Privacy Policy

New York City Housing Development Corporation Internet Privacy Policy

Thank you for visiting the New York City Housing Development Corporation (HDC) website. This website is designed to make it easier and more efficient for individuals and businesses to interact with HDC. HDC recognizes that it is critical for individuals and businesses to be confident that their privacy is protected when they visit our website.

Consistent with the provisions of the Internet Security and Privacy Act, the Freedom of Information Law, and the Personal Privacy Protection Law, this policy describes HDC's privacy practices regarding information collected from users of this website. This policy describes what information is collected and how that information is used.

HDC does not rent or sell personal information (e.g., information such as name, address, phone number, e-mail, etc., or other information that identifies or could lead to the identification of a user as a particular person), nor would HDC exchange or trade such information with third-parties without a user's explicit permission.

HDC only collects personal information that is provided voluntarily by sending an e-mail or initiating an on-line transaction and/or form through the HDC website, including but not limited to Housing Connect.  This includes information that is submitted to HDC as part of compliance and monitoring requirements.  

I. Information Collected and Stored Automatically When You Visit this Website

While visiting the HDC website, certain information is collected automatically. This information does not identify you personally but may identify the computer used to access this website. The following information about your visit is automatically collected and stored:

  1. The Internet Protocol Address and domain name used, but not the e-mail address. The Internet Protocol Address is a numerical identifier assigned either to your Internet service provider or directly to your computer;
  2. The type of browser and operating system you used;
  3. The date and time you visited this site;
  4. The web pages, services and/or forms you accessed at this site;
  5. The website you visited prior to coming to this website;
  6. The time spent on each page of this website and the total time spent on this website;
  7. The language that you view the website in;
  8. The type of device, either mobile or personal computer, you used to access this website; and
  9. The general physical location (for example, the city and state) of your internet access via the Internet Protocol Address. 

None of the foregoing information is deemed to constitute personal information.

The information that is collected automatically may be collected through the use of web beacons via a third-party provider. This information is used to improve this website's content and to help HDC understand how users are interacting with the website. This information is also collected for statistical analysis, to determine what information is of most and least interest to our users, and to improve the utility of the material available on the website. This information is not collected for commercial marketing purposes, and HDC is not authorized to sell or otherwise disclose information collected from the website for commercial marketing purposes.

II. Retention of Information Collected Through this Website

The information collected through this website is retained by HDC in accordance with the records retention and disposition requirements of the New York State Arts & Cultural Affairs Law. Information on the requirements of the Arts & Cultural Affairs Law may be found at https://www.archives.nysed.gov/records/laws-arts-and-cultural-affairs-57-05

In general, the Internet services logs of HDC, comprising electronic files or automated logs created to monitor access and use of HDC services provided through this website, are retained for approximately one year and thereafter, depending on the type of data, some files or logs are destroyed while others are maintained by HDC. For example, some personal information that you submit is retained in accordance with HDC's retention and disposition policies as required under applicable law. Information concerning these records retention and disposition policies may be obtained through the Privacy Compliance Officer listed in this policy.

III. Information Collected When You E-mail this Website

During your visit to this website you may send an e-mail to HDC. Your e-mail address and the contents of your message will be collected. The information collected is not limited to text characters and may include audio, video, and graphic information formats included in the message. Your e-mail address and the information included in your message will be used to respond to you, to address issues you identify, to improve this website, or to forward your message to the appropriate party. Your e-mail address is not collected for commercial marketing purposes, and HDC is not authorized to sell or otherwise disclose your e-mail address for commercial purposes.

IV. Information Collected When You Complete an On-line Transaction

During your visit to this website, you may initiate a transaction like creating an application on Housing Connect, going through the sponsor review process and completing a disclosure compliance package, or interacting with any other applications linked to the HDC website. The information, including personal information, volunteered by you in initiating the transaction is used by HDC to operate HDC programs, which include the provision of goods, services, and information. The information collected by HDC may be disclosed by HDC for those purposes that may be reasonably ascertained from the nature and terms of the transaction in which the information was submitted (for example, if you add users to your WebLoans account, HDC may be able to retain information on those additional users.)

V. Cookies

Cookies are text files, or entries in larger files, used to distinguish between visitors to a website, and to track information during one or more visits to a website. The use of cookies is a standard practice among Internet websites. To better serve you, HDC uses cookies to enhance or customize your visit to the HDC website. Cookies can be created automatically on the device you use to access the HDC website. These cookies do not contain personal information and do not compromise your privacy or security. HDC uses the cookie feature to store a randomly generated identifying tag on the device you use to access this website. Cookies are stored in your web browser, and most web browsers provide you with options to accept or block them. If you choose to accept cookies, you can control how long to retain them and when they are cleared from your device. However, refusing or deleting these cookies may limit your ability to take advantage of some features of this website.

VI. Information and Choice

As noted above, HDC does not collect any personal information about you during your visit to this website unless you provide that information voluntarily by sending an e-mail or initiating an on-line transaction. You may choose not to send us an email or complete an on-line transaction.  While your choice not to participate in these activities may limit your ability to receive specific services or products through this website, it will not prevent you from requesting services or products from HDC by other means and will not normally have an impact on your ability to take advantage of any other features of this website, including browsing or downloading publicly available information.

VII. Minors

HDC does not knowingly collect personal information from minors or create profiles of minors through this website. Users are cautioned, however, that the collection of personal information submitted in an e-mail or a transaction will be treated as though it was submitted by an adult, and may, unless exempted from access by federal or state law, be subject to public access. HDC strongly encourages parents and teachers to be involved in minors' Internet activities and to provide guidance whenever minors are asked to provide personal information on-line. HDC further asks that minors ask for and receive their parent's permission before providing any information online.

VIII. Security and Monitoring

In certain instances, a user may have the opportunity to receive or create a password to access or submit personal information. One should not divulge a password to anyone, and HDC will never ask a user for a password in a telephone call, fax, e-mail or other form of unsolicited communication. When a user is finished with an application or applications that are password protected, such user should exit the relevant page(s). If the browser used to access said password protected pages is a publicly-accessible browser, users should close down the entire session and, if applicable or possible, flush any temporary caches or other areas where such a password might be stored subsequent to use, and log out of all applications.

HDC maintains efforts to integrate industry standard or better security measures and systems into the design, implementation and day-to-day operation of HDC’s website and its underlying servers and networks.   Furthermore, HDC maintains ongoing efforts to identify and/or block unauthorized intrusions into or onto the HDC website, and to upload to or change information on or otherwise cause damage to the HDC website or the information resident hereon or submitted hereto. 

For site security purposes and to ensure that this service remains available to all users, HDC employs software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. Unauthorized attempts to upload information or change information on this service are strictly prohibited and may be punishable under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act, and such other federal, state or local laws as applicable.

IX. Disclosure of Information Collected Through This Website 

The collection of information through this website and the disclosure of that information are subject to the provisions of the Internet Security and Privacy Act. HDC will only collect personal information through this website or disclose personal information collected through this website if the user has provided such personal information. Participation in an online transaction resulting in the voluntary disclosure of personal information to HDC by the user, whether solicited or unsolicited, constitutes consent to the collection and disclosure of the information by HDC for the purposes reasonably ascertainable from the nature and terms of the transaction.

However, HDC may collect or disclose personal information without user consent if the collection or disclosure is: (1) necessary to perform the statutory duties of HDC, or necessary for HDC to operate a program authorized by law, or authorized by state or federal statute or regulation; (2) made pursuant to a court order or by law; (3) for the purpose of validating the identity of the user; or (4) of information to be used solely for statistical purposes that is in a form that cannot be used to identify any particular person.

Further, the disclosure of information, including personal information, collected through this website is subject to the provisions of the Freedom of Information Law and Personal Privacy Protection Law.
The act of using HDC’s website constitutes the user’s express consent to HDC’s monitoring of all uses of the system. If such monitoring reveals possible evidence of criminal activity or any other unauthorized use, system administration personnel may provide your information to law enforcement or other officials, as authorized or required by law.

HDC may share information with other government agencies for the limited purpose of facilitating services and benefits, in accordance with all applicable federal, state, and local laws and regulations.

X. Health Care Information

Any third party subject to the Health Insurance Portability and Accountability Act of 1996 and its regulations (collectively, "HIPAA") that creates, receives, maintains, or transmits via HDC’s website any Protected Health Information (“PHI”), as that term is defined by HIPAA, must comply with HIPAA’s Privacy and Security Rules.  Each third party subject to HIPAA must also require its Business Associates, as that term is defined by HIPAA, to comply with HIPAA when, on behalf of HDC, each such Business Associate creates, receives, maintains, or transmits PHI hosted by HDC. Nothing stated herein shall be interpreted to diminish the compliance requirements imposed by any other applicable law or policy.

XI. Third Party Links

HDC provides links to, and may be linked from, local, state and federal government agencies, and from, or to, other websites. The existence and/or provision of those links neither constitutes nor implies endorsement of the destination or departure website(s) or of the content, viewpoint, accuracy, opinions, policy(ies), product(s), accessibility or privacy policy of said destination or departure website(s). Nor does any link between the HDC website and a third-party website imply sponsorship of such website, or the creator of such website.

Some content on portions of the HDC website resides on servers run by third parties, which have their own privacy policies. 

XII. Intellectual Property

The content of the HDC website is copyrighted and contains some third-party images/graphics that are used with permission. Users are notified, therefore, that one should presume the need to obtain permission from the copyright holder before reproducing or otherwise using images/graphics from this website.

XIII. Access to and Correction of Personal Information Collected Through this Website

Any user may submit a request to the HDC Privacy Compliance Officer to determine whether personal information pertaining to that user has been collected through this website. Any such request shall be made in writing to privacy@nychdc.com. After the request is received, proof of identity will be required in order to accommodate the request.

The Privacy Compliance Officer shall, within five (5) business days after the date of the receipt of a proper request: (i) provide access to the personal information; (ii) deny access in writing, explaining the reasons therefore; or (iii) acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not be more than thirty (30) days from the date of the acknowledgment.

In the event that HDC has collected personal information pertaining to a user through the HDC website and that information is to be provided to the user pursuant to the user's request, the Privacy Compliance Officer shall inform the user of his or her right to request that the personal information be amended or corrected under the procedures set forth in Section 95 of the Public Officers Law.

XIV. Confidentiality and Integrity of Personal Information Collected Through this Website

HDC is strongly committed to protecting personal information collected through this website against unauthorized access, use, or disclosure. Consequently, HDC limits employee access to personal information collected through this website to those employees who need access to the information in the performance of their official duties. Employees who have access to this information are required to follow appropriate procedures in connection with any disclosures of personal information.

In addition, HDC has implemented procedures to safeguard the integrity of its information technology assets, including, but not limited to, authentication, monitoring, auditing, and encryption. These security procedures have been integrated into the design, implementation, and day-to-day operations of this website as part of our continuing commitment to the security of electronic content as well as the electronic transmission of information.

For website security purposes and to maintain the availability of the website for all users, HDC employs software to monitor traffic to identify unauthorized attempts to upload or change information or otherwise damage this website.

XV. Disclaimer

The information provided in this privacy policy should not be construed as giving business, legal, or other advice, or warranting as fail proof, the security of information provided through this website.  We reserve the right to make changes to our web privacy policy at any time.  Changes will be posted on this page along with the privacy policy revision date.

XVI. Contact information

For questions regarding this Internet Privacy Policy:
Email: privacy@nychdc.com

Updated as of January 26, 2024