01Who we are
Lumina Housing Limited ("LHL", "we", "us" or "our"), company number 16825991, registered office 71-75 Shelton Street, London, England, WC2H 9JQ, is a data controller for the purposes of the UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (registration C1974262). We provide supported exempt accommodation across a portfolio of properties in Birmingham, working under a managed agent model alongside registered providers.
This policy explains how we collect, use, share, retain and protect personal data belonging to residents, prospective residents, staff, contractors, property owners and landlords we work with, and people who visit this website. Different sections apply depending on your relationship with us, so please read the section most relevant to you.
Contact us
Data protection contact: Yaseen A., Director. If you have any question about how we handle your data, or wish to exercise any of the rights in Section 6, email info@luminahousing.co.uk or write to us at the registered office above.
02Personal data we collect
2.1 Residents and prospective residents
- Identity and contact details: name, date of birth, contact number, email, next of kin or emergency contact.
- Referral and eligibility information: referring agency, local authority, benefit, Universal Credit and Housing Benefit (including Exempt Accommodation) status.
- Special category data (where relevant and necessary): health conditions, disabilities and support needs; information revealing racial or ethnic origin, religion or belief, or sexual orientation, where volunteered or necessary to arrange appropriate accommodation.
- Support session records: notes made by support staff during scheduled support sessions, including progress, welfare and any safeguarding observations.
- Safeguarding and incident records, including, in limited circumstances, criminal offence data relevant to a safeguarding concern.
- Tenancy or licence documentation, correspondence, and financial records relating to rent and service charges.
2.2 Staff, directors and contractors
- Identity, contact and right to work information.
- Employment records, including sickness absence and, where relevant, health information needed to make reasonable adjustments.
- Payroll and bank details.
2.3 Property owners and landlords
- Identity and contact details, bank details for rent payment, and lease and property documentation.
2.4 Visitors to this website
- If you contact us through this website by email, phone or WhatsApp, we receive the details you choose to send us and use them to reply.
- This website does not use analytics, advertising or tracking cookies. It saves one setting in your browser so it can remember that you have seen our cookie notice.
- Our fonts are provided by Google Fonts, so your browser connects to Google's servers, which receive your IP address. Like most websites, our hosting provider also keeps standard technical logs to keep the site secure.
03How we use your data and our legal basis
| We use your data to | Legal basis |
|---|
| Assess suitability for a property and arrange onboarding | Contract (Article 6(1)(b)) and, for health or support data, substantial public interest (Article 9(2)(g)) |
| Provide ongoing support and welfare check-ins | Contract (Article 6(1)(b)) and substantial public interest (Article 9(2)(g)) for special category data |
| Verify and administer housing related benefit and Universal Credit eligibility | Legal obligation, statutory and government purposes (Article 6(1)(c) and (e), Schedule 1 paragraph 6 DPA 2018) |
| Respond to safeguarding concerns and protect residents or staff from harm | Vital interests (Article 6(1)(d)) and substantial public interest: safeguarding of individuals at risk (Article 9(2)(g), Schedule 1 paragraph 18 DPA 2018) |
| Manage rent, service charges and financial administration | Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) |
| Manage staff employment and payroll | Contract, legal obligation, and the employment condition (Article 9(2)(b)) for special category data |
| Comply with regulatory, tax and legal obligations | Legal obligation (Article 6(1)(c)) |
| Reply to enquiries sent to us through this website | Legitimate interests (Article 6(1)(f)) |
Further detail on our processing of special category and criminal offence data, including the specific Schedule 1 conditions we rely on, is set out in our Appropriate Policy Document, available on request.
04Who we share data with
We only share personal data where necessary and permitted by law. Recipients may include:
- Registered provider partners: for the purposes of managed agent arrangements and associated Housing Benefit administration.
- Local authorities and the Department for Work and Pensions (DWP): for benefit verification and statutory reporting.
- Referring support agencies and health or social care professionals: where necessary to coordinate a resident's support and safeguarding, and where a lawful basis applies.
- Property owners and landlords: limited information necessary for property management, never resident support records.
- Professional advisers and regulators: including accountants, auditors and the ICO, where required.
- Emergency services: where necessary to protect life or prevent serious harm.
We do not sell personal data, and we do not transfer personal data outside the UK. If this changes, this policy will be updated to explain the safeguards used.
05How long we keep your data
Retention periods depend on the type of data and are set out in full in our Data Retention Policy, available on request. As a general guide: active resident and support files are kept for the duration of the tenancy or licence, plus a limitation period afterwards to deal with any dispute; safeguarding records are kept for longer where necessary to protect vulnerable individuals; and financial records are kept for at least six years in line with HMRC and Companies Act requirements.
06Your rights
Under the UK GDPR, you have the right to:
- Be informed about how your data is used (this policy).
- Access a copy of the personal data we hold about you.
- Rectification of inaccurate or incomplete data.
- Erasure of your data in certain circumstances.
- Restrict or object to certain processing.
- Data portability for data you provided to us that we process by automated means under consent or contract.
- Withdraw consent at any time, where consent is our legal basis, without affecting processing already carried out.
To exercise any of these rights, contact us using the details in Section 1. We will respond within one month. Some rights do not apply in all circumstances. For example, we may need to keep safeguarding records after a rights request where there is an overriding legal reason to do so.
Right to complain
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve your concern directly first.
07Keeping your data secure
We use appropriate technical and organisational measures to protect your data, including access controls on electronic systems, secure storage of paper records, and limiting access to personal data to staff who need it to do their job. Further detail is set out in our internal Staff Data Handling Policy.
08Changes to this policy
We may update this policy from time to time to reflect changes in our processing activities or in the law. The current version is always published on this page.
