Why do we process your personal information?
We process your personal information, including any special categories of personal information, in connection with managing a range of issues such as reports of antisocial behaviour, complaints and appeals, claims against Trivallis, and shared cost works involving individuals who are not tenants of Trivallis. We process this information either because you’ve given us your consent, because it’s necessary to fulfil our contractual obligations, or because laws allow or require us to do so. In some cases, this processing is a statutory requirement. For example, where we must comply with housing legislation, safeguarding duties, or regulatory requirements.
If you didn’t give us this information, we wouldn’t be able to provide you with a tenancy.
Sometimes we process your personal information because, as a business, we have a legitimate interest in doing so. These interests include maintaining and improving the quality of our housing services, ensuring the safety and wellbeing of our tenants, managing our properties effectively, and communicating important updates. We only do this, though, when we’re confident that you would reasonably expect us to do so, for example, when you help us with surveys that we’re undertaking in order for us to improve the service that we give to you.
In some instances, we may require your consent in order to process your personal information. If we do, we will make this clear to you and will not process your information unless you consent to us doing so. You will then be given the option to withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before your consent was withdrawn.
Summary Table: Legal Bases for Processing Tenant Data
| Purpose of Processing |
Type of Data |
Legal Basis |
Recipients |
Example |
| Managing your tenancy |
Contact details, tenancy agreements |
Contractual necessity |
Internal housing management teams, contractors, payment processors |
Setting up your tenancy, collecting rent, arranging repairs |
| Handling complaints, appeals, or antisocial behaviour |
Incident reports, communications |
Legal obligation / Legitimate interest |
Internal complaints and safeguarding teams, legal advisors, local authorities or law enforcement (where required) |
Investigating a complaint or resolving neighbour disputes |
| Shared cost works involving non-tenants |
Property ownership, contact details |
Legal obligation / Consent |
Contractors, surveyors, legal advisors, affected third parties (e.g. neighbouring property owners) |
Coordinating repairs with leaseholders or owners |
| Improving services through surveys |
Feedback, opinions |
Legitimate interest |
Internal service improvement teams, survey platform providers, data analysts |
Asking for your views to improve housing services |
| Marketing or optional services |
Contact details, preferences |
Consent |
Communications team, marketing service providers, partner organisations offering optional services (only with consent) |
Sending newsletters or event invitations (only if you opt in) |
*Categories of recipients are listed for transparency and may not apply in every case. Data is only shared where relevant and necessary. A full list of third-party service providers is available on request.
What personal information do we process and where do we get it from?
Most of the personal information that we process is information that you’ve given us about you and the people who live with you. This includes things like your name, address, telephone numbers, date of birth, national insurance number, gender and bank account details. We also process special categories of personal information such as your race or ethnic origin, religion, and information concerning your health or sexual orientation, but will only do this where there is a lawful basis for us to do so, for example, where you have consented to us processing your information, where we need to process your information in order to protect your vital interests, or where there are laws that allow us, or require us, to do so. In addition to the above, when we deal with antisocial behaviour cases, we may process information relating to criminal convictions or allegations.
Sometimes we process personal information about you that we’ve been given by other organisations such as the local authority or the Police. This could include, for example, information relating to a housing application, housing benefit claim or support package, or something like antisocial behaviour. The other organisation would only share this information with us, though, where either you’ve given them permission to do so or the law allows them to do so.
Do we ever transfer your personal information outside of the UK?
Much of the personal information that we process at Trivallis is held electronically, either in our offices at Pontypridd or off-site in UK data centres. When the information is held off-site, we work closely with our software providers to make sure that this information is stored in accordance with the requirements of the General Data Protection Regulation (GDPR).
Some organisations which provide services to Trivallis may transfer data outside of the UK, but we only allow this if the data is adequately protected and if appropriate safeguards are in place – such as an adequacy decision by the UK Government or the use of approved contractual clauses. You can request more information around safeguards by contacting our Data Protection Officer at dataprotection@trivallis.co.uk.
How long do we hold your personal information for?
In connection with managing your tenancy, we hold your personal information for a period of six years after your tenancy has ended and, usually, this is the longest that we will hold any of your personal information for. Information provided by other agencies and relating to the special needs of tenants, and records relating to offenders, are held only while the tenancy continues; and footage from Trivallis’ CCTV cameras is only retained for 30 days. At the end of this time, we’ll securely dispose of your personal information.
When we must hold your personal information for longer than usual due to legal obligations or operational requirements, and where a fixed retention period is not appropriate, we apply criteria based on the nature of the data and the purpose of processing. Where feasible, we will anonymise data held beyond its standard retention period.
What rights do you have?
You have a number of rights under the General Data Protection Regulation (GDPR).
You have the right to access the personal information that we process about you and, if you believe that the personal information is incorrect or incomplete, to have it rectified or erased.
You have the right, in certain circumstances, to restrict the processing of your personal data or to object to specific types of processing, including direct marketing. Where processing is based on consent or is carried out by automated means, you may also have the right to data portability, that is, to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
You also have the right to lodge a complaint with a supervisory authority – the Information Commissioner’s Office for the UK.
For more information about your rights under UK data protection law and how your personal data should be handled, you can visit the ICO’s UK GDPR guidance and resources, or please reach out to the DPO at dataprotection@trivallis.co.uk.
How to Raise a Data Protection Concern?
If you have concerns about how we process your personal data or believe your data protection rights may have been broken under the Data use and Access Act, you can raise a complaint with us. This may include issues such as delays in response to a data request, concerns over how your data has been used or shared, or dissatisfaction with the outcome of a Subject Access Request (SAR).
Please submit your complaint to our Data Protection Officer by email at dataprotection@trivallis.co.uk. We aim to acknowledge your complaint within 30 calendar days, and we will provide a full response as quickly as possible.
If you are not happy with our initial decision, you may request an internal review, where your case will be looked at again but by a separate reviewer within the organisation.
If you remain unhappy after this internal review, you have the right to take your concern further to the Information Commissioner’s Office (ICO). For more information or to submit a complaint, please visit the ICO’s website: https://ico.org.uk/global/contact-us.
Useful Links
For more information on individual’s rights, the Information Commissioner’s website:
https://ico.org.uk
Why do we process your personal information?
We process your personal information, including any special categories of personal information, in connection with managing issues such as the reporting of antisocial behaviour, claims against Trivallis, complaints and appeals, and shared cost works for people who aren’t tenants of Trivallis. The legal bases for this processing may include your consent, our legitimate interests, compliance with legal obligations, or the performance of a task carried out in the public interest. In some cases, we are required by law to process this information (statutory requirement), while in others, it may be necessary to fulfil a contractual obligation or to protect the rights of Trivallis or others.
If you didn’t give us this information, we wouldn’t be able to provide you with a service.
Sometimes we process your personal information because, as a business, we have a legitimate interest in doing so. These interests include managing our operations efficiently, ensuring the safety and security of our premises, engaging with the wider community, and improving the services we offer. We only do this, though, when we’re confident that you would reasonably expect us to do so, for example, when you help us with surveys that we’re undertaking in order for us to improve the service that we give to you.
When we require your consent in order to process your personal information we will make this clear to you and will not process your information unless you consent to us doing so. You will then be given the option to withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before your consent was withdrawn.
Summary Table: Legal Bases for Processing Non-Tenant Data
| Purpose of Processing |
Type of Data |
Legal Basis |
Recipients |
Example |
| Handling complaints, appeals, or antisocial behaviour |
Contact details, incident reports |
Legal obligation / Legitimate interest |
Internal complaints and safeguarding teams, legal advisors, local authorities or law enforcement (where appropriate) |
Investigating a complaint made by or about a non-tenant |
| Managing shared cost works |
Property ownership, contact details |
Legal obligation / Consent |
Contractors, surveyors, legal advisors, affected third parties (e.g. neighbouring property owners or leaseholders) |
Coordinating repairs with leaseholders or freeholders |
| Responding to legal claims |
Communications, case details |
Legal obligation |
Legal representatives, insurers, regulatory bodies, courts or tribunals |
Processing information related to a claim against Trivallis |
| Engaging with community stakeholders |
Contact details, correspondence |
Legitimate interest |
Communications team, partner organisations, local authorities |
Communicating with residents or organisations about housing issues |
| Optional communications or services |
Contact details, preferences |
Consent |
Communications team, marketing service providers, partner organisations offering optional services (only with consent) |
Sending updates or invitations to non-tenants who opt in |
*Categories of recipients are listed for transparency and may not apply in every case. Data is only shared where relevant and necessary. A full list of third-party service providers is available on request.
What personal information do we process and where do we get it from?
Most of the personal information that we process is information that you’ve given us about you and the people who live with you. This includes things like your name, address and telephone numbers. We also process special categories of personal information such as your race or ethnic origin, religion, and information concerning your health or sexual orientation but will only do this where there is a lawful basis for us to do so, for example, where you have consented to us processing your information, where we need to process your information in order to protect your vital interests, or where there are laws that allow us, or require us, to do so. In addition to the above, when we deal with antisocial behaviour cases, we may process information relating to criminal convictions or allegations.
Sometimes we process personal information about you that we’ve been given by other organisations such as the local authority or the Police. This could include, for example, information relating to something like antisocial behaviour. The other organisation would only share this information with us, though, where either you’ve given them permission to do so, or the law allows them to do so.
Who do we share your personal information with?
We sometimes share your personal information with other people or organisations. This includes contractors working for Trivallis; organisations like the Ombudsman, to allow them to process any complaints that you might have made; or the Police and other agencies for the purposes of crime prevention or detection. We only do this, though, if you consent for us to do so, or where there are laws that allow us to do so, or if it’s necessary for us to do so in order for us to provide a service to you.
Do we ever transfer your personal information outside of the UK?
Much of the personal information that we process at Trivallis is held electronically, either in our offices at Pontypridd or off-site in UK data centres. When the information is held off-site, we work closely with our software providers to make sure that this information is stored in accordance with the requirements of the General Data Protection Regulation (GDPR).
Some organisations which provide services to Trivallis may transfer data outside of the UK, but we only allow this if the data is adequately protected and if appropriate safeguards are in place – such as an adequacy decision by the UK Government or the use of approved contractual clauses. You can request more information or a copy of these safeguards by contacting our Data Protection Officer at dataprotection@trivallis.co.uk.
How long do we hold your personal information for?
In connection with dealing with antisocial behaviour, we hold your personal information for a period of six years after the case has been closed and, for complaints and appeals, for two years after the case has been closed. In connection with shared cost work, we hold your personal information for a period of six years after the work has been completed. For claims against Trivallis, we hold your personal information as required in order to meet risk management and legal obligations. Footage from Trivallis’ CCTV cameras is only retained for 30 days. At the end of this time, we’ll securely dispose of your personal information.
When we must hold your personal information for longer than usual due to legal obligations or operational requirements, and where a fixed retention period is not possible, we apply criteria based on the nature of the data and the purpose of processing. Where feasible, we will anonymise data held beyond its standard retention period.
What rights do you have?
You have a number of rights under the General Data Protection Regulation (GDPR).
You have the right to access the personal information that we process about you and, if you believe that the personal information is incorrect or incomplete, to have it corrected or deleted.
You have the right, in certain circumstances, to restrict the processing of your personal data or to object to specific types of processing, including direct marketing. Where processing is based on consent or is carried out by automated means, you may also have the right to data portability, that is, to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
You also have the right to lodge a complaint to a supervisory authority – the Information Commissioner’s Office for the UK.
For more information about your rights under UK data protection law and how your personal data should be handled, you can visit the ICO’s UK GDPR guidance and resources, or please reach out to the DPO at dataprotection@trivallis.co.uk.
How to Raise a Data Protection Concern
If you have concerns about how we process your personal data or believe your data protection rights may have been broken under the Data use and Access Act, you can raise a complaint with us. This may include issues such as delays in response to a data request, concerns over how your data has been used or shared, or dissatisfaction with the outcome of a Subject Access Request (SAR).
Please submit your complaint to our Data Protection Officer by email at dataprotection@trivallis.co.uk. We aim to acknowledge your complaint within 30 calendar days, and we will provide a full response as quickly as possible.
If you are not happy with our initial decision, you may request an internal review, where your case will be looked at again but by a separate reviewer within the organisation.
If you remain unhappy after this internal review, you have the right to take your concern further to the Information Commissioner’s Office (ICO). For more information or to submit a complaint, please visit the ICO’s website: https://ico.org.uk/global/contact-us.
Useful links
For more information on individual’s rights, the Information Commissioner’s website:
https://ico.org.uk
Why do we process your personal information?
We process your personal information, including any special categories of personal information, in connection with surveys that we’re undertaking in order for us to improve the service that we give to you. The legal basis for processing this information may be your consent, or our legitimate interest in evaluating and enhancing our services.
We may require your consent in order to process your personal information. If we do, we will make this clear to you and will not process your information unless you consent to us doing so. You will then be given the option to withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before your consent was withdrawn.
In some instances, we process your personal information because, as a business, we have a legitimate interest in doing so. These interests include gathering feedback to improve our services, understanding user needs and preferences, and evaluating the effectiveness of our communications and engagement efforts. We only do this, though, when we’re confident that you would reasonably expect us to do so. Participation in surveys is entirely voluntary, and the processing of your data for this purpose is not a statutory or contractual requirement.
Summary Table: Legal Bases for Processing Data from Online Surveys
| Purpose of Processing |
Type of Data |
Legal Basis |
Recipients |
Example |
| Gathering feedback to improve services |
Opinions, comments, service ratings |
Legitimate interest |
Internal service improvement teams, survey platform providers, data analysts |
Asking residents about satisfaction with repairs or communication |
| Monitoring equality, diversity, and inclusion |
Demographic data (e.g. age, ethnicity) |
Consent |
EDI officers or teams, data analysts, reporting teams (using aggregated or anonymised data where possible) |
Collecting optional diversity data to inform inclusive service planning |
| Contacting participants for follow-up |
Name, email address (if provided) |
Consent |
Communications team, survey platform providers |
Reaching out to survey participants who opt in for further engagement |
| Analysing trends and reporting |
Aggregated survey responses |
Legitimate interest |
Data analysts, research teams, senior management (using aggregated or anonymised data) |
Using anonymised data to identify service gaps or community needs |
| Prize draws or incentives |
Contact details |
Consent |
Internal administration teams, prize fulfilment partners (only where necessary), finance teams (for processing rewards) |
Entering participants into a draw if they choose to provide contact info |
*Categories of recipients are listed for transparency and may not apply in every case. Data is only shared where relevant and necessary. A full list of third-party service providers is available on request.
What personal information do we process and where do we get it from?
Many of our surveys can be completed anonymously. Sometimes, though, we request that you provide us with your personal information in order for us to improve the service that we give to you. This includes things like your name, address, telephone numbers, date of birth and gender. If we process any special categories of personal information in connection with undertaking surveys, such as your race or ethnic origin, religion, and information concerning your health or sexual orientation, we will only do so where you have consented to us processing your information.
Who do we share your personal information with?
In connection with undertaking surveys, we don’t share your personal information with other people or organisations.
Do we ever transfer your personal information outside of the UK?
Much of the personal information that we process at Trivallis is held electronically, either in our offices at Pontypridd or off-site in UK data centres. When the information is held off-site, we work closely with our software providers to make sure that this information is stored in accordance with the requirements of the General Data Protection Regulation (GDPR).
Some organisations which provide services to Trivallis may transfer data outside of the UK, but we only allow this if the data is adequately protected and if appropriate safeguards are in place – such as an adequacy decision by the UK Government or the use of approved contractual clauses. You can request more information or a copy of these safeguards by contacting our Data Protection Officer at dataprotection@trivallis.co.uk.
How long do we hold your personal information for?
In connection with undertaking surveys, we hold your personal information for a period of two years after you have completed the survey.
When we must hold your personal information for longer than usual due to legal obligations or operational requirements, and where a fixed retention period is not possible, we apply criteria based on the nature of the data and the purpose of processing. Where feasible, we will anonymise data held beyond its standard retention period.
What rights do you have?
You have a number of rights under the General Data Protection Regulation (GDPR).
You have the right to access the personal information that we process about you and, if you believe that the personal information is incorrect or incomplete, to have it corrected or deleted.
You have the right, in certain circumstances, to restrict the processing of your personal data or to object to specific types of processing, including direct marketing. Where processing is based on consent or is carried out by automated means, you may also have the right to data portability, that is, to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
You also have the right to lodge a complaint to a supervisory authority – the Information Commissioner’s Office for the UK.
For more information about your rights under UK data protection law and how your personal data should be handled, you can visit the ICO’s UK GDPR guidance and resources, or please reach out to the DPO at dataprotection@trivallis.co.uk.
How to Raise a Data Protection Concern
If you have concerns about how we process your personal data or believe your data protection rights may have been broken under the Data use and Access Act, you can raise a complaint with us. This may include issues such as delays in response to a data request, concerns over how your data has been used or shared, or dissatisfaction with the outcome of a Subject Access Request (SAR).
Please submit your complaint to our Data Protection Officer by email at dataprotection@trivallis.co.uk. We aim to acknowledge your complaint within 30 calendar days, and we will provide a full response as quickly as possible.
If you are not happy with our initial decision, you may request an internal review, where your case will be looked at again but by a separate reviewer within the organisation.
If you remain unhappy after this internal review, you have the right to take your concern further to the Information Commissioner’s Office (ICO). For more information or to submit a complaint, please visit the ICO’s website: https://ico.org.uk/global/contact-us.
FAQs for Survey Participants: Answers to Common Questions About Your Data
Is my survey response anonymous?
Most surveys are anonymous unless you choose to provide contact details. If anonymity is not possible, we’ll make that clear before you submit.
Why are you collecting this information?
We use survey responses to improve services, understand community needs, and monitor equality and inclusion. Your feedback helps shape better outcomes.
Will my data be shared with anyone?
Survey data may be shared in aggregated or anonymised form for reporting or service planning. We will never share identifiable data without your consent.
Useful links
For more information on individual’s rights, the Information Commissioner’s website:
https://ico.org.uk
Cookie preferences
Managing Cookies
You can manage or disable cookies through your browser settings at any time by clicking on the cookies image on the page. Please note that disabling certain cookies may affect the functionality of the site. For more information about how we use cookies: view our Cookies Policy.
Automated Decisions and Profiling
We do not routinely use automated decision-making or profiling that has legal or similarly significant effects on tenants and non-tenants.
If we ever introduce such processes, we’ll provide clear information about how decisions are made, what data is used, and what it could mean for you. You’ll also have rights to request human review, express your point of view, and challenge the decision.
