Privacy notice

Hendre and its subsidiary companies Hafod Housing, Hafod Care and Hafod Resources are the “Data Controllers” of the personal data that you have provided to us or that has been disclosed to us by others, for example the Local Councils. We are required to manage your data in accordance with the Data Protection Act 2018 and The General Data Protection Regulation 2016/679. Our address is St Hilary Court, Copthorne Way, Cardiff CF5 6ES.

This privacy notice explains what information we collect and why, who we may share it with, how long we keep it, what your rights are in relation to it, and how you can contact us or the Information Commissioners Office (ICO) if you have any questions or complaints.

What information do we collect?

Whether you are a tenant, lease holder or service user we need specific information to make sure we meet our contractual obligations to you as either a landlord or care/support provider. We will use your information to deliver the service to you, for example to meet your care/support and accommodation needs.

If you are not a current customer but are applying to us for accommodation and or services, we will use your data to assess your application and measure this against our ability to deliver to your needs.

The information we will need you to provide us with, or which we may receive about you from others, will depend on the service we are providing to you. For example, we would require detailed health information if you are a resident of one of our care facilities, where as we would not require this information if you were a general needs tenant.

Others who may provide us with information about you include:

  • local councils and central government departments such as the Department of Work and Pensions
  • local authorities, health and social care professionals, previous care providers
  • previous landlords and credit agencies
  • home Office, local authorities
  • police and other public authority fraud departments and local authorities
  • other residents

We may hold some or all of the following information (this is not an exhaustive list):

  • your name
  • the name of any others who live with you in your property including children
  • date of birth
  • address
  • telephone number and email address
  • national insurance number and NHS number
  • benefit reference number and record of benefits
  • financial information other than debt history
  • bank account number and sort code
  • health information which may include care records
  • equality monitoring data (ethnicity, religion, gender, disability, marital status and sexuality)
  • any relevant criminal convictions and allegations of including antisocial behaviour
  • responses to surveys and research
  • employment
  • next of kin
  • photographs and CCTV
  • telephone call recording when you call our offices
  • notes and records on conversations and correspondence between us

Why we need this information and our legal basis

To assess your application and manage our contract with you

We use the information we hold about you to manage your tenancy, leasehold or support agreement and deliver the necessary services to you. This information is required for contractual reasons and consequently you are not able to choose whether or not you provide information for these purposes.

There are a number of situations where it is within our legitimate interest to use your data for specific purposes.  We have measures in place to ensure our legitimate interests do not outweigh your rights and freedoms. However, if you feel this isn’t the case you can raise your concerns with us.

We consider that in some circumstances we have a legitimate interest to ensure that:

  • our services/properties meet the needs of our customers/service users
  • we can contact residents in the event of emergencies and to carry out essential repairs
  • we communicate with residents to meet our business objectives, encourage social inclusion and help build communities
  • work with authorities and the police to support safer communities
  • Hafod remains commercially viable and protects its commercial and social assets
  • we have effective procedures for preventing, and managing, outstanding debt resulting from unpaid rents and charges
  • we make the most efficient use of our resources and we understand how we are performing; and
  • we understand our resident’s experiences and views so that we can effectively influence and contribute to debates on future housing strategies
To provide care and support services

As a provider of care and support services we process data about your health and social care needs to deliver our services that meet your assessed needs. We also process this information because it is necessary in the performance of our contract with you in order to fulfil our legal and regulatory obligations and where it is in our legitimate interests to do so.

Where we are providing care and support services as part of a local authority contract, we may share your information with the commissioning local authority or NHS trust.

To provide appropriate properties and services

We will use your information that relates to your health and social care to help us make any reasonable adaptations to our properties and services and to make them fit for purpose and accessible for everyone.  We also use this information to make sure we are protecting vulnerable individuals in our communities.

We do this to meet our legal and regulatory obligations, for example, The Equality Act 2010, and because there is a substantial public interest for us to do so.

Some of our processing is carried out to ensure we fulfil our legal and regulatory obligations in providing care and support services under the following:

  • Social Services and Wellbeing (Wales) Act 2014
  • Wellbeing of future generations (Wales) Act 2015
  • Mental Capacity Act 2005
  • Mental Health Act 1983
  • Care Inspectorate Wales for quality and safety
To promote community safety to safeguard individuals

We process personal data to promote a safer community environment; this can include information about anti-social behaviour, criminal activity and convictions.  We process this information because it is in our legitimate interest to do so and to prevent and detect unlawful acts.

We process information about safeguarding individuals, to fulfil our legal obligations and because there is a substantial public interest for us to do so.

To contact you about your property and other services

We will use your contact information to get in touch with you about issues relating to your tenancy or leasehold and to deal with any legal matters arising from it. This includes repairs and maintenance, rent collection, complaints and housing management issues, in the event of an emergency, or to enforce the terms of your tenancy or lease. We may do this by post, telephone, email, social media direct messaging and text message.

We may pass on your details to contractors that provide services on our behalf. This is so they can contact you to carry out essential services related to your property. We do this because it is necessary in the performance of a contract. Where we do not have the appropriate contact details for you, we may also try and source these externally from third parties or public sources of information.

We’re constantly working to improve our services.  One of the ways we do this is by listening to our residents and asking for feedback via surveys. These surveys are mostly carried out in house.  There are occasions when we will use an agency to carry out surveys on our behalf. In such cases, we pass on your contact details to them so that they can contact you and ask about our performance.  Some surveys will fall under the Housing Act 1996 and as such there is a legal requirement on us to use your data for this purpose. Other surveys will fall within our legitimate interests however you may opt out of further contact by letting the person requesting the feedback know that you do not wish to take part in any further surveys. Surveys may be sent by post, email and text message.

We may also use your contact details to keep you updated about Hafod events or other services which do not form part of our contractual landlord services which we feel may be of interest to you. This includes our e-newsletter, letting you know about things such as energy efficiency, housing options events and financial advice.  In some cases, it maybe in our legitimate interests to use your contact details in this way or we may require your consent. You can always opt-out of further contact by simply selecting the opt out button in the email or text.  You can also opt out in writing by sending your request to Hafod, St Hilary Court, Copthorne Way, Cardiff CF5 6ES.

To provide health and social care treatment

We process your information so that we can provide the service we have been asked to provide.  Some of our processing is carried out to fulfil a contract or an agreement we have with you.  Where we require information because it is necessary in the performance of a contract you will not be able to opt out of providing this information.  This is because without it we would be unable to provide you with the service you have asked us to undertake.

To monitor equality, diversity and inclusion

We may ask you to provide us with your diversity data (ethnicity, religion, disability, sexual orientation). This information is not used to make any decisions about you individually, but is for statistical purposes to help us understand who is living in our communities.  It helps us to ensure fairness and equality in the services we provide, and allows us to fulfil our legal and regulatory obligations.  You do not have to provide this information but it helps us if you choose to do so.

To prevent and detect fraud and illegal subletting

We process some personal data to guard against fraud and illegal subletting, for example proof of identity.  Failure to provide any information we require in relation to this could put your application or tenancy at risk. We process this type of information to fulfil our legal obligations and to prevent and detect unlawful acts.

For profiling purposes

We use some of your personal data to create a profile so we can identify Hafod services that might be of interest or helpful to you. For example, if information suggests that you may be having some difficulties with managing your finances or we think you might encounter difficulties in the future we can direct you to our Smart Money Team. Alternatively, if our information suggests that you might be a vulnerable tenant because of age or ill health we may offer you additional support.

We do not use automated profiling or automated decision making to make any decisions on your application, tenancy or leasehold.

To support research and analysis

We may use your personal data to carry out internal research and analysis.  We do this to develop and improve services and to help us understand trends within the housing sector.  We process information based on our legitimate interests for these purposes.

Data Processors

We also disclose some information with our data processors. These are organisations that carry out a service on our behalf.  This includes repairs and maintenance, gas servicing and debt collection.  We only share information which is necessary for them to carry out the service they have been contracted to provide.  All our contractors operate under the terms and conditions of a legally enforceable contract and will not use your information for anything other than carrying out a service on behalf of Hafod. We do this based on our legitimate interests.

Welsh Government Housing Regulation

We share information about social housing letting data with the Welsh Government Housing Regulation.  It is a regulatory requirement for all registered social landlords to provide this data as per The Regulatory Framework for Housing Associations Registered in Wales.  The Regulation Framework is a non-statutory Code of Guidance which we are obliged to follow.

The data sets we share includes information on lettings, type of tenancy, rents and charges, demographic information about tenants (including special category data and criminal convictions) and financial information.  The data set does not include names or addresses but does include the unique property reference and the full postcode.

The information is used for research and statistical purposes to allow the Welsh Government to exercise their role in providing adequate social housing.  The information cannot be used for any other purposes, such as making decisions in relation to specific residents.

We share information because it is necessary for the performance of a task carried out in the public interest and/or for reasons of substantial public interest.  Individuals are not able to opt out of this process.

If you require further information please visit their website

Who may we share your information with?

In certain circumstances we may share your personal data with specific organisations. This may also include those organisations sharing information they hold about you with us. These organisations may include the following:

  • local council and government departments
  • health and Care services
  • police and other law enforcement agencies
  • electricity, water and gas companies
  • social Housing Regulator
  • MPs and Councillors acting on your behalf
Experian and the Rental Exchange Programme

We share some of your personal data with Experian, a consumer credit reporting agency.  This is to help us prevent and detect fraud and illegal subletting and to manage our rental arrears.  We also receive information about you from Experian and for the same purposes.  We process this information to fulfil our legal obligations and to prevent and detect unlawful acts.

As part of the Rental Exchange Programme, we share your rental payment history with Experian.  This programme allows tenants with a poor credit history or no credit history, who are paying their rent on a regular basis, to build up a credit score and access more beneficial finance e.g. better deals on credit cards or loans.  You can opt out of the Rental Exchange Programme at any time by contacting us.  You can call Hafod and we will opt you out.

We exchange information as part of the Rental Exchange Programme because it is in our legitimate interest to do so.

Failing to keep up with your regular payments could affect your credit rating.

If you would like more information you can visit or call Experian on 0115 9410888 and ask for a copy of the Rental Exchange Programme.


We do not usually gather information directly from children as part of our core landlord or care services. We may process information relating to children in your household where it has been provided to us during our relationship with you. This is usually limited to name, date of birth and gender.  In such cases, we process that information based on our legitimate interest and to fulfil our legal and regulatory obligations.

Recording telephone calls

We may record your telephone calls to our Head Office, for training and monitoring purposes and to make sure we’re delivering a good service. We process data in this way because it is in our legitimate interests to do so.

Contacting us by telephone

When you contact us by telephone your telephone number may be added to your account so that we can contact you in future.

We may also use a mobile telephone number listed on your account to text you regarding emergencies, appointment reminders and service updates.  We may also send you satisfaction surveys (you will be given the option to opt out of the text messages).

Contacting us by e-mail

If you e-mail us, we will respond to you using the e-mail address you gave us. Please try to avoid sending personal data by e-mail as this is not considered to be a secure communication method. Your e-mail address will be added to your account and may be used for future communications. E-mails are deleted in line with our retention rules.  Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.


We have installed CCTV systems at some of our schemes, estates and offices. We use CCTV to deter criminal activity, antisocial behaviour and to protect our properties, residents and communities. It is in legitimate interest to do so. CCTV footage may be disclosed to the police or Courts.

Marketing and research

To support research and analysis

Hafod carries out a number of different research and analysis projects in order to develop and improve services and to help us understand trends within the housing, support and care sector.

We may use your personal data to carry out research but in most cases we will only require anonymous data. This may include contacting you by email, text, or post to take part in this work. We may where you have consented, contact you to seek further views and opinions. In some circumstances we process information based on our legitimate interests for these purposes.

For each research project you will be provided with an information sheet, which will explain in more detail the type of information that will be collected, details of any partnership working and how this information will be used and retained.

Our Research and Innovation department also operates under the guise of Side-by-Side Innovation. You may receive correspondence from Side-by-Side Innovation in relation to research and analysis projects, which is directly affiliated with Hafod.


We will only send you marketing by email or text message if you have consented to this. We may send marketing by post. You can opt-out from receiving marketing at any time by using the link in the communication or contacting us by post or telephone.

Keeping Your Information Safe

When you contact our offices, you will be asked to verify yourself by asking some security questions. This is to make sure we don’t disclose your personal information to anyone else by accident. If you want a relative or a support worker to be able to talk to us on your behalf, we will need you to sign a consent form to provide this authority.

We work hard to make sure the systems and processes we use to manage your information are secure. This includes regular training for all our people who may have access to your data and ensuring that our IT systems are frequently updated and tested to ensure they are secure.


Many websites places cookies whenever a user visits their site, in order to track traffic flows.  Cookies are text files, which identify your computer to the server.  Hafod may use cookies from time to time.  Please see our cookie policy.

Links to Other sites

Our web sites and blog may contain links to other web sites.  We are not responsible for the privacy practices of such sites.  When you leave our site please read the privacy statement of each and every website that collects personal data about you.  This privacy policy applies solely to information collected by Hafod.

How long do we keep your personal information?

We will not keep your information for any longer than is necessary for the purpose we need to use it for.  We have a weeding and retention schedule and delete information according to our legal and statutory requirements. For Housing records we comply with the National Housing Federation weeding and retention schedule and for care records we retain for 7 years from the time our services cease.

Transfer outside the UK

We do not transfer or process your information outside the European Economic Area unless we have specific consent or where the nature of the processing requires it (for example you have chosen to use an email or other communications service which routes data outside the EEA)

Your privacy rights

You can object or withdraw your consent to the use of your personal data at any time.  In some situations we may not be able to provide your requested service where the information processing is an integral part of the service we provide.  We will tell you if this is likely to be the case.

Subject to some legal exceptions, you have the right to:

  • request a copy of the personal information Hafod holds about you
  • to have any inaccuracies corrected
  • to have your personal data erased
  • to place a restriction on our processing of your data
  • to object to processing; and
  • to request your data to be ported (data portability)

Please address any such requests to Hafod’s Data Protection Officer through  or write to The Data Protection Officer, Hafod, St Hilary Court, Copthorne Way, Cardiff. CF5 6ES.

If you are not happy with our response, you have the right to appeal directly to the regulator – the Information Commissioners’ Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.  Telephone 0303 1231113 Email

We make sure our privacy notice is kept up to date.  You can find the latest version on our website (  If you would like a hard copy please e-mail or write to The Data Protection Officer, Hafod, St Hilary Court, Copthorne Way, Cardiff CF5 6ES.