Privacy policy

Last reviewed: 30 July 2026.

1. Introduction

Accommodation Concern is committed to protecting the privacy and security of personal information. This Privacy Policy explains how we collect, use, store, and share personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We process personal information to deliver our services, meet our legal responsibilities, and operate as a registered charity.

2. Who We Are

Accommodation Concern
Charity Number: 1146257
Company Limited by Guarantee Number: 07945758
Registered Address: Accommodation Concern, 1 Meadow Road, Kettering, Northamptonshire, NN16 8TL
Telephone: 01536 416560
Email: help@a-c.org.uk

Data Controller: Accommodation Concern
Data Protection Lead: Managing Director

3. What Personal Data We Collect

We may collect and process the following categories of personal information depending on your relationship with us:

3.1 Service Users

Name, address, contact details
Date of birth, gender
National Insurance number
Household, tenancy and accommodation details
Financial information, including income, debt and benefits
Support needs and casework notes
Equality and diversity information, where optional
Special category data where relevant, including physical or mental health, racial or ethnic origin, sexual orientation, religious or philosophical beliefs, and safeguarding information

3.2 Staff, Volunteers & Trustees

Employment or volunteering details
References and recruitment information
Training records
Identification documents
Payroll, bank and pension details
Next of kin
DBS information, where required

3.3 Website Visitors

Aggregated website usage information collected through our self-hosted Plausible Analytics service, such as pages viewed, referral source, broad country-level location, browser, operating system, device type and selected website events
Information submitted through online contact, referral and repair forms
Information saved locally in your browser while you use interactive tools, such as the overcrowding calculator. This remains in your browser unless you choose to include a summary in a referral

4. How We Collect Personal Data

We collect information in the following ways:

Directly from you, including face-to-face, phone, online forms and email
From referral partners, with appropriate authority
From statutory agencies for safeguarding or legal purposes
Through third-party systems we use for casework, HR, accounting or fundraising
Through our self-hosted, cookieless Plausible Analytics service

5. Our Lawful Bases for Processing

Under UK GDPR, we process data under one or more of the following lawful bases:

5.1 Performance of a Contract

To provide you with advice, support, accommodation, or other services you have engaged in with us.

5.2 Legal Obligation

To comply with safeguarding duties, housing or debt legislation, financial reporting requirements and employment law.

5.3 Vital Interests

For protection of life or when someone is at immediate risk of harm.

5.4 Legitimate Interests

To operate and improve our services, including monitoring and evaluating casework, reporting to funders and regulators, managing our systems and IT security, maintaining accurate records, and understanding aggregated patterns in how our website is used.

5.5 Consent

Used only when no other lawful basis applies, such as equalities monitoring, photographs for marketing, and contact preferences for newsletters. You may withdraw consent at any time.

5.6 Special Category Data

Processed under Article 9(2)(d) for not-for-profit bodies providing support to members or beneficiaries, Article 9(2)(g) for substantial public interest such as safeguarding and preventing fraud, Article 9(2)(h) for provision of social care, support or health-related services, and explicit consent where required.

6. Why We Use Your Personal Data

We use personal data to:

Deliver advice and casework
Manage your accommodation or tenancy with us
Communicate with you about your support
Meet funding, auditing, and regulatory requirements, including AQS, MAPS and local authority requirements
Ensure equality, diversity and inclusion monitoring
Keep you safe through safeguarding processes
Manage staff, trustees and volunteers
Keep accurate organisational records
Send updates, newsletters or fundraising information where consent is given

7. Who We Share Your Information With

We share data only when necessary and proportionate. This may include:

7.2 Third-Party Data Processors

Case management systems
HR and payroll providers
Email marketing tools, where opt-in only
Website hosting, self-hosted analytics, IT and cloud storage providers

All third parties are required to comply with UK GDPR and our data protection standards. We never sell our data.

8. International Transfers

Some of the IT and cloud services we use may process or store information outside the UK. Our public website and self-hosted Plausible Analytics service currently run on Railway infrastructure in the United States (US East, Virginia).

Our Plausible service is configured without analytics cookies or persistent visitor identifiers. We do not send names, contact details, referral answers or calculator entries to Plausible.

Where information is transferred outside the UK, we require an appropriate transfer safeguard. Railway's Data Processing Addendum incorporates the UK International Data Transfer Addendum and relevant standard contractual clauses. We review suppliers and international transfers periodically.

9. How Long We Keep Your Data

We retain personal data only for as long as necessary. Typical retention periods include:

Casework records: 6 years after last contact
Safeguarding records: up to 75 years
HR and payroll records: 6 years after employment ends
Finance records: 6 years
Volunteer records: 3 years after involvement ends
CCTV, if used: typically 30 to 60 days
Aggregated website analytics: retained while it remains useful for understanding and improving the website, and reviewed periodically

10. How We Keep Your Data Safe

We use a range of organisational and technical measures to protect personal data, including secure electronic systems, restricted access controls, staff training and confidentiality agreements, encrypted devices where appropriate, and secure disposal methods for all data.

11. Your Rights

You have the following rights under UK GDPR:

Right to be informed about how we use your data
Right of access to your personal data
Right to rectification, meaning correction of inaccurate data
Right to erasure in certain circumstances
Right to restrict processing
Right to data portability
Right to object, for example to marketing
Rights related to automated decision-making, although we do not use these

You can make a request by contacting us at help@a-c.org.uk or calling 01536 416560.

12. Complaints

If you are unhappy with how your data has been handled, you can contact our Data Protection Lead.

You also have the right to contact the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; www.ico.org.uk; telephone 0303 123 1113.

13. Changes to This Policy

We may update this Privacy Policy from time to time.

The most recent version will always be available on our website and at our offices.