This page explains how One Housing Group Limited (or its subsidiaries and brands TPHA, Citystyle, One Direct Maintenance Limited, One Support, Season and Baycroft) collects, uses, stores and shares personal information about you.

Privacy Notice 

Who we are

Season is a brand within One Housing Group Limited (OHGL). OHGL is a controller of personal information for the purposes of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Our head office is located at 100 Chalk Farm Road, London NW1 8EH.

Under the GDPR, One Housing Group Limited has a legal duty to protect any information we collect from you, or have about you from other sources.

The GDPR has a set of rules and guidelines we must follow when handling your personal information. These are referred to as Data Protection Principles.

All personal data we store is held securely and we have security measures in place to protect it.

OHGL is registered with the Information Commissioners Office as a Data Controller. Our registration number is Z687766X.

If you would like to find out more about how we use your personal information, you can contact the Group Data Protection Officer at

How we use and store your personal information

This privacy notice tells you what to expect when we collect and store your personal information.

It also tells you the purposes for which we process your personal information and the legal basis for the processing (‘processing’ includes us keeping your personal information).

It applies to information we collect about:

+ Contractors, suppliers, partners or agents

We will collect relevant information from you in accordance with our contracts or information sharing agreements.

This may include names and qualification information relating to your staff. The purpose is to enable you to provide services to our residents on behalf of OHGL.

Information is held centrally by our Procurement Team and by the relevant team/department, in line with our retention periods. Personal data is held securely and we have security measures in place to protect it.

Care and support customers

When a referral is made on your behalf to OHGL for care or support, we will collect and process personal information about you. We do this, so we can:

  • deliver safe effective care and support   services to you
  • identify your care and support needs and complete   our assessments, so we can offer you the most effective service possible
  • complete risk assessments
  • monitor equality and diversity
  • share information about your care and   support with your family or next of kin in an emergency, and with your   consent.
  • provide assistance to the police in the   event of a Missing Person case
  • update our records of your care and support   needs
  • monitor our premises

Information is held centrally by our Care and Support teams on our computer system, hard copy storage and relevant contact information is held by individual teams in line with our retention periods. Personal data is held securely and we have security measures in place to protect it.

+ Members of the public

We may collect and process personal information about you in the following circumstances:

  • to respond to requests for information   regarding our services
  • to contact you regarding property you have   registered an interest in
  • to comply with relevant legislation and   regulation

Personal information is stored on our computer systems. It is held securely and we have security measures in place to protect it.

Legal basis for processing

We have four main legal bases for processing personal data of prospective Season residents:

  1. Where it is necessary for the performance of a contract (provision of services set out in the tenancy agreement);
  2. Where it is necessary for the purposes of the legitimate interests pursued by OHGL or by a third party to process your information. We can do that as long as we do not interfere with your fundamental rights or freedoms;
  3. Because we have your consent (i.e. agreement) to us processing your personal information. You can withdraw your consent at any time. This is explained further below in the section entitled ‘Your rights under GDPR’;
  4. Where processing is necessary to comply with the law or a statutory obligation.

Other reasons we can rely upon to process your personal information under GDPR are as follows:

  • Where we are under a legal obligation or an obligation under a contract to process/disclose the information.
  • Where we need to protect the vital interests (i.e. health and safety) of you or another person.

Some personal information is treated as special category data, specifically health, sexuality, racial or ethnic background, political opinions, religion, beliefs, trade union membership or genetic and biometric data. The legal basis for processing these special categories of personal data is more limited. To lawfully process special categories of personal data, we must identify a lawful basis for the processing and meet a separate condition for the processing.

The basis we can use are:

  • With your consent;
  • Where we need to protect the vital interests (i.e. the health and safety) of you or another person;
  • Where you have already made your personal information public;
  • Where we or another person needs to bring or defend legal claims;
  • Substantial public interest grounds.

To process personal data about criminal convictions or offences we must have both a lawful basis for the processing and either legal authority or official authority for the processing.

How we manage your personal information

We process your personal information in accordance with the principles of GDPR. We will treat your personal information fairly and lawfully and we will ensure that information is:

  • processed for limited purpose
  • kept up-to-date, accurate, relevant and not excessive
  • not kept longer than is necessary
  • kept secure.

Access to personal information is restricted to authorised individuals on a strictly need to know basis.

We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate.

Who might we share your personal information with?

Normally, only OHGL staff will be able to see and process your personal information. However, there will be occasions when we will need to share personal information with third parties for the purposes as outlined or where we are legally required to do so.

When sharing personal information, we will comply with all aspects of the GDPR. Special categories of personal data about health, sexual life, race, religion and criminal activity for example is subject to particularly stringent security and confidentiality measures.

We also share information:

  • to allow us to tailor our services to you
  • to deal with rent arrears (e.g. tracing and/or debt collection agencies)
  • to deal with unpaid bills, e.g. utility or council tax bills - we may need to pass on your forwarding address

We will also disclose your personal details, if required to do so, by law or any Government body.

We’ll only share the minimum information necessary for the contractor to carry out their services on behalf of OHGL. We will also ensure that data sharing agreements are in place, where we are sharing personal data with data processors. If you have any concerns about a company operating on behalf of OHGL, or information that’s been shared with an external company, please contact  the Group Data Protection Officer at

OHGL will never sell personal information to a third party.

International transfers of personal data

Our website is hosted within the UK. Our other systems are generally located on our premises, or elsewhere within Europe, but some services used for email campaigns, responding to enquiries regarding our care homes and completing online surveys are located outside of Europe.

Where data is transferred outside Europe, we will make sure that transfers will only be made to countries in which the European Commission has made an ‘adequacy decision’, or where appropriate safeguards are in place.

How long do we keep information?

We have a retention schedule, which sets out how long we keep different types of information for. We follow legal requirements and best practice.

Please contact us if you’d like a copy of the schedule.

Your rights under GDPR

Access to personal information

Under the GDPR, you have the right to ask us what personal information we hold about you, and to request a copy of it. This is known as a ‘subject access request’ (SAR).

We have a Subject Access Request form which provides further information to help you submit your request. We will also request photo identification. To make a subject access request, please complete the online form. Alternatively you can email us at, or let us know by contacting customer services at 0300 123 9966.

We will respond to your request with all the information we’re legally required to provide within 30 days.


If you need to correct any mistakes contained in the information we hold about you, you can let us know by contacting customer services at 0300 123 9966.

Erasure (‘right to be forgotten’)

You have the right to ask us to delete personal information we hold about you.

Restriction on processing - You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it.

Objection to processing - You have the right to object to processing where we say it is in our legitimate business interests.

Withdrawal of consent - If the basis on which we are using your personal information is your consentwe will seek your consent to contact you for non-essential services.  

How to contact us

If you want to find out more about this, you can email the Group Data Protection Officer at, or write to Data Protection Officer, 100 Chalk Farm Road, London NW1 8EH. Alternatively, you can find here other ways to contact us.


OHGL aims to meet the highest standards when collecting and using personal information. You can raise a complaint with us if you think that our collection or use of information was unfair, misleading, inaccurate or inappropriate.

If you are still not happy with our response, you have the right to appeal directly to the regulator – the Information Commissioners’ Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113.

Updated May 2019