Privacy Policy

Castles & Coasts Housing Association Ltd is committed to ensuring that your privacy is protected. 

This policy describes how Castles & Coasts Housing Association aims to repay the trust you have shown by sharing your personal data with us.

This privacy policy covers Castles & Coasts Housing Association's requirements under the Data Protection Act DPA (2018) and the General Data Protection Regulation GDPR (2016) and all future legal acts.


About us

Castles & Coasts Housing Association is a Registered Social Housing Provider, Registered under the Co-operative and Community Benefits Society Act 2014 (company number RS007617) with registered office at 5 Paternoster Row, Carlisle, Cumbria CA3 8TT. Castles & Coasts Housing Association trades under the trading names of Castles & Coasts Housing Association Ltd.

Castles & Coasts Housing Association is the controller of all personal data processed by Castles & Coasts Housing Association, Castles & Coasts Housing Association Ltd.

Castles & Coasts Housing Association Limited (CCHA) formed on 31 July 2017 following the merger of Two Castles Housing Association and Derwent & Solway Housing Association.

Registration with the Information Commissioner’s Office

For the purpose of the Data Protection Act (2018) Castles & Coasts Housing Association is registered as a data controller with the Information Commissioners Office with registration number ZA268880.

Data Protection Officer

Castles & Coasts Housing Association’s Data Protection Officer is contactable by the following methods

Address - 5 Paternoster Row, Carlisle, Cumbria CA3 8TT

Telephone - 0800 085 1171

Email -

Personal Data Processed by Castles & Coasts Housing Association

Castles & Coasts Housing Association collects, stores and processes personal data for several purposes, mainly: personnel administration, financial accounting, and delivery of housing services.

As a member of the National Housing Federation, Castles & Coasts Housing Association follows the federation's recommendation for document storage and data retention periods. Details on the criteria are available via the button below. 

Type / Classes of information we collect:

  • personal details
  • goods and services
  • supplier details
  • financial details
  • bank information
  • lifestyle and social circumstances
  • complaints
  • education and employment details
  • health, safety and security details
  • visual images, personal appearance and behaviour
  • Information relating to safeguarding

We may record calls made to and from CCHA for training and monitoring purposes. This is to help ensure we're delivering a good service.

We also process sensitive classes of information that may include:

  • physical or mental health details
  • gender
  • sexual orientation
  • trade union membership
  • offences and alleged offences
  • criminal proceedings, outcomes and sentences
  • racial or ethnic origin
  • religious or other beliefs of a similar nature


Who the information is processed about

  • tenants and residents
  • applicants for accommodation which include their families and households
  • asylum seekers
  • business associates
  • landlords
  • probation officers
  • social workers
  • spiritual and welfare advisers
  • consultants and professional advisers
  • survey respondents
  • job applicants
  • employees including self-employed contractors
  • offenders and suspected offenders
  • complainants and enquirers
  • suppliers and service providers
  • people captured by CCTV images
  • local authority officers
  • councilors
  • officers for regulators and official bodies

Web Page Tracking Cookies

Castles & Coasts uses cookies to track information on this website

How we use your information - Lawful Basis

We process personal information to enable us to provide social housing accommodation and services which include:

  • letting, renting and leasing properties
  • Purchase and sale of properties
  • administering waiting lists
  • carrying out research
  • managing tenancies and leases
  • administering housing and property grants
  • providing associated welfare services, advice and support
  • maintaining our accounts and records
  • supporting and managing our employees, agents, and contractors 
  • managing and processing job applications
  • processing personal information using CCTV systems to monitor and collect visual images for the purpose of security and the prevention and detection of crime

How data held and used is referred to as the lawful basis for processing data under the GDPR.  CCHA holds and processes the data to perform its contractual service for existing and future contracts.

Castles & Coasts Housing Association may share data for the lawful reasons shown:

  • delivery of housing maintenance and services as part of the customer contract, leasehold agreement or tenancy agreement
  • flag risks and vulnerabilities that contractors should be aware of
  • contact information to allow contractors to arrange visit for the work
  • Utility companies (including Energy Angels) so that they can charge the correct people. A copy of Energy Angels' privacy notice can be found here: Tenant privacy notice - Energy Angels  
  • current, past or prospective employers
  • family, associates and representatives of the person whose personal data we are processing
  • educators and examining bodies
  • suppliers and service providers
  • financial organisations
  • central government
  • local government
  • auditors
  • survey and research organisations
  • other housing associations or trusts
  • trade unions and associations
  • health authorities
  • enquirers and complainants
  • security organisations
  • health and social welfare organisations
  • professional advisers and consultants
  • probation services
  • charities and voluntary organisations
  • police forces
  • courts and tribunals
  • professional bodies
  • employment and recruitment agencies
  • credit reference agencies
  • debt collection agencies
  • landlords
  • for the management and collection of money for rent or services provided or to be provided
  • legal requirements including providing information for housing benefit and universal credit, council tax, criminal activity
  • safeguarding teams

Sub-contract Processing

Castles & Coasts Housing Association uses sub-contract organisations to process personal data under a written contract which defines that they must comply with stringent data privacy requirements. Castles & Coasts Housing Association only employs organisations that comply with the provisions of the General Data Protection Regulation. These organisations are audited to ensure compliance.

Castles & Coasts Housing Association’s processors include, but are not limited to,

  • Paragon Group for the delivery of post
  • allpay and Capita Payments 360 for the secure processing of card payments
  • MRI Software for the secure hosting of the texting system for the provision of email sending services 
  • BT for management of the 0800 phone line
  • BMG Research for the purposes of gathering service satisfaction data from customers
  • Contractors who perform repairs, maintenance and servicing work on behalf of Castles & Coasts

Data collected on behalf of Ministry of Housing Communities & Local Government (MHCLG)

If your household has entered a new social housing tenancy after 1989, social housing providers would have shared your personal information with the Government for research and statistical purposes.

Information from MHCLG and their privacy statement is available from

Castles & Coasts Housing Association may use augmentation services to satisfy its legal obligation to ensure the accuracy of personal data being processed by using, for example:

Royal Mail Postal Address File (PAF) to update redirected addresses and to ensure address accuracy and completeness.

BT Operator Services Information System (OSIS) to ensure telephone number accuracy and completeness.


Castles & Coasts Housing Association does not use any profiling systems for personal information.

Your Rights



Right of access

You have the right to obtain confirmation from Castles & Coasts Housing Association as to whether or not personal data concerning you are being processed, and, where that is the case, access to that personal data.

Right to rectification

You have the right to oblige Castles & Coasts Housing Association to rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.

Right to erasure (right to be forgotten)

You have the right (under certain circumstances, but not all) to oblige Castles & Coasts Housing Association to erase personal data concerning you.

Right to restriction of processing

You have the right (under certain circumstances, but not all) to oblige Castles & Coasts Housing Association to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.

Right to data portability

You have the right (under certain circumstances, but not all) to oblige Castles & Coasts Housing Association to provide you with the personal data about you which you have provided to Castles & Coasts Housing Association in a structured, commonly used and machine-readable format.

You also have the right to oblige Castles & Coasts Housing Association to transmit those data to another controller.

Right to withdraw consent

If the lawful basis for processing is consent, you have the right to withdraw that consent.

Right to object to direct marketing

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.

Rights in relation to automated decision making and profiling

Castles & Coasts Housing Association does not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.


Your right to lodge a complaint with a supervisory authority

If you wish to exercise any of your rights concerning your personal data, you should contact Castles & Coasts Housing Association’s Data Protection Officer at the address shown above. If you are not satisfied with the response you receive you have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is:

Information Commissioner's Office

Wycliffe House

Water Lane




 (t) 0303 123 1113


Privacy policy awareness, Document Owner and Approval

The Data Protection Officer owns this guidance and is responsible for ensuring that it is reviewed on a regular basis.

  • Regular review
    • Review and changes recorded and change revision kept on the website and with the DPO
    • Review to update with changes to business
    • Following DPIA when appropriate
    • Changes to external contractors
    • Changes in data sharing and when / if consent is used for data
    • Changes to legislation
  • Consistent signposting to the Privacy policy at
    • CCTV Installations
    • Email signature
    • All letters to residents
    • Residents magazine
    • All contract and sign up information to include a clear description of the purpose of the data being captured and also a signpost to the privacy policy
    • Data sharing agreements and other information request type documentation
    • Standard footer on all webpages linking to the privacy policy


Version Control

Change History Record



Description of Change


Date of Issue


Initial issue

Business Systems & Technical Information Manager

4 April 2018


Addition of link and note on collection of CORE data for Ministry of Housing Communities & Local Government


6 June 2018


Update of name "Martin Jackson" as the named contact for GDPR


9 July 2019


Update of name "Martin Jackson" as the named contact for GDPR


31 March 2020


Amendment of NHF Reference to data retention period link

Amendment of privacy policy changing Deeplake to MRI Software

Finance Director

1 July 2020


Castles & Coasts Housing Association Web Tracking cookies privacy policy

This website uses cookies to track internet use.



  • Information that you provide by filling in forms on our site (“our site”). This includes information provided when you complete our on-line accounts form and enquiry forms.
  • If you contact us, we may keep a record of that correspondence.
  • We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
  • Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.
  • We use Google Analytics Demographics and Interest Reporting to learn about our website visitors, and possibly target future advertising. All data is anonymised and we do not match it to usernames, email addresses or other personally identifying information. Visitors can opt-out of Google Analytics tracking by installing the following browser add-on.

We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about our users' browsing actions and patterns, and does not identify any individual.

We want to make the services we provide, easy, useful and reliable. Where services are delivered on the internet, this sometimes involves placing a small amount of information on your device, for example your computer or mobile phone. These include small files known as "cookies".

These pieces of information are used to improve services for you through, for example:

  • Recognising that you may already have provided a username and password so that you do not need to keep entering these into every web page when requested
  • Measuring how many people are using our services so they can be improved

If the cookie banner is visible on the webpage, you can choose whether to set your browser to accept or reject cookies. Just remember that choosing not to accept cookies may affect your experience on our website. Changing the settings depends on the browser you use. The main browser types are listed below:
Google Chrome

From the Chrome menu in the top right corner of the browser, select Settings.
At the bottom of the page, click "Advanced".
Under Privacy and security, select "Content settings".
To manage cookie settings, select "Cookies".
To view or remove individual cookies, click "See all cookies and site data" and hover the mouse over the entry. Select the dustbin icon that appears next to the cookie to remove it.
To delete all cookies, click "Remove All".

Internet Explorer 11.0

Choose Tools and then Internet options
Click the Privacy tab
Move the slider to choose your preferred settings.

Internet Explorer 10.0

Choose Tools and then Internet options
Click the Privacy tab
Move the slider to choose your preferred settings.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

We use information held about you in the following ways:

  • To ensure that content from our site is presented in the most effective manner for you and for your computer.
  • To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.
  • To carry out our obligations arising from any contracts entered into between you and us.
  • To allow you to participate in interactive features of our service, when you choose to do so.
  • To notify you about changes to our service.

We may also use your data, to provide you with information about goods and services which may be of interest to you and we may contact you about these by post, telephone, or email.

If you are an existing customer, we will only contact you by electronic means (e-mail or SMS) with information about goods and services similar to those which were the subject of a previous sale to you.

If you are a new customer, we will contact you by electronic means only if you have consented to this.

If you want us to use your data in this way, please tick the relevant box situated on the form on which we collect your information.

We will not disclose this information on website tracking to third parties.


You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by ticking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at Castles & Coasts housing Association, information on the contacts page

Our site may, from time to time, contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.