The Church of Scotland Housing and Loan Fund is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: Privacy@churchofscotland.org.uk

The purpose of processing the personal data we ask for is to proceed with a loan or house to rent application on your behalf, to comply with legal obligations and where the processing is necessary for the purposes of the legitimate interests in facilitating successful loan or house to rent applications and ensuing loans and tenancies.

Name, name of spouse or civil partner (if applicable), dates of birth of both individual and spouse/partner, number of years served as a Minister in the Church of Scotland, intended retirement date, full address including postcode, email address (for serving Ministers this must be the Church of Scotland email address), home telephone number and mobile telephone number, status (Minister, Widow/er), Parish, occupation of spouse/civil partner (if applicable), details of any dependents living with the applicant: name, age and relationship with the applicant.

The application form then requests various information in relation to whether you have received assistance from the Housing and Loan Fund before, the category of assistance relevant (e.g. house to rent, Shared Appreciation Loan, Standard Loan, Short-term Bridging Loan), what preferred area etc. The application will also collect financial information including national insurance number, tax reference codes, information about income and financial status, bank account details and whether you have a current mortgage. It also requests all details and amounts of both you and your spouse/partner's current accounts, savings accounts, stocks and shares, investment accounts such as ISAs and any other investments (e.g. pensions etc), any liabilities (e.g. credit cards, overdrafts, loans) and any other capital and income including pensions, and Life Assurance Policies or Endowments.

We also collect next of kin contact details who we may contact should we become aware of an emergency involving you and who we may contact in order to discuss the loan or tenancy should you be incapacitated. This information will include a name, or names and contact information such as their address and/or telephone number and/or email address.

We collect this data directly from Housing and Loan Application Forms for assistance and next of kin forms sent to beneficiaries after a loan or tenancy has begun.

The lawful basis for processing the majority of the data is UK GDPR Article 6(1)(b) "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".

For the processing of any special category (sensitive) personal data, the lawful basis is UK GDPR Article 9(2)(d) "processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects."

We use SME Professional Property Software Solutions who are our data processor for administration and management of tenancies. The processor acts only on the instructions of the Church and there is an appropriate contract in place.

It is necessary for the Housing and Loan Fund to share information about you with HMRC, to whom we have a statutory duty to provide annual information about benefits in kind.

Tradespersons may need to have your telephone number to arrange a mutually convenient time to visit you for the purposes of repair or improvement work to your house. Occasionally, Social Services or Occupational Therapists will require information about you, including your contact details, to allow them to make recommendations about mobility aids etc. On rare occasions we may need to contact organisations such as the Police or the Fire Brigade if there are issues with safety. If you live in a property which is looked after by a factoring company, we may need to communicate with them regarding communal repairs etc.

The organisations with which we might share your information include (but are not limited to) Scottish Gas, Local Authorities, the NHS, the Police, the Fire Service, Social Services, Occupational Therapists, Legionella Risk Assessment contractors, factors, tradespersons authorised by us such as plumbers, electricians, central heating engineers, builders, joiners, and roofers.

Landlords may share details about the performance of the Tenant's obligations and past, present and future addresses with other landlords or letting agents, credit and reference providers, utility suppliers and local authority Council Tax and Housing Benefit departments with a view to preventing fraud and dishonesty and for administrative and accounting purposes and debt tracing.

Finally, we ask for details of your next-of-kin, or other person that we could contact in case of an emergency.

If your application to the Fund is unsuccessful we hold your application form and associated information for one year following conclusion of your application. Following this year, your application will be destroyed securely following Church procedures.

If your application has been successful we hold your data for the period of your loan or tenancy agreement and will be held for an additional seven years after the conclusion of the loan or tenancy agreement. Once this period has passed your data will be destroyed securely following Church procedures.

Under data protection laws individuals have a number of rights, these are detailed here.

For the processing of personal data for this purpose all rights apply except for the Right to Object. If you wish to exercise any of your rights, please contact the Data Protection Officer (DPO) at Privacy@churchofscotland.org.uk who will process your request accordingly and without undue delay, within the one month deadline.