractors who need to see it in order to carry out their jobs and/or deliver services to you.
• Never asking you directly for your passwords.
• Training and testing our staff to recognise and act appropriately in the event of cyber attacks of different kinds, including ‘phishing’.

If you are registered with our customer portal, you are the owner of your username and password and must not share this information with anybody else. We also advise you to use a different complex password for any online service you use for your own protection.

It may sometimes be necessary to transfer personal information outside the UK as a result of our requirements for data hosting services. If we do this your personal information, will continue to be subject to appropriate safeguards as set out in Data Protection Legislation.

We will sometimes provide you with links to other websites, but these websites are not under our control. We will not be liable to you for any issues arising in connection with their use of your information, the website content or the services offered to you by these websites. Therefore, we would advise you to consult the privacy policy and terms and conditions on each website to see how they may process your information.

In addition, when using other digital platforms such as Facebook and social networks to communicate with us, please remember it is your responsibility to set appropriate settings on your accounts so you are comfortable with how your information is used and shared on them.

As a customer and data subject under data protection law, you have certain rights as summarised below. In general we will treat any requests to action these rights with respect and with due regard to the need to carry them out without delay, and within a 30 day period from the request. Please note however that further time may be allowed for completion if:

1. the scope of your request is unclear, (allowing the 30 day period to start from the date when clarification is received by us);

2. you have not proven your identity as a data subject (allowing the 30 day period to run from the date when identification is received); and/or

3. your request is complex, or one of a series of requests made by you in a relatively short time period (allowing us to complete the request within a total of 3 months from the date it was made).

Your request can be submitted through our customer portals or it can be emailed to abridataprotection@abri.co.uk To find out how else you can contact us, please visit our website.

Access to your personal information

You have the right to a copy of the personal information that we hold about you. This is often called a Subject Access Request (SAR), and there are limits to this right, such as where the disclosure of the information would unreasonably impact the data protection rights of a third party, or is subject to another recognised exemption eg. legal professional privilege. Where we rely on an exemption to withhold information from your SAR we will tell you that we have done so and why.

Before providing personal information to you or another person on your behalf, we will ask for proof of identity and information about your interactions with us so that we can locate your personal information.

Correction of your personal information

If any of the personal information we hold about you is inaccurate or out of date, you can request that it be corrected or updated. Or you can amend it yourself by logging in to the customer portal and editing you records.

We rely on you and any third parties from which we source information about you to provide information that is correct, and to inform us as soon as possible of any changes that affect the accuracy of that information. It is particularly important that the contact details we have for you, and anyone that you have consented to us sharing information with about you, remain up to date.

Right to object to our processing of your data

If we rely on our legitimate interests as a basis for processing (which includes sharing) your personal data, you have the right to object to our continued use of that information, unless we can show that there is a compelling reason for the processing to continue or we are bringing or defending a legal claim. For instance you may decide to object to our use of your data to issue periodic surveys or newsletters. Unless the survey is one we need to send to you by law, we will then apply an ‘opt-out’ to your account in respect of future surveys, or newsletters, in accordance with your wishes.

You also have a right to object to any profiling undertaken for which we use your personal data, or against any automated decisions taken on the basis of such profiling. We will consider such objections in light of the law and our own business rationale for doing so and will inform you of our decision whether to accept the objection or not.

Right to erasure of your personal information

You have the right to ask us to erase your personal information if:

• there is no longer a lawful reason for us to use it (including when you have withdrawn consent);
• our original purpose in processing that data no longer exists, and no other purpose has replaced it;
• you have objected to our processing of the information and there is no overriding legitimate interest for us to continue the processing; or
• the personal information has to be erased in order to comply with a legal obligation

We can refuse to erase your personal information in certain circumstances, including, when:

• we have an overriding legitimate interest in continuing to process it;
• we have to comply with a legal obligation that requires us to continue processing that information
• we need to do so as part of a task we are carrying out in the public interest; or
• we need the information as part of a legal claim that we are bringing or defending

If we proceed with an erasure request, having considered the factors set out above, we will delete the data from our live-systems and from any hard-copy filing systems we use without delay. If we have appointed data processors to handle any of your data that needs to be deleted, we will contact them and ensure that they too delete the affected data. In respect of data held on our back-ups, please see the section above.

Right to data portability

You have the right to receive and reuse your personal information which you have provided to us, for your own purposes across different services. This applies where the processing is based on your consent or for the performance of a contract and when processing is carried out by automated means.

Right to restrict processing

You can tell us that you do not wish us to process certain personal information related to you for example if you believe it is not accurate, or you feel it is unlawful or being used for a purpose different to what you were told we would use it for. You can also tell us that you do not wish us to process information relevant to your ethnic origin, sexuality, health or disabilities or religious beliefs for the purpose of monitoring equality of opportunity or treatment.

Consent

In some circumstances, your consent is the legal basis for us using your information.

Consent must be freely given by you for a specific purpose; we will always clearly explain why we need the information we have asked you for. Consent must be clearly given; so, we never assume your consent, or use pre-ticked boxes to communicate consent.

You have the right to change your mind at any time and withdraw your consent. The consequence might be that we can’t do certain things for you. Consent can be withdrawn using our customer portal, by emailing abridataprotection@abri.co.uk or by writing to us at the address given below.

We always ask for the consent of a parent when we wish to share the data of any child (under 16) where the processing itself is based on the provision of consent. However in some cases we are obliged to disclose children’s data under a legal obligation eg. a safeguarding referral to Children’s Social Services.

Right to Make a Data Protection Complaint

If you believe that Abri has not complied with data protection law in the way it has collected, used, shared or protected your personal information; or if you feel we haven’t met our obligations with regard to the fulfilment of your rights (eg. Subject Access Request disclosure), you have the right to make a data protection complaint directly to us. We will acknowledge your complaint, investigate it appropriately, keep you informed where necessary, and tell you the outcome without undue delay. Details of how to make a complaint are provided in the "Contact Us" section below.

If you’d like to exercise any of these rights or have a question about this policy or the way your personal information is used, please contact our Data Protection Officer by one of the following means:

By emailing: abridataprotection@abri.co.uk

Online: through logging on to the My Abri customer portal

By Phone: via our Customer Experience Service Centre: by calling 0300 123 1567

By Post: Data Protection Officer, Abri Group Ltd., Collins House, Bishopstoke Rd., Eastleigh SO50 6AD.

If you are concerned about how we have handled your personal information, you have the right to make a data protection complaint directly to Abri. You can lodge a complaint about the handling of your data at any time by calling our Customer Service Centre on the phone numbers given above, by post, through the customer portal or by emailing abridataprotection@abri.co.uk.

We will acknowledge receipt of your complaint within the timescales required by law and will investigate and respond without undue delay. We may contact you for further information where necessary to understand or investigate your concerns.

We will inform you of the outcome of our investigation and any action that we propose to take.

If you remain dissatisfied after we have responded to your data protection complaint, you may refer the matter to the Information Commissioner (ICO), which is the UK's independent regulator for data protection. You can visit www.ico.org.uk or ring 0303 123 1113 to find out more.