Data controller
Thirteen Group, 2 Hudson Quay, Windward Way, Middlesbrough, TS2 1QG
Data protection officer
Lyndsey Marron, email: data.compliance@thirteengroup.co.uk
Privacy notice
This privacy notice tells you what to expect when Thirteen processes personal information. It applies to information about applicants, customers and other service users. Thirteen is the Data Controller, joint controller or Data Processor of personal information depending on the service.
Why do we collect and store personal information?
We need to collect, process and store personal information about you to fulfil our obligations as a registered provider of social housing, and to deliver efficient and effective services including contracted services we are running.
Information we may hold about you and how we use this
The information we hold on our records concerns our relationship with you. For example:
- we hold names and dates of birth, photographic ID and information about your previous housing circumstances to assess housing applications – we will only hold this information as long as required to assess your housing need in line with our retention policies.
- with relation to contracted services we run, ex-offender information is stored in order to offer the accommodation and well-being service. Only necessary information is stored.
- we hold your contact details so we can communicate with you regarding customer service and essential contact messages.
- we record information about your needs and requirements to ensure our services are accessible; that we take account of any support needs in our dealings with you; and to improve our communications with you. For example, if you are involved with a carer or social worker, if you need adaptations in your home, if you need large print or translated text, if you are working with a probation officer etc.
- we record information to help us to deliver housing management services including reports of anti-social behaviour, complaints, change in circumstances e.g. if you have a medical need which means your housing needs change.
- we keep financial records about the amount of money you have paid us; any amount(s) outstanding and associated recovery action.
- we may hold information about you if you have already signed up to one of our additional guidance and support services. For example, in connection with access to training and employment, we may hold information about your job history, skills and experience, or if we are supporting you with your financial circumstances, we may hold information about your household income and expenditure.
- we will hold recordings of your telephone calls to us, as calls to and from our contact centre and Customer Experience teams, and occasionally other teams are recorded for training and monitoring purposes so we can ensure we’re delivering a good service*. If you are being recorded, you will be informed prior to the conversation and if you do not wish to be recorded you can contact us via email or letter instead.
- we may capture your image on our CCTV systems if you visit estate, office or community facilities which have CCTV cameras in operation*
- we may carry out insight and satisfaction surveys to help us to monitor our performance, to keep our records up to date and to improve our services to our customers. This information is stored in-line with our retention policies.
*Call recordings and CCTV recordings will be held in accordance with Thirteen’s Information Governance Framework, ICT Security Policy and CCTV Policy.
This list is not exhaustive, as we hold records of most contacts we have with you, or about you, and we process this information so we can deliver services to you.
Our legal basis for processing your information for all of the above purposes are:
- Contract: for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
- Legal Obligation: for us to comply with the law (not including contractual obligations)
- Vital Interests: to protect someone’s life
- Legitimate interests: for our legitimate interests, or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests. Legitimate interests are those uses of personal data by a Data Controller that are deemed necessary (e.g. to provide the product or service) or reasonably to be expected by a data subject. A clear example of the latter is the basis of an existing customer relationship.
- Consent: You have given clear consent for us to process your personal data for a specific purpose.
Generally, the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you), but we may also hold information provided by third parties where this is relevant to your housing circumstances or the service, we are delivering to you e.g. from social workers and health professionals, MoJ, probation, employers/potential employers.
We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases, you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact on our ability to provide some services to you if you refuse to provide information that stops us from doing so.
How we manage your personal information
Processing of your personal information will be undertaken in accordance with the principles of the UK General Data Protection Regulation 2018 (GDPR 2018). Access to personal information is restricted to authorised individuals on a strictly need to know basis
We will treat your personal information fairly and lawfully and we will ensure that information is:
- processed for limited purposes
- kept up-to-date, accurate, relevant and not excessive
- not kept longer than is necessary
- kept secure.
We are committed to keeping your personal details up-to-date, and we encourage you to inform us about any changes to ensure your details are accurate. To help us to ensure confidentiality of your personal information we may ask you security questions to confirm your identity when you call us or when we call you.
We will not discuss your personal information with anyone who contacts us on your behalf, unless we have a legitimate reason to do so or you have given us prior written authorisation to do so. Anyone calling on your behalf may also be subject to security questions to ensure we’re taking adequate steps to protect your personal information.
We may apply notifications to your information (for example, in relation to your vulnerability or health status) to enable us to tailor and deliver services to you. Thirteen only holds records during the period of our relationship and for a set period afterwards to allow us to meet our legal obligations, including resolving any follow up issues between us.
Sharing your personal information
Normally only our employees are able to see and process your personal information. However, there may be times when we need to share relevant information with third parties for the purposes as outlined below, or where we are legally required to do so. When sharing personal information, we will comply with all aspects of the UK GDPR 2018.
Sensitive information about health, sexual orientation, race and religion, criminal records for example is subject to particularly stringent security and confidentiality measures
Where necessary or required, we may share personal information:
- with our contractors to undertake some repairs, maintenance or improvement works
- with third party service providers, in connection with services performed on our behalf. For example if we use a mailing house to distribute our newsletters or to undertake surveys on our behalf
- we use a system to review accounts which includes some profiling, which reviews rent history and other limited factors to complete automated text messaging and calls to prompt contact regarding arrears. We don’t AI or automation where a decision is required linked to any tenancy action
- our relationships with such providers are governed by our contracts with them which include strict data sharing and confidentiality protocols
- with other registered providers, trusts and landlords, in connection with tenancy references and associated enquiries
- with community partners in connection with the delivery of co-ordinated local services
- with Council Tax offices, to ensure billing details are correct
- with utility companies to ensure correct billing can take place.
information will be shared with authorised third parties to provide landlord services in partnership with us. Energy Angels act on our behalf to work with utility providers to ensure gas and electricity is readily available for new customers moving into their new home. - with credit reference agencies and debt collection agencies, in connection with some housing applications and in relation to any outstanding charges
- with local authorities and government departments as necessary for administering justice, or for exercising statutory, governmental, or other public functions
- with police and other relevant authorities (eg Probation Service, Department of Work and Pensions, HM Revenues and Customs) in relation to the prevention or detection of crime and fraud; the apprehension or prosecution of offenders and the assessment or collection of tax or duty
- with other statutory organisations, eg social services and health authorities, MP’s and Councillors as necessary for exercising statutory functions
- with the Regulator of Social Housing, to comply with our regulatory obligations
- with CORE - COntinuous REcording of Lettings and Sales in Social Housing in England, The Ministry for Housing, Communities and local Government (MHCLG) collect data on social housing lettings and sales via CORE for statistical purposes. Please see the CORE privacy notice
- this list is not exhaustive as there are other circumstances where we may also be required to share information, for example:
- to meet our legal obligations
- in connection with legal proceedings (or where we are instructed to do so by Court Order)
- to protect the vital interests of an individual (in a life or death situation)
International transfer of personal information
We do not envisage transferring any information about or relating to you to anyone who is located outside of the European Economic Area other than as indicated above and we have a commitment from our business partners and data processors that they too will honour this commitment.
Your rights
Right of Access
You have the right of access to personal information we hold about or concerning you. This is called a subject access request. If you would like to exercise this right, please visit the Data Subject Access Request page.
We have a subject access request form which you can use for this purpose and we ask that your request is accompanied by proof of identity. If you are seeking to obtain specific information (e.g. about a particular matter or from a particular time period), it helps if you clarify the details of what you would like to receive in your written request.
If someone is requesting information on your behalf they will need written confirmation from you to evidence your consent for us to release this and proof of ID (both yours and theirs).
We have one month to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible).
In response to subject access requests we will provide you with a copy of the information we hold that relates to you. This will not generally include information about your property such as repair logs, details of contractor visits, or general property maintenance information as this is unlikely to be ‘personal information’.
Right of Rectification or Erasure
If you feel that any data that we hold about you is inaccurate you have the right to ask us to correct or rectify it. You also have a right to ask us to erase information about you where you can demonstrate that the data we hold is no longer needed by us, or you withdraw the consent upon which our processing is based, or you feel that we are unlawfully processing your data. Your right of rectification and erasure extends to anyone we have disclosed your personal information to and we will take all reasonable steps to inform those with whom we have shared your data about your request for erasure.
Right to Restriction of Processing
You have a right to request that we refrain from processing your data where you contest its accuracy, or the processing is unlawful and you have opposed its erasure, or where we don’t need to hold your data anymore but you want us to in order to establish, exercise or defend any legal claims, or we are in dispute about the legality of our processing of your personal data.
Right to Portability
You have a right to receive any personal data that you have provided to us in order to transfer it onto another data controller where the processing is based on consent and is carried out by automated means. This is called a data portability request.
Right to Object
You have a right to object to our processing of your personal data including but not limited to direct marketing and profiling.
Changes to this privacy notice
This Privacy Notice is kept under regular review and was last updated in January 2026