Privacy and cookies

0. Summary

We collect information so we can provide homes and services safely, fairly and lawfully.

We only use information where we have a legal reason (a “lawful basis”), for example to manage your tenancy or employment, keep people safe, meet our legal duties, or with your consent.

We only share information where necessary and lawful (for example with repairs contractors, councils, the NHS, the police or regulators).

You can ask to see your information (for example by making a data subject access request), correct it, object to some uses, or ask us to delete it in some cases.

Our Data Protection Officer (DPO) can help: CoSec@coastlinehousing.co.uk, 01209 200200.

1. About this notice

This Privacy and Cookies Notice explains how Coastline Housing Group – which comprises Coastline Housing Ltd, Coastline Design and Build Ltd, Coastline Services Ltd and Coastline Care Ltd (“Coastline”, “we”, “us”) – collects and uses personal information.

It applies to customers (current, prospective and former), residents and household members, supported and temporary housing customers, leaseholders and shared owners, community programme participants, job applicants, employees, contractors and suppliers, website users, visitors to our premises and anyone else who interacts with us.

It also explains your rights under UK data protection law and how to contact us.

2. Who we are and how to contact us

Controller: Coastline Housing Limited, 4 Barncoose Gateway Park, Pool, Redruth, Cornwall, TR15 3RQ.

Data Protection Officer (DPO): CoSec@coastlinehousing.co.uk | Tel: 01209 200200.

General enquiries: customer.service@coastlinehousing.co.uk

3. The personal data we collect

We collect and process different types of information depending on your relationship with Coastline. Examples include the following (this list is illustrative rather than exhaustive):

3.1 Customers (current) and members of their households

Identification and contact details
Date of birth
Household composition
Tenancy details and communications
Payment and arrears information
Bank details
Equality and diversity information (e.g. gender, ethnicity, sexual orientation, cultural or religious needs) where provided
Disabilities, support needs and vulnerabilities (where relevant to providing housing, support services or safeguarding individuals)
Employment and financial status (for example, to assess affordability or provide welfare or benefits support if you choose)
Responses to optional customer surveys (usually anonymised)
Preferences and interests (where provided)
Emergency contact information
Signature and identification
IP address and activity for My Coastline online services
Note: Where customers contact us in emergency or out‑of‑hours situations, we may receive information about vulnerabilities or health indicators shared by the caller where necessary to respond appropriately.

3.2 Prospective customers

Application details
Current, previous and forwarding addresses
Financial circumstances and welfare entitlements
National Insurance number (where required for eligibility, verification or allocation checks)
References from previous landlords
Details of relevant third parties involved with your household
Information about unspent criminal convictions where relevant to allocations and tenancy management

3.3 Former customers

Basic tenancy records (start and end dates)
Outstanding debts
Records of complaints and anti‑social behaviour where relevant

3.4 Leaseholders, shared owners and outright owners

Contact information
Identity and affordability assessments
Service charge and rent accounts
Arrears management
Repairs and maintenance records
Right‑to‑rent or ownership checks
Lease extensions, staircasing and resale administration
Statutory consultation information
Stock condition survey results
Regulatory safety checks (for example gas safety)

3.5 Supported and temporary housing residents (including crisis accommodation and move‑on)

Contact and identification information
Information necessary to provide accommodation and support
Care, support and safeguarding information (including, where relevant, medical needs and care plans) where applicable
Referral and move‑on details

3.6 Community investment / social impact participants and volunteers

Contact and participation details
Information relating to financial, wellbeing, employment and training programmes
Volunteering sign‑up and exit details
Information required to provide placements or opportunities

3.7 Contractors, suppliers, partners and agents

Business contact details
Names and qualification data of personnel assigned to Coastline work
Information necessary to manage procurement, contract delivery, health and safety and access to our premises and systems

3.8 Board members, independent committee members and customer governance members

Contact details
Equality and diversity information (e.g. gender, ethnicity, sexual orientation, cultural or religious needs) where provided
Service agreements and appointments
Bank details
Training records
Declarations of interest
DBS information (where relevant) and identification
Information we provide to regulators and statutory bodies

3.9 Job applicants

Identity and contact details
CVs and application information
Education and qualifications
References and background checks (including right‑to‑work)
Any other information you provide during recruitment

3.10 Employees

Identity and contact details
Employment history
Equality and diversity information (e.g. gender, ethnicity, sexual orientation, cultural or religious needs) where provided. Next‑of‑kin and emergency contacts
Payroll, tax and pension information
Bank details
Occupational health information
Training, performance and disciplinary records
Access control and CCTV data
Lone‑worker and fleet telematics data
IT usage monitoring in line with policy
DBS information (where relevant)

3.11 Children

We may hold information relating to children in households where it is provided to us in the course of our relationship with you, for example to manage a tenancy, support service, safeguarding or adaptations.

3.12 Images, recordings and online identifiers

Telephone calls to our Customer Contact Centre may be recorded for training, quality monitoring and evidential purposes
CCTV operates at Coastline premises to provide a safe and secure environment, prevent and detect crime or anti‑social behaviour and protect residents, visitors and colleagues
Photographs may be taken at events or in communities for marketing purposes (with consent)
Properties (including interiors) may be photographed to manage condition and tenancies
Website and system logs (such as IP address, browser type, date and time) may be captured for security, diagnostics and audit.

4. Where we obtain personal data

We collect personal data:

Directly from you (for example through applications, forms, emails, calls, meetings, surveys, website or portal use and social media interactions), and
From third parties where relevant and lawful, including councils and benefits offices, health and social care organisations, police and safeguarding partners, elected representatives acting for you, credit reference agencies and tracing agents, previous landlords, financial institutions and payment providers, managing agents, partner landlords, courts, regulators and our professional advisers.

5. Why we use your data and our lawful bases

We only process personal data where we have a lawful basis under the UK GDPR. Depending on the activity, these include (non‑exhaustive):

5.1 Customers (current)

To assess applications, allocate properties and manage tenancies, provide repairs, accept payments and communicate with you – Legal basis: contract (Article 6(1)(b)).
To handle customer complaints, feedback and compliments, investigate issues raised and respond appropriately – Legal basis: legal obligation (Articles 6(1)(c) and legitimate interests (Article 6(1)(f).
To comply with legal and regulatory obligations (e.g., housing/health & safety, safeguarding) – Legal basis: legal obligation (Article 6(1)(c)).
To meet safeguarding duties, prevent harm and protect individuals at risk – legal obligation (Article 6(1)(c)) and, where necessary to protect life or prevent serious harm, vital interests (Article 6(1)(d)).
Tenancy management, service improvement, surveys (optional), arrears recovery, anti‑social behaviour prevention and staff/resident safety – Legal basis: legitimate interests (Article 6(1)(f)).
Tailoring services to your circumstances (e.g., accessibility, adaptations, support needs) and welfare/benefits/debt advice where you choose to receive it – Legal basis: consent (Article 6(1)(a)).

5.2 Prospective customers

References, affordability and suitability checks, allocations and pre‑tenancy activities – Legal basis: contract/steps prior to contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)).

5.3 Former customers

Legal rights and obligations (e.g., Right to Buy/Acquire evidence) – Legal basis: legal obligation (Article 6(1)(c)).
Debt recovery and records relevant to tenancy management and safeguarding – Legal basis: legitimate interests (Article 6(1)(f)).

5.4 Leaseholders/shared owners/outright owners

Lease/ownership administration (including service charges, arrears, works consultation, repairs, statutory and safety checks, stock condition surveys, staircasing, lease extensions and resale) – Legal basis: contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)).

5.5 Supported and temporary housing

To provide accommodation and support, manage referrals and move‑on, and protect individuals’ vital interests – Legal bases: contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)); vital interests (Article 6(1)(d)).

5.6 Community investment / social impact and volunteering

To deliver programmes, volunteering and placements, and share relevant opportunities – Legal basis: contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)); consent where applicable (Article 6(1)(a)).

5.7 Contractors/suppliers/partners

To manage procurement, contracts, health and safety, access and performance – Legal bases: contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)); legal obligation where applicable (Article 6(1)(c)).

5.8 Company Members, Board Directors and Committees members

To administer appointments, governance and regulatory reporting – Legal bases: contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)); legal obligation (Article 6(1)(c)).

5.9 Job applicants and employees

Recruitment, employment administration, payroll and pensions, training and development, performance and conduct management, building security, wellbeing/occupational health, lone‑worker and fleet safety – Legal bases: contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f)).

5.10 Security and governance purposes

To investigate, manage and respond to security incidents, data breaches and related events – legal obligation and legitimate interests – Legal basis: legal obligation (Articles 6(1)(c) and legitimate interests (Article 6(1)(f).

5.11 Special category and criminal convictions data

We minimise the use of special category personal data. Where it is processed, we rely on:

Your explicit consent (Article 9(2)(a)), or
A relevant condition under Schedule 1 of the Data Protection Act 2018 (for example employment or social protection, safeguarding or substantial public interest). Where safeguarding is involved, we process special category data where necessary for reasons of substantial public interest, to protect individuals at risk and to meet statutory safeguarding duties, in accordance with the Data Protection Act 2018, Schedule 1.

Where permitted by law and relevant to our activities, we may also process information about criminal convictions, for example in connection with allocations, tenancy management or safeguarding. Special category data may arise in the contexts described above, including safeguarding, equality monitoring, complaints handling, employment and supported housing services.

6. Analytics, AI and profiling

We may use data analytics to improve our services. Where appropriate and consistent with our legal duties, we may apply advanced analytics and machine learning (for example, segmentation) to help identify customer needs and tailor support. We do not make solely automated decisions that produce legal or similarly significant effects without appropriate safeguards and a lawful basis. If we introduce any such processing, we will update this notice and provide specific information at the point of collection.

7. CORE – social housing lettings and sales (England)

As a social housing provider, we are required to submit data on social lettings and sales to the national CORE dataset. Data is submitted in a secured system and is provided in a highly pseudonymised form for research and analytical purposes carried out in the public interest. Further information is available from the UK Government’s CORE privacy notice.

8. Fraud detection and data matching

We may use personal data to prevent and detect fraud (for example, data matching and checks with third parties such as the Land Registry, financial institutions, utilities or education providers). We will only do this where lawful, necessary and proportionate and will keep records of the checks carried out.

9. Who we share personal data with

We share personal data where necessary to provide services, manage tenancies, employment and volunteering, meet legal and regulatory obligations, safeguard individuals, prevent and detect crime and fraud, or pursue legitimate interests (e.g., debt recovery).

Typical recipients include: maintenance and housing/support contractors, utilities and council tax offices, consultants and professional advisers, police and emergency services, HMRC and government departments, local authorities and the NHS, health and social care professionals, managing agents and partner landlords, courts and insurers/auditors, translation/mediation services, regulators, credit reference and debt recovery agencies, charities/support partners, research companies conducting customer surveys, mailing providers and training/placement providers (non‑exhaustive). Each party must handle personal data securely and in accordance with the law and their own privacy policies.

We may share personal data, including special category data where lawful and necessary, with local authorities, health and social care organisations, the police and other statutory safeguarding partners to protect individuals at risk or meet safeguarding obligations.

10. International transfers

If personal data is transferred outside the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and we conduct transfer risk assessments where required. Some of our service providers may store data in the UK/EEA and/or internationally (for example Microsoft 365/Cloud, Google, Apple, Dropbox, SurveyMonkey, SmartSurvey and WiredPlus).

11. Direct marketing and communications

We only send electronic marketing (e.g., email/SMS) where we have your consent or can rely on the ‘soft opt‑in’ for our own similar services to existing customers. Every message provides a simple way to opt out. We do not send third‑party marketing without consent.

12. Cookies and similar technologies

12.1 What are cookies, scripts and web beacons?

Cookies are small files placed on your device that store or access information when you use our website or online services.
Scripts are small pieces of code used to make our site function properly and interactively.
Web beacons/pixels are tiny images or code snippets that help monitor site traffic and interaction.

12.2 Why we use them

We use: (a) strictly necessary cookies to deliver pages/features you request and ensure security and network management; (b) preference cookies to remember choices (e.g., language/accessibility); (c) statistics/analytics cookies to understand site usage and improve our services; and (d) marketing cookies to measure communications and campaigns.

12.3 Legal basis and your choices

For non‑essential cookies, we rely on your consent under PECR and Article 6(1)(a) UK GDPR. Strictly necessary cookies rely on our legitimate interests in providing a secure, functional site (Article 6(1)(f)) and the PECR exemption. On your first visit, our banner lets you accept, reject or manage non‑essential cookies. You can change your choices at any time via ‘Manage settings’ in the footer. Withdrawing consent does not affect prior lawful use.

12.4 Examples and cookie table

Examples of cookies we may use include functional security cookies (e.g., ‘csrftoken’) and analytics cookies (e.g., Google Analytics cookies) if you consent. Our Consent Management Platform (CMP) shows a current cookie table (name, provider, purpose, expiry, category) and is updated when cookies change.

12.5 Logs and diagnostics

Like most websites, our servers may log your device’s IP address, browser type and version, pages visited and the date/time of access. We use this for security, diagnostics and service improvement.

12.6 Further information

For general information about cookies, you may wish to visit independent resources such as ‘All About Cookies’. Your browser help pages explain how to delete or block cookies. Blocking necessary cookies may affect site functionality.

13. CCTV, signage and call recordings

We operate CCTV at Coastline premises, including (for example) Coastline House, Miners Court, our Homeless Service and other schemes such as Supported Living and Extra Care. A full list of our CCTV locations is as follows:

5 and 7 North Road, Camborne; 17 Fore Street, Camborne; 20 Edmund Road, Redruth; 23 Treswithian Park Road, Camborne; Chi Winder, Pool; Coastline House 4 Barncoose Gateway Park, Pool; Henley House, Fore Street, Pool; Hens-Horn Court, Station Road, Helston; Miners Court 64 Miners Court, Redruth; Tarn West, 74 Green Lane, Redruth;Trelawny Court, College Street, Camborne; Veor House, South Terrace, Camborne; and Whitehaven, Redruth.

Signage is displayed to make recording obvious to visitors.

We use CCTV to provide a safe and secure environment, deter and detect crime and anti‑social behaviour, protect residents, visitors and colleagues and to support incident investigation. Footage is retained in line with our retention schedule and is shared only where lawful (e.g., with the police, insurers or legal representatives). Our call centre may record calls for training, quality monitoring and evidential purposes; access is controlled and recordings are retained as set out in Section 16.

14. Security of your information

We apply appropriate technical and organisational measures to keep personal data secure, including access controls, staff training, secure storage and contractual protections with our suppliers.

15. Your data protection rights

You have rights to access, rectify, erase and restrict your data, to object to processing (including where based on legitimate interests and to direct marketing), and to data portability where applicable. You can withdraw consent at any time (this does not affect prior lawful processing). We will respond within one month (extendable by two months for complex/multiple requests). You also have the right to complain to the Information Commissioner’s Office (ICO).

16. How long we keep personal data

We keep personal data only as long as needed for the purposes set out in this notice, then securely dispose of it. Typical periods include: tenancy data up to six years after tenancy end (longer if debts or legal claims persist); call recordings usually up to 90 days (longer for investigations/training); CCTV footage normally six weeks unless linked to ASB/crime (up to two years after legal proceedings conclude); marketing photographs used with consent for up to 12 months, after which images are destroyed or archived unless consent is renewed.

17. How to exercise your rights or complain

To exercise your rights or complain about how we use your personal data, contact our Data Protection Officer (DPO) via CoSec@coastlinehousing.co.uk or write to the DPO at Coastline Housing Limited, Coastline House, 4 Barncoose Gateway Park, Pool, Redruth, TR15 3RQ.

You can also contact the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; Tel: 0303 123 1113; see www.ico.org.uk for details.

18. Changes to this notice

We may update this notice to reflect changes in our processing or the law. We will publish the new version with the effective date above.

Last updated: May 2026