Your personal information rights and how to raise a concern

Your Personal Information Rights

At mhs homes, we want you to understand how your personal information is used and the rights you have.

Your personal information belongs to you. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 give you a number of rights over how your information is collected, used and stored.

We are committed to being open about how we use your information and helping you exercise your rights when you need to.

Your Rights at a Glance

You have the right to know:

• What information we collect

• Why we collect it

• How we use it

• Who we share it with

• How long we keep it

You can find this information in our Privacy Notice.

You have the right to ask for a copy of the personal information we hold about you. This is known as a Subject Access Request (SAR).

Examples of information that may be included within the scope of a Subject Access Request include:

• Tenancy records

• Repair records

• Correspondence and communications

• Records relating to services we provided to you

• Other personal information we hold about you

Visit the 'How do I make a request?' section below to find out how to request your information.

Correct personal information about you

If you believe the personal information we hold about you is inaccurate or incomplete, you can ask us to correct it.

We will review your request and let you know the outcome.

Ask us to delete personal information

In some circumstances, you can ask us to delete personal information we hold about you.

This right is not absolute and depends on why we hold the information. We will always consider your request and explain our decision.

Ask us to limit how we use your personal information

In certain situations, you can ask us to temporarily restrict how we use your personal information while we review a concern or resolve an issue.

Object to how we use your personal information

You can object to certain types of processing where the law allows you to do so.

We will carefully consider your request and explain the outcome.

Access your personal information in a portable format

Where applicable, you can ask for certain information to be provided in a format that allows it to be transferred or reused elsewhere.

Rights relating to automated decision-making

Where we use automated decision-making or profiling that has a legal or similarly significant effect on you, you have additional rights relating to those decisions.

If these rights apply, we will explain them to you and how they can be exercised.

Making a request is simple.

You do not need to complete a specific form to exercise your personal information rights, although we may provide forms to help us process requests more efficiently. Requests can be made verbally or in writing.

Contact the Data Protection Team.

Email: [email protected]

You can also contact us through our website, by telephone, or by speaking to a member of staff who can help direct your request to the right team.

What happens next?

Once we receive your request, we will:

1. Acknowledge your request.

2. Confirm your identity if necessary.

3. Contact you if we need more information.

4. Review the information we hold.

5. Respond within the timescales required by law.

We will usually respond within one calendar month of receiving a valid request.

If your request is broad or complex, we may contact you to better understand what information you need. This helps us provide the most relevant information as efficiently as possible. For very complex cases we might have to extend for a further 2 months however we will ensure we let you know in advance before this happens.

We take the protection of your personal information seriously and want to hear from you if you are unhappy with the way we have handled it.

You can make a complaint if you have concerns about:

• How we have collected, used, stored or shared your personal information

• The accuracy of information we hold about you

• A delay or issue relating to an information rights request

• How we have handled a Subject Access Request

• A personal data breach involving your information

• Any other concern about how your personal information has been managed

How to make a complaint

All data protection complaints should be directed to our Data Protection Officer.

Email: [email protected]

Complaints can be made verbally or in writing and do not need to mention data protection legislation to be considered.

The Data Protection Officer will review and investigate your concerns in accordance with our complaints and information governance procedures, ensuring they are handled fairly, thoroughly and in line with legal and regulatory requirements.

We are committed to being open and transparent about how we handle information requests and protect personal information.

This information is updated every six months and provides an overview of:

• Subject Access Requests (SARs)

• Personal information rights complaints

• Compliance with statutory response times

• Personal data breaches

Performance information is published for transparency purposes and may be updated following validation of management information.

Subject Access Requests

Compliance with statutory timescales

No Subject Access Requests exceeded the statutory response times during the last 12 months.

We occasionally receive follow-up queries relating to previously completed requests. Where appropriate, these are managed separately from new Subject Access Requests.

Personal information rights complaints

Personal data breaches

A personal data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information.

Data breach reporting

We record and investigate all reported data breaches and near misses. Trends are reviewed by senior management to identify learning opportunities, improve controls and reduce the risk of future incidents.

An increase in reported incidents does not necessarily indicate an increase in harm. It may reflect improved staff awareness, a stronger reporting culture and enhanced incident identification processes.

Serious personal data breaches

A serious personal data breach is one that is likely to result in a risk to the rights and freedoms of individuals and may require notification to the Information Commissioner's Office (ICO).

Where a breach meets the legal threshold for reporting, we will notify the ICO and affected individuals in accordance with our legal and regulatory obligations.

Continuous improvement

We use information from requests, complaints and data breach investigations to:

• Improve our services and processes

• Strengthen staff training and awareness

• Enhance data protection controls

• Improve the quality and accessibility of information provided to customers

This information is reviewed and updated every six months as part of our commitment to openness, accountability and transparency.

Need support?

We are committed to ensuring everyone can exercise their information rights.

If you need information in an alternative format, require support making a request or complaint, or would like someone to act on your behalf, please let us know and we will work with you to meet your needs.