Privacy Notice

Pattern circle

Identity of Controller

Twenty11 Limited is a controller of personal information for the purposes of the General Data Protection Regulation (‘GDPR’).[i]


Your privacy is important to us. We only collect the information we need and will only use it for the purposes we say we will use it for.  We will not share it with anyone other than who we tell you or we are legally obliged to share it with.

This Privacy Notice tells you the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information).

Why we collect personal information and where we get it from

For you to rent a home from us we need some personal information about you. We obtain this information either directly from you or from Buckinghamshire Council when you bid on a home through Bucks Home Choice. This is to enable us to assess your suitability to enter into a contract with us and manage your tenancy.

We ask for details of your current household when you apply for a tenancy, and when your tenancy is reviewed. You must ensure that you have the consent of household members to provide this. This includes information of you and your household’s income. This is to enable us to assess your suitability for one of our homes and to help determine the rent you will pay. Without this information we will not be able to provide you with a tenancy.  We may need to verify this information through confirming the data you provide with your bank where it relates to bank account details, your employer when it relates to a wage or salary you receive, or the Department of Work and Pensions when it relates to benefits you receive.  We will also carry out a credit check of all adult household members to aid verification of the household information provided, to help determine if there are any issues that may impact on a positive sustainable tenancy – which we would discuss with you. It is important that when you apply you have the permission from all household members and they are aware of the checks we will undertake.

We will also use your personal data so that we provide details of services we, or our partner agencies, offer.  This includes referrals to agencies to support you to accessing advice, support, as well as employment and training opportunities. Where this may include details of your health – we will only do so if you have given explicit consent to do so.

As we are a new company, we want to ensure that we are meeting our core aims, including supporting tenants to reach their potential, so we will be using your data (including special category data you provide) for statistical and research purposes.  We are working with Sheffield Hallam University to carry out the research on our behalf and will be sharing your information in an anonymised format.

Coronavirus pandemic (COVID-19)

During the unprecedented challenges we are all facing during the Coronavirus pandemic, we will be collecting new information to help ensure your safety and the safety of others. We will not keep this information for any longer than necessary. We do not yet know how long the pandemic will continue for, so the requirement to keep this information will be kept under review, and the retention of the data will be reviewed no later than six months after the UK government has declared the pandemic is over.

What information we collect

We only collect the information we need to provide services to you. This is limited to the information we need – we don’t collect information we don’t need or just in case we may need it in the future.

Legal basis for processing

We often have two main legal bases for processing personal data. Firstly, where it is necessary for the purposes of the legitimate interests pursued by Twenty11 or by a third party to process your information. We can do that so long as we do not interfere with your fundamental rights or freedoms.

Secondly, because we have your consent (i.e. agreement) to us processing your personal information. Under the GDPR, consent is a legal basis for processing personal information. You can withdraw your consent at any time. This is explained further below in the section entitled ‘Your rights under GDPR’.

The other reasons we can rely upon to process your personal information under GDPR is as follows:

  • Where we are under a legal obligation or an obligation under a contract to process/disclose the information.
  • Where we need to protect the vital interests (i.e. the health and safety) of you or another person.

We will usually only ask Special Categories of Personal Data if there is a specific reason for this and you consent to us collecting and using this. One example is if you ask for an adaptation to your home, we may need you to provide some information about your health – but only information that is relevant to the adaptation. The other grounds we can rely upon to process special categories of personal data are:

  • Where we need to protect the vital interests (i.e. the health and safety) of you or another person;
  • Where you have already made your personal information public;
  • Where we or another person needs to bring or defend legal claims; and/or
  • Substantial public interest grounds

Who we share data with and why

We only share your details to allow us to manage your tenancy and our homes. This is mainly shared with Red Kite Community Housing, who manage our homes and tenancies on our behalf and their contractors, when we have given them approval to do so, who carry out repairs or planned maintenance works. However, we only share information that is necessary for them to carry out their work. Red Kite and their contractors will only use the data we provide them for the purpose we have shared it with them for – they cannot use the data for any other reason.

We also share information with Experian, which is a credit reference agency, to give details about your rent payments. This is to enable you to achieve a better credit score. We do this as we have a legitimate interest to do so. We make it clear when you sign up to your tenancy that we do this and you are able to opt out at any time.

We may also share information with:

  1. Law enforcement agencies to prevent or detect crime if we are authorised to by law or if we are required to.
  2. The Department of Work and Pensions to ensure you receive the right benefit.
  3. Buckinghamshire Council if you apply for a new home, to tackle tenancy fraud and other legal obligations.
  4. Utility companies such as gas, electricity and water companies to provide your name and your date of occupancy of your property.
  5. With the HCA when monitoring Red Kite’s activities in its capacity as the regulator of Housing Associations.

Where we need your consent

From time to time, we may pass your details to other agencies who may be able to help you (such as debt advice agencies or the Job Centre Plus) – for example, as part of a Personal Success Plan. We will only do this if we have your consent to do so.

How we store your data

We store all our data on our servers which are in the UK or Ireland. We do not store or transfer data outside of the European Economic Area. We ensure everyone we share information with also stores any information they hold about you within the European Economic Area.

We will only hold your records during the period of our relationship with you and for a set period afterwards to allow us to meet our legal obligations including resolving any follow up issues between us.

Your rights under the GDPR

You have a number of rights under the GDPR:

Access to personal information

Under the GDPR, you have a right to ask us what personal information we hold about you, and to request a copy of your information. This is known as a ‘subject access request’ (SAR). SARs need to be made in writing and we ask that your written request is accompanied with proof of your identify. We have one calendar month within which to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible).

Following your SAR, we will provide you with a copy of the information we hold that relates to you. This will not generally include information that relates to your property such as repair logs or details of contractor visits, as this is not considered personal information.


If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting us using the contact details below.

Erasure (‘right to be forgotten’)

You have the right to ask us to delete personal information we hold about you. You can do this where:

  • the information is no longer necessary in relation to the purpose for which we originally collected/processed it
  • where you withdraw consent
  • where you object to the processing and there is no overriding legitimate interest for us continuing the processing
  • where we unlawfully processed the information
  • the personal information has to be erased in order to comply with a legal obligation.

We can refuse to erase your personal information where the personal information is processed for the following reasons:

  • to exercise the right of freedom of expression and information;
  • to enable functions designed to protect the public to be achieved e.g. government or regulatory functions
  • to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
  • for public health purposes in the public interest;
  • archiving purposes in the public interest, scientific research historical research or statistical purposes;
  • the exercise or defence of legal claims; or
  • where we have an overriding legitimate interest for continuing with the processing.

Restriction on processing

You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

  • You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
  • You challenge whether we have a legitimate interest in using the information
  • If the processing is a breach of the GDPR or otherwise unlawful
  • If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

Objection to processing

You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

Withdrawal of consent

You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.

Right to data portability

The right to data portability allows us to obtain and reuse your personal data across different services. It allows us to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. The right only applies to personal data you have provided to us where the reason we are relying on to use the information is either your consent or for the performance of a contract. It also only applies when processing is carried out by us using automated means.

Who to contact and further information

For further information on how to request your personal information and how and why we process your information, you can contact us using the details below:

By email: 

By post:
Data Protection Officer
Twenty11 Limited
Windsor Court
Kingsmead Business Park
Frederick Place
High Wycombe
HP11 1JU

The Information Commissioner (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, and one of their primary functions is to administer the provisions of the GDPR.

You have the right to complain to the ICO if you think we have breached the GDPR. You can contact the ICO at:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

0303 123 1113  /

[i] By this we mean the Regulation as supplemented and amended by the Data Protection Act 2018