Legal information including privacy and cookie notices for all Curo Group websites

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. You will still be able to use this website, but it may prevent you from taking full advantage of it.

 

‘Customer’ means anyone who receives a service (such as renting a home or other property) from Curo.

Curo Group and its associated companies (‘Curo’) is a housing association and house-builder based in Bath providing homes and high quality care and support services across the West of England. Curo is committed to respecting your right to privacy and to processing your personal information in a lawful, fair and transparent way. As a Data Controller, all personal data we hold about you will be processed in line with the UK General Data Protection Regulations (‘GDPR’) and the Data Protection Act 2018.

The following summarises:

• How we use personal data
• What personal data we need
• Why we need it
• How we use it
• Who we might share it with, and
• How long we will keep it for

It also sets out the rights you have regarding any of the personal data held by Curo.   From time to time we may update this Notice. Any updates will be posted on our website.

What is personal data?

Personal data is any information relating directly or indirectly to a living individual. This information includes things such as a name, an identification number, location data, online identifier or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

What personal data do we process?

We only collect personal data for specific, clear and legitimate purposes and we will not process it for purposes that differ from those we have notified you about.   We will limit our use of your personal data to what is needed, relevant to, and necessary for the purposes we have identified. Access to your personal data is given only to those who need to process it for the purposes identified. We will ensure that we keep your personal data accurate and up to date, and will not store it for longer than is necessary.

The types of personal data we collect includes (but are not limited to):

Name, address, phone number(s), email address(es), other identifiers (for example social media user names), financial, medical/health, behavioural, criminal offence/conviction, religious beliefs, trades union membership or political opinions, images, CCTV, audio recordings, location data, disability information, profiling information and other information such as next of kin and copies of ID documentation.

We collect this information in a number of ways, including (but not limited to) information we collect directly from you, for example when you:

• interact with our website and social media platforms 
• become a customer
• access your account online
• call our customer contact department
• make an enquiry
• book a repair
• participate in surveys
• attend meetings with us
• purchase services or products from us
• raise a complaint or request
• participate in our events
• attend our business premises covered by CCTV

We also collect information from third party sources, for example, credit referencing agencies, landlord and other references, data analysis companies and local authorities.

Why do we process personal data?

Our processing of your personal data is necessary for us to provide services to you, maintain our relationship with you and to fulfil our legal obligations. We use personal data for the following reasons:

• Finding you a suitable home
• Managing your property and delivering home improvements
• Managing tenancies and compliance
• Providing community services
• Health, safety and wellbeing
• Managing enquiries
• Managing your accounts
• Selling properties or shares in properties
• Supporting you in your home
• Managing our suppliers and contractors
• Improving customer experience
• The management and governance of our businesses
• Fulfilling our legal obligations
• Supporting you to build a credit history

How do we process your personal data?

The GDPR gives companies a number of lawful reasons to collect and process personal data. Below are the lawful reasons we rely upon and the types of processing activities that relate to each:

Performance of a Contract: In some circumstances it is necessary to process your personal data in order to fulfil our contractual obligations with you. Without this information we would not be able to provide a service to you. For example:

• Setting up and administering leasehold, shared owner and freehold accounts
• Pursuing overdue payments
• Managing and delivering repairs
• Issuing notices
• Administering grants
• Managing tenancies and Estates queries
• Property sales
• Delivering services to support independent living
• Administering customer accounts
• Making payments to customers and suppliers
• Tenancy compliance and management
• Administering resident involvement groups
• Creating and administering tenancy agreements and lettings
• Trade enquiries and requests and managing subcontractors/suppliers
• Administering abandoned goods

Legal Obligation:

In some circumstances it is necessary to process your personal data so we can comply with our legal obligations. Without this information we would not be able to fulfil our legal obligations to you, the authorities, or regulatory and statutory bodies. For example:

• Service of notices in connection with residential and commercial property management
• Supplier/subcontractor compliance
• Preparation of legal matters
• Administering public liability claims
• Sharing benefit payment information with the relevant authority
• Risk and assurance, including fraud monitoring and investigation
• Tenancy/lettings management and administration, for example processing ID for Right to Rent and Direct Lets, and processing documentation for signature
• Home Safety compliance and complaint resolution
• Providing support to and protection of customers, for example administering safeguarding procedures
• Sharing information with local authorities, such as electoral register

Legitimate Interest:

There are situations where processing your personal data is necessary to pursue our legitimate interests as a business. We have to balance our interests as a business with yours as an individual, so that our legitimate interests do not override your interests, rights or freedoms.

For example:

• Planning and delivering home improvements
• Delivering health and safety standards
• Conducting surveys and reports including customer feedback surveys and quality assurance
• Managing our properties and tenancies
• Administering customer accounts and properties
• Providing customer support, for example texting customers about rent statements and referring to other agencies
• Receiving and recording enquiries from the public, customers and suppliers and administration
• Recording calls for monitoring, training, complaint and auditing purposes
• Housebuilding project work
• Supplier and subcontractor checks and administration
• Carrying out and administering suitability assessments and reports in relation to the Independent Living Service
• Generating records in the course of carrying out our business activities, including notes, meeting minutes and associated documentation, general correspondence
• Organising, planning and administering events, including generic publicity material
• Processing details of properties and tenants on Curo’s ICT systems
• Customer segmentation analysis
• Recording images via CCTV or other photographic means and noise monitoring for security and investigation purposes
• Carrying out audits, quality assurance and maintaining databases
• Investigating, monitoring and reporting issues and reportable events
• Managing complaints and enquiries
• Lettings management, for example administration of credit checks and referencing
• Tendering and procurement processes
• Supporting tenants to build a credit history through the Rental Exchange programme with Experian
• Administering applications for Curo grants
• Sending customers and stakeholders information about Curo services via email, text, social media and letter
• Providing customers with translations and interpretations
• Management of resident involvement groups
• Risk assessment and social value monitoring
• Case management
• Risk flag management
• Business continuity and emergency
• Business continuity and emergency
• Progressing open market sales
• Analysing traffic to our website
• To facilitate colleague training and improvement
• Graduate schemes and scholarships

Consent:

In some situations, we will ask you for your consent to collect and process your personal data, for example:

• When you interact with us via our website and social media, for example Twitter and Livechat
• Through cookies when interacting with our website
• Attending events
• Contact information when purchasing a home from us or making an expression of interest in our properties
• Administering our Working Well and Employability schemes
• Parolee resettlement
• Requests from customers
• Taking photographs for publicity
• Customer support in connection with tenancy compliance
• Recording third party permissions

Vital Interests:

Occasionally, we may need to process your personal data when it is necessary to protect your life, for example, in an emergency situation where you cannot give consent.

Special category data

Sometimes, we will need to process more sensitive personal data, known as ‘Special Category’ data. This type of information includes personal data about your race, ethnic origin, political opinions, religious beliefs, trade union memberships, biometrics, health/medical information and sexual orientation. We use special category data to better understand your needs, provide a better service and to comply with our legal and statutory duties for example under health and safety, social protection and/or equality legislation. When we collect and process (including sharing) this data we will rely on one of the following additional purposes to process it:

• Explicit consent;
• Employment, social security and social protection law;
• Already made public by you;
• Legal claims;
• Substantial public interest purposes including equality of opportunity/treatment or
• Health or Social Care law

Sometimes it will be necessary to process personal information relating to criminal prosecutions, proceedings, sentencing or convictions. In those circumstances we will rely on one of the following additional grounds to process (including sharing) this personal data:

• Consent;
• Employment, social security and social protection law;
• Protecting vital interests;
• Already made public by you;
• Legal claims;
• Judicial acts;
• Preventing or detecting unlawful acts or
• Health or Social Care purposes

Who we share your personal data with

In order to provide you with a service and to fulfil our business objectives and legal obligations, there are many situations where it is necessary to share your personal data with third parties. In such circumstances we will share your data with the following categories of organisations/individuals:

• Regulatory requirements , legal and compliance, such as the Department for Work and Pensions, NHS, legal representatives, auditors
• Suppliers and contractors such as mortgage advisors, trades and sites, Sirona, subcontractors, trades or organisations tendering for work, All Pay, MailChimp
• Referencing and credit checking companies
• Utilities companies
• Other housing associations
• Platforms for electronic signature of documents, such as SignRequest
• CCTV, security and safety device providers
• Local authorities, police, our external partners, social services, contract funders and support agencies, such as HCRG Care Group, to fulfil our contractual or legal obligations
• ICT service providers and software companies, such as Microsoft, Survey Monkey, Eventbrite and hosted and in- house providers including MyCuro and Voicebox, and Google
• Other colleagues, departments and companies within Curo Group

How long will we keep your personal data?

We will only keep your personal data for as long as necessary and for the purpose for which it was collected. When it is no longer necessary to keep your personal data we will delete it. Our policy for deciding how long we keep personal data is based on National Housing Federation best practice guidance and our legal obligations.

Examples:

• When we obtain your bank details to make a refund we will destroy the personal data once the refund has been processed
• Personal data collected from credit checks is kept until the start of a tenancy or acceptance of it
• Tenancy agreements will be retained for six years after the end of the tenancy to comply with our legal obligations and industry guidance.

Sometimes, we may need to retain data for analytical, statistical or research purposes. In these circumstances we will anonymise or pseudonymise your personal data so you will not identifiable.

Profiling

Sometimes we use personal data (including personal data obtained from third-party data gathering organisations) to help us generate customer profiles based on lifestyle and behaviours. We use this information to deliver a more customised customer experience and ensure services are delivered appropriately.

Security and sharing your personal data outside the EEA

We ensure that appropriate security measures are in place when handling your personal data. Occasionally, we may share your data with third party suppliers outside of the European Economic Area (‘EEA’), for example we use Survey Monkey which has servers in the USA. In such circumstances, we ensure that your personal data will receive the same protection as if it were being shared within the EEA by ensuring that our contracts contain a requirement for suppliers to adhere to the same strict data privacy requirements as us.

Your data rights

You have the following rights over your personal data:

The right to request:

• Access to your personal data free of charge, unless the request is unfounded or excessive.
• Correction of your personal data if it is inaccurate or incomplete.
• To have your personal data deleted or removed where there is no good reason for processing to continue.
• Processing of your data to be restricted, subject to certain criteria.
• Your data is moved, copied or transferred to another platform, subject to certain criteria.

If you make such a request, we will respond to it within one month of your request. In some circumstances we may require an extension to this time period and will notify you of the reasons for this. If we refuse your request, we will inform you of the reason(s) and of your right to complain to the Information Commissioner’s Office (see details below) within one month of your request.

You also have the following rights:

• To object to us processing your personal data where we have relied upon legitimate interests to process, subject to certain criteria.
• Not to be subject to a decision made on the basis of automated profiling, if that decision produces legal or a similarly significant effect on you, subject to certain criteria.

The right to withdraw your consent

Where you have given consent for us to process your personal data, you have the right to withdraw your consent at any time. Please contact us at the email or phone number below.

Direct Marketing

You have the right to object to us processing your personal data for direct marketing purposes. If you would like to stop receiving our marketing communications, please contact us at the email or phone number below.

Checking Identity

In order to protect confidentiality we will ask you to verify your identity before responding to any request made under this privacy notice. If a third party makes a request on your behalf, we require proof that you have given your permission for them to act on your behalf.

Contact Details for Further Information

The Curo Group incorporates the following two companies and four charitable registered societies in England and Wales. Each company and society is a Data Controller:

• Curo Enterprise Limited (ICO ZA223885)
• Curo Market Rented Services Limited (ZA236884) Four charitable registered societies:
• Curo Group (Albion) Limited (ICO Z659867X)
• Curo Places Limited (ICO Z6598589)
• Curo Choice Limited (ICO Z6627936)
• Mulberry Park Community Benefit Society (ICO ZA461268)

The registered office for all organisations in the Group is: The Maltings, River Place, Lower Bristol Road, Bath BA2 1EP.

If you have any queries or questions about the data we hold about you, please contact our Data Protection Officer at privacy@curo-group.co.uk or phone 01225 366000.

Contacting the Information Commissioner’s Office

If you are unhappy with the way we have handled your personal data or our response to a request you have made to us, you have the right to complain to the Information Commissioner’s Office:

Information Commissioner's Office details: Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

0303 123 1113
casework@ico.org.uk
www.ico.org.uk/concerns

---

Curo Customer Privacy Notice. Reference number: G001. Version number 008

'Other stakeholders' includes members of the public, suppliers, partner organisations and any other interested parties.

Curo Group and its associated companies (‘Curo’) is a housing association and house-builder based in Bath providing homes and high quality care and support services across the West of England.  Curo is committed to respecting your right to privacy and to processing your personal information in a lawful, fair and transparent way. As a Data Controller, all personal data we hold about you will be processed in line with the General Data Protection Regulations (‘GDPR’) and data protection laws. 

The following summarises:

• How we use personal data
• What personal data we need
• Why we need it
• How we use it
• Who we might share it with, and
• How long we will keep it for

It also sets out the rights you have regarding any of the personal data held by Curo. From time to time we may update this Notice, any updates will be posted on our website. 

What is personal data? 

Personal data is any information relating directly or indirectly to a living individual.  This information includes ‘identifiers’ such as a name, an identification number, location data, email address or social media name, or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

What personal data do we process?

We only collect personal data for specific, clear and legitimate purposes and we will not process it for purposes that differ from those we have notified you about.   We will limit our use of your personal data to what is needed, relevant to, and necessary for, the purposes we have identified. Access to your personal data is given only to those who need to process it for the purposes identified. We will ensure that we keep your personal data accurate and up to date, and will not store it for longer than is necessary. 

The types of personal data we collect includes (but is not limited to):

Name, address, phone number(s), email address(es) (including work email addresses), other identifiers (for example social media user names), financial, medical/ health, behavioural, criminal offence/ conviction, religious beliefs, Trades Union Membership or political opinions, images, CCTV, audio recordings, location data, disability information, profiling information and other information such as next of kin, copies of ID documentation.

We collect this information in a number of ways, including (but not limited to):

Information we collect directly from you, for example when you:

• Interact with our website and social media platforms
• Become a business partner or tender for contracts with us
• Provide information to us, including via phone, email or other correspondence
• Generate documents, records and other information in the course of your relationship with us, for example, when carrying out work on our behalf
• Make an application to us, for example applying to work with us or applying for a Curo grant
• Participate in surveys or provide feedback to us
• Attend meetings with us
• Provide services or products to us or deliver services on our behalf
• Raise a complaint or request or are involved in an incident on our premises
• Participate in our events
• Attend any of our premises covered by CCTV surveillance
• Are engaged in a sale or purchase of leasehold, shared ownership or freehold property
• You are a guarantor, next of kin, power of attorney or agent acting on behalf of a Curo customer or stakeholder

Please note that "us", "we" and "our" in the list above includes times where we are operating as Homes for the South West.

We also collect information from third party sources, for example, private and organisational references, the Data Barring Service and the Bath and North East Somerset Homesearch Register.

Why do we process personal data?

Our processing of your personal data is necessary for us to provide services to our customers, to maintain relationships with our stakeholders, and to fulfil our business objectives and legal obligations. We use personal data for the following reasons:

• Providing homes and general properties
• Managing properties and delivering home improvements
• Managing tenancies and compliance
• Providing community services
• Health, safety and wellbeing
• Managing enquiries
• Managing our customers’ accounts
• Selling properties
• Supporting out tenants in their homes
• Managing our suppliers and contractors
• Improving customer experience
• The management and governance of our businesses
• Fulfilling our legal obligations

How do we process your personal data?

The GDPR gives companies a number of lawful reasons to collect and process personal data.  Below are the lawful reasons we rely upon and the types of processing activities that relate to each:

Performance of a Contract:

In some circumstances it is necessary to process your personal data in order to fulfil our contractual obligations with you. Without this information we would not be able to fulfil our business and legal obligations to you.  For example:

• Your provision of goods and services to us, or on our behalf, such as making payment to you
• When you make a request for a Direct Let Form
• Using the documents, paperwork and other information given and generated by you during your engagement with us (whether contractual or pre-contractual)
• Tenancy and customer account management, such as contacting family members and householders following the death of a tenant, or when carrying out a success plan
• Completing reservation forms in connection with house purchases
• Administering trade enquiries, including processing information contained in request forms
• Carrying out sub-contractor and supplier company search administration, such as conducting company financial and background checks
• Processing purchase orders
• Carrying out assessments before being housed by Curo
• Providing support to customers in our Enabling Independent Lives schemes, such as providing contact details of a partner organisation support worker to a customer or completing assessments containing third party support worker details
• In the preparation of our company records, such as processing emoluments
• In the preparation of agreements, such as confidentiality agreements
• Processing next of kin details, for example in connection with the creation of tenancies or providing support
• In connection with customer tenancy compliance and management, such as investigating incidents connected with the Housing Management Function

Legal Obligation:

In some circumstances it is necessary to process your personal data so we can comply with our legal obligations.  Without this information we would not be able to fulfil our legal obligations to you, the authorities, or regulatory and statutory bodies. For example:

• Recording, investigating and administering health and safety related matters
• Carrying out and administering subcontractor and supplier checks, such as checking appropriate insurance and carrying out fraud checks
• In connection with legal matters, such as disputes, infringements and public liability claims
• For risk and assurance purposes, such as monitoring, investigating and reporting issues and reportable events
• Carrying out Right to Rent checks
• Tenancy management and compliance, including administering and attending multi agency meetings, administering tenancies following the death of a tenant
• Carrying out our company secretarial duties, including preparing and maintaining company records

Legitimate Interest:

There are situations where processing your personal data is necessary to pursue our legitimate interests as a business. We have to balance our interests as a business with yours as an individual, so that our legitimate interests do not override your interests, rights or freedoms.  For example:

• Administering applications for Curo grants
• Carrying out financial checks on new suppliers and subcontractors
• Maintaining procurement schedules
• Administering next of kin details
• Carrying out surveys, for example to gain opinion on Universal Credit
• Providing support services to our customers, such as processing third party information contained in assessments and other documentation to support Independent Living Service customers
• Managing suppliers and contractors
• Recording images via CCTV or other photographic means and using noise monitoring for security and investigation purposes
• Sharing safeguarding information with the local authority or police
• For targeted media releases
• Maintaining a key contacts list for emergency situations, including details of journalists and partner organisation contacts
• To support tenancy compliance and management, including investigating third party incidents connected with the Housing Management Function and managing risk
• Carrying out risk assessments and impact assessments
• Business strategy, financial management, budgeting and forecasting
• Shaping and influencing regional and national policy
• Gathering information relating to planned housing regeneration and refurbishment projects
• Key management relating to our properties, including monitoring and investigating breaches of our key management policy
• In connection with recruitment and candidate selection
• Sending information about Curo services and activities to stakeholders on a business to business basis
• Administering and organising events
• To carry out general administration of our business, including, recording meetings, producing minutes, agendas, distribution lists, contact directories, and general correspondence
• Maintaining our supplier database and records
• Carrying out third party checks, including Data Barring Service and qualifications checks
• Carrying out and administering tender submissions
• Maintaining our CRM, Finance and Housing Management Systems, for example recording information relating to our properties
• Responding to queries and complaints
• Maintaining records relating to suppliers, developers and subcontractors
• Administering sales, including recording progress, completed and withdrawn applications
• Analysing traffic to our websites, including the Homes for the South West website 
• Taking photographs for publicity or marketing

Consent: 

In some situations, we will ask you for your consent to collect and process your personal data, for example:

• Interacting with us via social media, for example Twitter and Live chat
• Through cookies when interacting with our website
• When attending our events
• Obtaining contact information when purchasing a home from us or making an expression of interest in our properties so we can to send you information about our products and services
• Making a request or notification to us
• Acting as a guarantor, next of kin, power of attorney or other agent
• Administering our Employability and Working Well schemes
• Assessing volunteering viability and linking community support across our Social Prescribing schemes in North East Somerset Community Connect and South Gloucestershire Community Connectors
• Administering general enquiries and requests, such as those received via social media platforms and phone
• Parolee resettlement
• Recording third party permissions 

Vital Interests:

Occasionally, we may need to process your personal data when it is necessary to protect your life, for example, in an emergency situation where you cannot give consent.

Special category data

Sometimes, we will need to process more sensitive personal data, known as ‘Special Category’ data.  This type of information includes personal data about your race, ethnic origin, political opinions, religious beliefs, trade union memberships, biometrics, health/ medical information and sexual orientation.   When we collect and process this data we will rely on the following additional purposes to process it:

• Explicit Consent
• Employment, social security and social protection law
• Already made public by you
• Legal Claims
• Public Interest

Sometimes it will be necessary to process personal information relating to criminal prosecutions, proceedings, sentencing or convictions.  In those circumstances we will rely on one the additional grounds to process this personal data:

• Consent
• Protecting vital interests
• Already made public by you
• Legal claims
• Judicial acts
• Substantial public interest

Who we share your personal data with

In order to provide you with a service and to fulfil our business objectives and obligations, there are many situations where it is necessary to share your personal data with third parties.  In such circumstances we will share your data with the following categories of organisations/individuals:

• Regulatory, legal and compliance, such as the Department for Work and Pensions, NHS, legal representatives and auditors
• Suppliers and contractors, such as trades and sites, subcontractors, All Pay and consultants
• Referencing and credit checking companies
• Other housing associations
• CCTV, security and safety device providers
• Local authorities, police, our external partners, social services, contract funders, support agencies
• IT service providers and software companies, such as Microsoft, Survey Monkey, Eventbrite, Google and hosted in-house providers such as MyCuro and VoiceBox 
• Other colleagues, departments and companies within Curo Group 

How long will we keep your personal data?

We will only keep your personal data for as long as necessary and for the purpose for which it was collected.  When it is no longer necessary to keep your personal data we will delete it.  Our policy for deciding how long we keep personal data is based on National Housing Federation best practice guidance and our legal obligations.

Examples: 

• Contracts will be retained for 6 years after the end of the contract
• Emails from members of the public making general enquiries will be kept for as long as necessary to deal with the enquiry and deleted as soon as possible thereafter

Sometimes, we may need to retain data for analytical, statistical or research purposes.  In these circumstances we will anonymise or pseudonymise your personal data so you will not be identifiable.

Profiling

Sometimes we use personal data obtained from Greenstone, a third party data gathering organisation, to help us generate customer profiles based on lifestyle and behaviours. We use this information to deliver a more customised customer experience. 

Security and sharing your personal data outside the EEA

We ensure that appropriate security measures are in place when handling your personal data.

Occasionally, we may share your data with third party suppliers outside of the European Economic Area (‘EEA’), for example we use Survey Monkey which has servers in the USA.  In such circumstances, we ensure that your personal data will receive the same protection as if it were being shared within the EEU by ensuring that our contracts contain a requirement for suppliers to adhere to the same strict data privacy requirements as us. 

Your data rights

You have the following rights over your personal data:

The right to request:

• Access to your personal data free of charge, unless the request is unfounded or excessive. 
• Correction of your personal data if it is inaccurate or incomplete.
• To have your personal data deleted or removed where there is no good reason for processing to continue. 
• Processing of your data to be restricted, subject to certain criteria.
• Your data is moved, copied or transferred to another platform, subject to certain criteria.

If you make such a request, we will respond to it within one month of your request. In some circumstances we may require an extension to this time period and will notify you of the reasons for this. If we refuse your request, we will inform you of the reason(s) and of your right to complain to the Information Commissioner’s Office (see details below) within one month of your request. 

You also have the following rights:

• To object to us processing your personal data where we have relied upon legitimate interests to process, subject to certain criteria. 
• Not to be subject to a decision made on the basis of automated profiling, if that decision produces legal or a similarly significant effect on you, subject to certain criteria. 

The right to withdraw your consent: 

Where you have given consent for us to process your personal data, you have the right to withdraw your consent at any time.  Please contact us via the contacts below. 

Direct Marketing

You have the right to object to us processing your personal data for direct marketing purposes.  If you would like to stop receiving our marketing communications, please contact us at the email or phone number below. 

Checking Identity

In order to protect confidentiality we will ask you to verify your identity before responding to any request made under this privacy notice.  If a third party makes a request on your behalf, we require proof that you have given your permission for them to act on your behalf. 

Contact details for further information

The Curo Group incorporates the following two companies and four charitable registered societies in England and Wales.  Each company and society is a Data Controller:

• Curo Enterprise Limited (ICO No. ZA223885)
• Curo Market Rented Services Limited (ICO No. ZA236884) 

Four charitable registered societies:

• Curo Group (Albion) Limited (ICO No. Z659867X)
• Curo Places Limited (ICO No. Z6598589)
• Curo Choice Limited (ICO No. Z6627936)
• Mulberry Park Community Benefit Society (ICO No. ZA461268) 

The registered office for all organisations in the Group is: The Maltings, River Place, Lower Bristol Road, Bath BA2 1EP.

If you have any queries or questions about the data we hold about you, please contact our Data Protection Officer at privacy@curo-group.co.uk or phone 01225 366000.

Contacting the Information Commissioner’s Office

If you are unhappy with the way we have handled your personal data or our response to a request you have made to us, you have the right to complain to the Information Commissioner’s Office:

Information Commissioner's Office details:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF                                    

0303 123 1113

casework@ico.org.uk

www.ico.org.uk/concerns

---

Curo Stakeholder Privacy Notice. Reference number: G002. Version number 004.

Privacy Notice for Job Applicants and Candidates

We at Curo manage our recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.

In this privacy notice, we explain how we process your personal data if:

1. You visit our Career Site (you being a “Visitor”)
2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
3. You apply for a position with us, via our Career Site or a third-party service (you being an ”Applying Candidate”)
4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This privacy notice also describes what rights you have when we process your personal data, and how you can exercise these rights.

When we use the term “Candidate” in this privacy notice, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.

1. About processing of personal data

Personal data is all information that directly or indirectly relates to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address.

Processing of personal data includes storing, sharing, and deleting personal data.

The UK General Protection Regulation (UK GDPR) and the Data Protection Act 2018 govern how UK companies may process personal data.

Most obligations under UK GDPR apply to the Data Controller. A Data Controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The Data Controller can use a Data Processor. A Data Processor is an entity that is only allowed to process personal data as instructed by the Data Controller and may not use the personal data for its own purposes.

We are the Data Controller when we process your personal data as described in this privacy notice.

2. What personal data do we process?

All individuals

• Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
• Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
• Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
• Contact details - Such as your name, email address, telephone number and physical address.

Candidates

• Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
• Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
• Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
• Information provided in our equality monitoring form - for example ethnicity, gender, faith which we collect for the purposes of monitoring and analysing our recruitment process (and which you are not obliged to provide).
• Information about your entitlement to work in the UK

3. Where do we receive your personal data from?

All individuals

• From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
• Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or to provide you with the information you request from us.

References

• From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
• From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
• From your references. If you provide us with references, we may collect information about you from them.
• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.

4. For what purposes do we process your personal data?

Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.

Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Share your personal data with other recipients, for the purposes mentioned in Section 5 below.

Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Collect information about your use of the career site, using cookies and other tracking technologies, as described in our Cookie Policy.

Affected individuals: Visitors.

Categories of personal data used: Device information.

Maintain, develop, test, and otherwise ensure the security of the career site.

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance.

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Provide you with updates about vacancies with us.

Affected individuals: Connecting Candidates.

Categories of personal data used: Contact details; Communications data.

Review profiles and applications sent to us. This also includes communicating with you about your application and profile.

Affected individuals: Connecting Candidates; Applying Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.

Affected individuals: Sourced Candidates; Referred Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Contact you directly about specific, future vacancies with us.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Record the interview(s) with you.

Affected individuals: Candidates.

Categories of personal data used: Communications data.

Contact you to ask for your participation in surveys

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Contact you to ask you to provide information about a candidate and evaluate the information you provide.

Affected individuals: References.

Categories of personal data used: Contact details; Communications data.

5. Whom do we share your personal data with?

Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.

Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.

Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy notice. You can find information about which cookies this applies to in our Cookie Policy.

To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.

To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.

6. On what lawful bases do we process your personal data?

To be able to process your personal data, we need to have a  lawful basis. A lawful basis is a reason for processing the personal data that is justified under UK GDPR.

When we process your personal data for the purposes described in this Privacy Notice, the lawful basis we rely on is normally that the processing is necessary for our legitimate interest in being able to recruit talent with the relevant competence for us. We have concluded that we have a legitimate interest in being able to perform the personal data processing for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose.

You can contact us for more information about how this assessment was made. See Section 9 and 10 below for our contact information.

There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we ask you if we can record an interview with you. Please see Section 9 below for more information about your right to withdraw your consent.

7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then?

We always strive to process your personal data within the UK or the EU/EEA.

However, some of our service providers process your personal data outside of the UK or the EU/EEA. We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the UK or EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the UK or EU/EEA, for example because of an authority request.

In cases where another recipient of your personal data (as described in Section 5 above) is based outside the UK or EU/EEA, this will also mean that your personal data is transferred outside the UK or EU/EEA.

When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the UK GDPR is used to enable the transfer. We use the following safeguards:

• A decision by the EU Commission that the country outside of the UK or EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the EU General Data Protection Regulation (EU GDPR). In particular, we rely on the EU Commission’s adequacy decision for the US via the  EU-US Data Privacy Framework.
• Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the UK or EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the EU GDPR still applies, and that your rights are still protected.

When your personal data is transferred outside the UK or EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.

If you want more information about the cases in which your personal data is transferred outside the UK or EU/EEA you can contact us using the contact details in Section 9 and 10 below.

8. For how long do we keep your personal data?

All individuals

If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.

Visitors

We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.

Candidates

If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.

For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.

If you don’t succeed in the initial recruitment process, we keep your personal data on file for 12 months after the recruitment process.  At the end of this period, we will contact you to ask your permission to keep your information in our talent pool for relevant future job openings. If you do not respond within 1 week, your information will be removed. You also have the opportunity at any time, to request that your information is removed immediately.

If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.

References

We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.

9. What rights do you have, and how can you exercise them?

In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular lawful basis.

In order to exercise any of the rights listed below, please either:

• Visit the Data & Privacy page on our Career Site;
• Log in to your account with us, where you can use the settings in the account to exercise your rights; or
• Contact us directly at privacy@curo-group.co.uk.

Right to be informed

You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.

We provide you with such information through this privacy notice, through updates on our Career Site (see also Section 11 below), and by answering any questions you may have for us.

Right to access your personal data.

You have the right to know if we process personal data about you, and to receive a copy of the data we process about you.

Right to access and to request a transfer of your personal data to another recipient (“data portability”).

You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.

Right to have your personal data deleted (“right to be forgotten”).

In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)

Right to object against our processing of your personal data.

You have the right to object to processing of your personal data, which is based on our legitimate interest, by referencing your personal circumstances.

Right to restrict processing.

If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described above, you can also request us to restrict processing of that personal data while we make our assessment of your request.

When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.

Right to rectification.

You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.

Right to withdraw your consent.

When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.

Right to raise a complaint.

For more information on your rights to make a complaint or your data protection rights more generally, please visit the Information Commissioner’s Office (ICO) website at www.ico.org.uk

10. Where can you turn with comments or questions?

If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to privacy@curo-group.co.uk.

11. Updates to this Privacy Notice

We update this privacy notice when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.

We encourage you to regularly check this page for any changes.

 

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Our website may contain links to other websites of interest. If you click a link to an external website you will leave our site; you should note that we do not have any control over that other website. We cannot, therefore, be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Curo authorises you to copy documents or pages published by Curo on this website for your own non-commercial use only, provided that your copies retain all copyright or other proprietary notices and any disclaimer contained in such documents or pages.

Our website uses Google Analytics to analyse the traffic on our website. For more information on Google's services please see here.

Curo does not represent or endorse the accuracy or reliability of any of the content contained in or distributed through, linked, downloaded or accessed from any of the pages contained in this website. Links on this site may lead to websites and servers maintained by third parties over whom Curo has no control.

All mapping on this website is © Crown copyright 2010. All rights reserved. Ordnance Survey Licence number 0100031184.

Download our retention schedule here:

The Curo Group incorporates:

Three companies registered in England and Wales:

• Curo Enterprise Limited (Co. No. 08103621) 
• Curo Market Rented Services Limited (Co. No. 4705482)
• Curo Finance Limited (Co. No. 13596265)

Four charitable registered societies under the Co-operative & Community Benefit Societies Act 2014.

• Curo Group (Albion) Limited (FCA No. 7945, Registered Provider registration number No. LH4336)
• Curo Places Limited (FCA No. 7091, Registered Provider registration number No LH4209)
• Curo Choice Limited (FCA No. 24208R) and
• Mulberry Park Community Benefit Society (FCA No. 7696)

The registered office for all organisations in the Group is The Maltings, River Place, Lower Bristol Road, Bath BA2 1EP.

VAT registration numbers

• Curo Group, Curo Places, Curo Market Rented Services and Curo Choice (known as Curo VAT Group) VAT Registration No. 791 1340 40.
• Curo Enterprise VAT Registration No. 165 0574 10.

If you’re a third-party solicitor enquiring about our insurance policy details and Portal ID:

• For Employers Liability our insurer is Zurich Municipal, policy number JHA-22S078-0073 and the portal compensator ID C00108. 
• For Public Liability our insurer is Zurich Municipal, policy number JHA-22S078-0073 and the portal compensator ID C00108. 

These terms shall be governed by and construed in accordance with English law. By using this website you hereby agree to submit to the exclusive jurisdiction of the English courts.