Guidance

Homes England: privacy notice

Updated 23 January 2024

Applies to England

Homes England (the trading name adopted by the Homes and Communities Agency) is committed to protecting the privacy and security of your personal data.

This privacy notice aims to give you information on how Homes England collects and processes the personal data provided to us, including information that you provide directly, and tell you about your rights and how the law protects you.

Homes England’s websites are not intended for use by children and we do not knowingly collect personal data that could identify individual children.

Please use the glossary to help you understand the meaning of some of the terms used in this privacy notice.

1. Users of our website and web portals

This section of our privacy notice applies to all individuals who visit our websites or provide information to us via one of our web portals.

It is important that you read this section of our privacy notice together with the main section of our privacy notice, or any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you. This is so that you are fully aware of how and why we are using your data.

1.1 Gov.uk and third party links

Please note that our Gov.uk web address is provided to us by the Government Digital Service (GDS). Please ensure that when visiting this website that you read the GDS privacy notice to understand how this may affect your personal data.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

1.2 Information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data, data such as:

• Identity data - includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, nationality and gender
• Contact data - includes billing address, residential address, delivery address, email address and telephone numbers
• Financial data - includes bank account and payment card details and information about the financial status of you or your business, including ownership structures and shareholdings etc.
• Transaction data - includes details about payments to and from you and other details of products and services you have purchased from us
• Technical data - includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
• Profile data - includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Procurement data - includes information that we may need to obtain and consider to ascertain in connection with UK and EU public procurement legislation (eg whether grounds for exclusion under the Public Contracts Regulations 2015 may apply)
• Usage data - includes information about how you use our website, products and services
• Marketing and Communications data - includes your preferences in receiving marketing from us and our third parties and your communication preferences

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data is data that may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity.

For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

We do not request any ‘special categories’ of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).

However, we recognise that where you are applying for a service or product, or tendering to provide goods, services or works, you may choose to provide us with information that falls within the definition of special categories of personal data.

For example, when you are using our Property Consents web portal to apply for our consent to make alternations to a property, you may decide to supply information about any mobility related issues faced by occupants in support of your application.

You are not required to provide any special category information as part of any application you make to us and your application will still be processed if you do not provide it.

Special categories of particularly sensitive personal information require higher levels of protection than other personal data. Where you do supply such information, we will rely on the ground that it is being processed by us in furtherance of the establishment and exercise of your legal rights.

1.3 If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested by us, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services).

In this case, we may have to cancel a product or service you have with us, or decline your application, but we will notify you if this is the case at the time.

1.4 How is your personal data collected?

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, Contact, Financial Data and Procurement Data by filling in forms (eg Know your customer form) or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide or that you may have provided when you:
  • apply for our products or services
  • complete KYC (know your customer) or CDD (customer due diligence)
  • create an account on our website
  • subscribe to our service or publications
  • request marketing to be sent to you
  • enter a competition, promotion or survey
  • submit a tender or quote
  • give us feedback
  • have applied for products in the past, such as the Get Britain Building funding or Build to Rent funding
• Automated technologies or interactions. As you interact with our website, or those of third parties, we may automatically collect Technical Data and Procurement Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.
• Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources as set out in the GOV.UK cookie settings information and as detailed below:
  • Technical data from the following parties:
    • analytics providers such as Google based outside the EU
    • search information providers inside or outside the EU
  • Contact, Procurement Financial and Transaction data from providers of technical, payment and delivery services inside or outside the EU
  • Identity Procurement and Contact data from data brokers or aggregators based inside or outside the EU
  • Identity Procurement and Contact data from credit reference agencies and CDD providers, publicly availably sources such as Companies House and the Electoral Register based inside the EU

1.5 How we process your information

We will only process your personal information if there is a lawful basis to do so. Most commonly, we will use your personal information in the following circumstances:

• When processing is necessary for the performance of a contract or when processing is required prior to entering into a contract with you
• When processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions
• When processing is necessary for compliance with a legal or regulatory obligation
• To prevent and detect crime, including fraud

Generally we do not rely on consent as a legal basis for processing your personal data.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where it is this is required or permitted by law.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

1.6 Ways that we can use your personal data

Purpose or activity	Type of data	Lawful purpose for processing
To register you as a new customer or supplier and to comply with our customer due diligence and “know your customer” (CDD/KYC) processes	* Identity * Contact * Procurement	* Performance of a contract with you * Necessary in the public interest to prevent and detect fraud and money laundering * Necessary to comply with a legal obligation
To process and deliver your application for a service or product (or process a tender or quote supplied by you in response to our tendering an opportunity to provide goods, works or services, and to enter into a contract for the supply of any of these) including: * To manage payments, fees and charges * To collect and recover money owed to us * To evaluate and monitor our exposure to you including credit risk * To evaluate a tender or quote that you submit in accordance with our procurement policies and the Public Contracts Regulations 2015	* Identity * Contact * Financial * Transaction * Marketing and Communications * Procurement	* Performance of a contract with you * Necessary in the public interest (eg to recover debts due to us or to perform our statutory functions) * Necessary to comply with a legal obligation
To manage our relationship with you which will include: * Notifying you about changes to our terms or privacy notice * Asking you to leave a review or take a survey	* Identity * Contact * Profile * Marketing and Communications * Procurement	* Performance of a contract with you * Necessary to comply with a legal obligation including obligations to prevent and detect fraud and money laundering * Necessary in the public interest (to keep our records updated and to study how customers use our products/services) or how suppliers interact with us when we are considering purchasing goods, service and works from them
To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	* Identity * Contact * Technical	* Necessary for the public interest (for running our business, provision of administration and IT services, network security, to prevent and detect fraud and money laundering and in the context of a business reorganisation or group restructuring exercise) * Necessary to comply with a legal obligation
To use data analytics to improve our website, products/services, marketing, customer and supplier relationships and experiences	* Technical * Usage	Necessary in the public interest (to define types of customers for our products and services, and suppliers from whom we purchase goods, works and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To provide information to Government about the take-up and effectiveness of our programmes and to compile National Statistics	* Identity * Contact * Financial * Transaction Marketing and Communications Procurement	Necessary in the public interest to compile National Statistics (compiled from Aggregated Data) and provide information to Government

1.7 Disclosures of your personal data

We require all Third Parties to respect the security of your personal data and to treat it in accordance with the law.

We may share your personal data with Third Parties for the purposes set out in the table above including third-party service providers, regulatory bodies and other Government departments and agencies.

For example, our e-tendering tool (ProContract) is hosted by ProActis (Due North). If you register to use the ProContract e-tendering system, you will be required to agree to the ProActis Terms and Conditions of using the system, and also their privacy notice.

We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We or our Third Parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

1.8 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.

Details of retention periods for different aspects of your personal data are available in our retention schedule.

By law we have to keep basic information about our customers and suppliers (including Contact, Identity, Financial and Transaction Data) for a certain period after they cease being customers for tax and VAT purposes.

In some circumstances you can ask us to delete your data: see the Data Rights section for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

2. Help to Buy: Equity Loan

This privacy notice explains how we collect, use and protect your personal data; and the rights you have with regards to that data.

This notice applies to the processing of your personal data through the Help to Buy: Equity Loan scheme.

Who also collect data for the same purposes as detailed in this notice for older legacy schemes including:

• First Time Buyers Initiative
• First Buy
• HomeBuy Direct
• Kickstart HomeBuy Direct

Please refer to the Homes England main privacy notice for further information on how we process personal data for other purposes.

2.1 Who we are

Homes England is the trading name adopted by the Homes and Communities Agency, our legal entity.

We are the data controller of the personal data processed. This means that we are responsible for deciding how we collect, use, and store your personal data.

2.2 Information we collect

Homebuyers

We collect personal data from you directly when you express an interest in or complete the PIF (Property Information Form), for a Help to Buy property. The types of data we collect are:

• Name(s) of applicant(s)
• Date of birth
• Address history up to 3 years at the point of application
• Contact details
• Address details of the property to be purchased
• Financial information (such as bank details, purchase price and income(s))
• Opinions (that may lead to identification)

We also collect data about you from other sources, such as joint applicants, credit reference or fraud prevention agencies, such as:

• the types of data listed above from the joint applicant. This should have been discussed with you by them prior to completing and submitting the application.
• either confirmation of accuracy or identification of irregularities of the types of data listed above
• details that identify your suitability/eligibility for the product you have applied for

Developers

We collect personal data directly from you when you or your business register to develop Help to Buy homes through the Homes England IMS (Investment Management System) portal and through the Developer Portal on the My First Homes website. The types of data we collect are:

• Name(s) of applicant
• Date of birth
• Contact details
• Financial information

We also collect data about you from other sources such as your business if you are a person of influence, and credit reference or fraud prevention agencies, such as:

• the types of data listed above from the business registration application. All parties should be aware before submitting the application.
• either confirmation of accuracy or identification of irregularities of the types of data listed above
• details that identify the suitability and eligibility for the product your business has applied for

2.3 How we process your information

We use the personal data stated above for the following purposes:

Homebuyers

To assist you to progress your Help to Buy application (Lawful basis: Contract)

Assessing your application, including performing identity, credit, and fraud checks (Lawful basis: Contract; Legal Obligation, Public Task)

Transferring your data to a credit reference or fraud prevention agency (Lawful basis: Public Task)

Deciding as to whether to accept your application (Lawful basis: Contract)

Administration your Equity Loan via our equity loan administrator (Lawful basis: Contract)

To ensure Homes England’s security is protected by way of registration of a second charge against the property (Lawful basis: Contract)

To detect, investigate, report, and prevent financial crime such as fraud or breaches of contract (Lawful basis: Contract; Legal Obligation, Public Task)

Sending marketing material relevant to your relationship with us (Lawful basis: Consent)

To allow you to participate in research of the Help to Buy product (Lawful basis: Consent)

Developers

To assist you to progress your application (Lawful basis: Contract)

Assessing your or your businesses application for registration to build, including performing identity, credit, and fraud checks (Lawful basis: Contract, Legal Obligation, Public Task)

To detect, investigate, report, and prevent financial crime such as fraud or breaches of contract (Lawful basis: Contract; Legal Obligation, Public Task)

Deciding whether to accept your application (Lawful basis: Contract)

Ongoing management of your contract (Lawful basis: Contract)

To assist you in accessing the Developer Portal (Lawful basis: Public Task)

Find out more about how Target Servicing Limited use cookies that are placed on the Developer Portal of the ‘My First Homes’ website.

2.4 What lawful basis do we have to process your personal data?

We are only able to use your personal data when the law allows us to. This is called the lawful basis. Regarding the above purposes, the lawful basis stated for each are explained below:

Contract – processing your data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

Public Task – processing your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions.

Legal Obligation – processing your data is necessary for compliance with a legal obligation.

Consent – you have given us your consent to process your personal data for the specific purpose we have explained to you.

When performing check on applicants as part of the assessment process, we may collect personal data related to criminal convictions. When we do so, we also rely on the following legal basis:

Unlawful Acts – processing your data to prevent or detect whether a law has been broken.

Fraud – processing your data to prevent fraud from taking place.

2.5 Who is the information shared with?

We use service providers to help administer the Help to Buy scheme. When we use these service providers, it is necessary for us to share your personal data with them, or for them to collect and share your personal data with us.

The main service providers and why they need your personal data are listed below:

• The Help to Buy Agent you applied through (to log and process your application)
• The Help to Buy equity loan administrator (to administer your Equity Loan)
• Solicitors and other legal professionals (to collect relevant information required to process your application, such as identity and proof of funds and administer your Help to Buy: Equity Loan and protect Homes England’s security)
• First Charge Mortgage Lenders (to administer your Help to Buy: Equity Loan)
• A RICS (Royal Institution Chartered Surveyors) approved valuer (when we need to obtain a valuation for redemption purposes)
• Credit reference and fraud prevention agencies (please see “Credit Reference and Fraud Prevention” for more detail)
• Our IT infrastructure providers (to provide secure data storage and power our internal systems such as our email and phone service.)
• Communication systems (to provide Help to Buy specific communications to you, such as account updates, research projects and, if consent is provided, marketing material)

Sometimes, we may be legally obliged to provide copies of personal information to other organisations. For example, to provide information to the police, or to a public inquiry.

We might not be always able to tell you that we have shared your information in this way, however we will ensure this is only shared in accordance with the law.

2.6 Where is your personal data stored and processed?

All personal data is stored and processed by Homes England, the Help to Buy Agents and the Help to Buy equity loan administrator within offices in the UK and using systems that utilise data centres in the UK.

If one of our service providers ever processes data outside the UK, we will ensure this is only where we can ensure that your personal data is adequately protected.

2.7 How long do we keep your personal data?

If you entered, or took steps to enter, into a contract, we will store your data for a period of six years after the end of your relationship with us. This is so we can comply with our general legal obligations and for the exercise or defence of any legal claims.

2.8 Credit Reference and Fraud Prevention

Credit Reference Checks

We carry out credit and identity checks when you either (a) apply for Help to Buy: Equity Loan, or (b) apply to be a registered Developer under the Help to Buy: Equity Loan scheme, for you or your business. We use credit reference agencies (CRAs) to help us with this. We will share your personal data with CRAs, and they will give us information about you.

If you are successful in your application, from time to time we may also search information that the CRAs have, to help us manage those accounts. We will go on sharing your personal data with CRAs for as long as you are a customer.

When we ask CRAs about you or your business, they will note it on your credit file. This is called a credit search. Other lenders may see this, and we may see credit searches from other lenders.

If you apply for a product with someone else, we and the CRAs will link your records with theirs. You should tell them about this before you apply for a product or service.

For more detail on how your personal data will be used by us and the CRAs, please read “Our use of Credit Reference Agencies”.

Fraud Prevention Agencies (FPAs)

The personal data we have collected from you will be shared with FPAs who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment.

Further details of how your information will be used by us and these FPAs, and your data protection rights, can be found by reading “Our use of Fraud Prevention Agencies”.

2.9 Your rights

Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data as described in this notice:

• right of access to personal data;
• right to correction or rectification;
• right to request deletion; and
• right to data portability.

Homes England must respond to a request to exercise these rights within one month. If you would like to submit a request, please contact the data protection officer.

2.10 Data Protection Officer

The contact details for our data protection officer are:

Post:
The Data Protection Officer, Homes England, Windsor House, 50 Victoria Street, London, SW1H 0TL

Telephone:
0300 1234 500

Email:
DPO@homesengland.gov.uk

2.11 Complaints

If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, please contact our data protection officer.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO)

• Email: casework@ico.org.uk

3. Help to Build: Equity Loan

3.1 About this notice

This privacy notice explains how we collect, use and protect your personal data; and also the rights you have with regards to that data.

This notice applies to the processing of your personal data through the Help to Build: Equity Loan scheme.

Please refer to Homes England’s main privacy notice for further information on how we process personal data for other purposes.

3.2 Who we are

Homes England is the trading name adopted by the Homes and Communities Agency, our legal entity.

We are the data controller of the personal data processed. This means that we are responsible for deciding how we collect, use and store your personal data.

3.3 Information we collect

Customer(s)

We collect personal data from you directly when you express an interest in or apply for a Help to Build: Equity Loan to build a property under the scheme. The types of data we collect are:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information (such as bank details, purchase price and income(s))
• opinions (that may lead to identification)
• equal opportunities data
• Help to Build: Equity Loan account number

We also collect data about you from other sources, such as joint applicants, the Land Registry, credit reference or fraud prevention agencies. This data includes:

• the types of data listed above from the joint applicant. This should have been discussed with you by them prior to completing and submitting the application
• either confirmation of accuracy or identification of irregularities of the types of data listed above
• details that identify your suitability/eligibility for the product you have applied for

3.4 How we process your information

We use the personal data stated above for the following purposes:

Register your interest in the Help to Build: Equity Loan scheme

Data processed:

• name(s)
• contact details

Lawful basis for processing:

• contract

To assist you to manage your Help to Build: Equity Loan application

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information

Lawful basis for processing:

• contract

Assessing your application, including performing identity, credit, and fraud checks

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• financial information
• data from other sources

Lawful basis for processing:

• public task
• legal obligation

Transferring your data to a credit reference or fraud prevention agency

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• financial information

Lawful basis for processing:

• public task

Deciding as to whether to accept your application

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information
• data from other sources

Lawful basis for processing:

• contract

Administration of your equity loan via our equity loan administrator, mortgage provider, conveyancing solicitors and RICS valuers

Data processed:

• name(s)
• date of birth
• contact details
• address
• financial information
• Help to Build: Equity Loan account number

Lawful basis for processing:

• contract

To detect, investigate, report, and prevent financial crime such as fraud or breaches of contract

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information
• data from other sources

Lawful basis for processing:

• contract
• legal obligation
• public task

Sending marketing material relevant to your relationship with us

Data processed:

• name(s)
• contact details

Lawful basis for processing:

• consent

To allow you to participate in market research

Data processed:

• name(s)
• contact details

Lawful basis for processing:

• legitimate interests

To allow us to monitor the effectiveness of equal opportunities to the scheme

Data processed:

• equal opportunities data

Lawful basis for processing:

• consent (explicit consent)

3.5 What lawful basis do we have to process your personal data?

We are only able to use your personal data when the law allows us to. This is called the lawful basis. Regarding the above purposes, the lawful basis stated for each are explained below:

Contract - Processing your data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

Legal obligation - Processing your data is necessary for compliance with a legal obligation.

Public task - Processing your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions.

Legitimate interests - Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.

Consent - You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so please contact the Data Protection Officer using the details provided below.

What about more sensitive data?

As part of the Help to Build: Equity Loan scheme, we may ask you to provide more sensitive personal data known as ‘special category personal data’ under the law. Where we do this, we rely on the ‘condition for processing’ stated in brackets for the purpose. These conditions are explained below:

Explicit consent - you have given us your explicit consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so, please contact the Data Protection Officer using the details provided below.

What about criminal offence data?

When performing checks on applicants as part of the assessment process, we may collect personal data related to criminal convictions. When we do so, we also rely on the following legal basis:

Unlawful acts - processing your data to prevent or detect whether a law has been broken.

Fraud - processing your data to prevent fraud from taking place.

3.6 Who is the information shared with?

We use service providers to help deliver and administer the Help to Build scheme. When we use these service providers, it is necessary for us to share your personal data with them.

The main service providers and why they need your personal data are listed below:

Our IT infrastructure providers

To provide secure data storage and power our internal systems such as our email and phone service.

The mortgage lender you have chosen

To log and process your application.

The Help to Build: Equity Loan administrator

To administer your equity loan.

Legal advisers/solicitors

To collect relevant information required to process your application, such as identity and proof of funds.

A RICS (Royal Institution of Chartered Surveyors) approved valuer

When we need to discuss or process your valuation.

Credit reference and fraud prevention agencies

Please see ‘Credit Reference and Fraud Prevention’ for more detail.

Our communication systems

To provide Help to Build specific communications to you, such as account updates, research projects and, if consent if provided, marketing material.

Sometimes, we may be legally obliged to provide copies of personal information to other organisations. For example, to provide information to the police, or to a public inquiry. We might not be always able to tell you that we have shared your information in this way, however we will ensure this is only shared in accordance with the law.

3.7 Where is your personal data stored and processed?

All personal data is stored and processed by Homes England within offices in the UK and using systems that utilise data centres in the UK.

If one of our service providers ever processes data outside the UK, we will ensure this is only where we can ensure that your personal data is adequately protected.

3.8 How long do we keep your personal data?

We will store your data for period of 6 years after the end of your relationship with us. This is so we can comply with our general legal obligations and for the exercise or defence of any legal claims.

3.9 Credit Reference and Fraud Prevention

Credit Reference Checks

We carry out credit and identity checks when you apply for a Help to Build: Equity Loan. We use credit reference agencies (CRAs) to help us with this. We will share your personal data with CRAs, and they will give us information about you.

If you are successful in your application, from time to time we may also search information that the CRAs have, to help us manage those accounts. We will go on sharing your personal data with CRAs for as long as you are a customer.

When we ask CRAs about you, they will note it on your credit file. This is called a credit search. Other lenders may see this, and we may see credit searches from other lenders.

If you apply for a product with someone else, we and the CRAs will link your records with theirs. You should tell them about this before you apply for a product or service.

For more detail on how your personal data will be used by us and the CRAs, please read ‘Our use of Credit Reference Agencies’.

Fraud Prevention Agencies (FPAs)

The personal data we have collected from you will be shared with FPAs who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment.

Further details of how your information will be used by us and FPAs, and your data protection rights, can be found by reading the ‘Our use of Fraud Prevention Agencies (FPAs)’ section of our main privacy notice.

3.10 Your rights

Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data as described in this notice:

• right to withdraw consent
• right of access to personal data
• right to correction or rectification
• right to request deletion
• right to data portability

Homes England must respond to a request to exercise these rights within 1 month. If you would like to submit a request, please contact the data protection officer.

3.11 Data Protection Officer

The contact details for our data protection officer are as follows:

By post:

For the attention of the Data Protection Officer
Homes England
Windsor House
50 Victoria Street
London
SW1H 0TL

By email: DPO@homesengland.gov.uk

By phone: 0300 1234 500

3.12 Complaints

If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, please contact our data protection officer.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

https://ico.org.uk/global/contact-us/

4. Contractors and agency workers

This section of our privacy notice applies to all contractors and agency workers

4.1 Information we collect

Homes England collects personal data about contractors and agency workers during the engagement process, either directly from contractors, tenderers or sometimes from an employment agency, intermediary or background check provider. We may sometimes collect additional information from third parties including former employers, former clients, credit reference agencies or other background check agencies.

We will collect additional personal information in the course of job-related activities throughout the period of your engagement.

We may collect, store, and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Gender
• Next of kin and emergency contact information
• National insurance number
• Copy of identification (Passport/driving licence)
• Bank account details
• Tax status information
• Start date
• Location of engagement or workplace
• Right to work documentation
• References and other information included in a CV or cover letter or as part of the tendering or engagement process)
• Prior employment records (including job titles, work history, working hours, training records and professional memberships)
• CCTV footage and other information obtained through electronic means such as swipe card records
• Information about your use of our information and communications systems
• Photographs

4.2 How we process your information

We will only use your personal information when the law allows us to.

Most commonly, we will useyour personal information in the following circumstances:

1. Where we need to perform the contract we have entered into with you or the employment agency or intermediary through whom you are working.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official purposes.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may process your data for the following purposes:

• Making a decision about your engagement
• National Security Vetting and BPSS checking
• Determining the terms on which you are engaged to work for us
• Checking you are legally entitled to work in the UK
• Paying you or any agency or intermediary
• Deducting tax and National Insurance contributions and other lawful deductions where required by law (e.g. under Chapter 10 ITEPA 2003)
• To notify you of any disaster or business continuity event, and recovery action
• Making decisions about the terms of your engagement
• Assessing your suitability or qualifications for a particular job or task
• Making decisions about your continued engagement
• Making arrangements for the termination of the engagement
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work
• Complying with health and safety obligations
• To prevent and detect fraud
• To monitor your use of our information and communication systems to ensure compliance with our IT policies
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• Equality and diversity monitoring
• Publicising our activities (e.g. group photos of events, site visits, etc.)
• To ensure that gifts and hospitality you receive are documented in accordance with our policy
• To ensure that any potential conflicts between your work-related interests and your personal interests are identified and managed appropriately. This includes making a declaration of interest periodically or as requested and whenever a new conflict or potential conflict is identified and also in relation to investment information where required under the Market Abuse Regulation.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

4.3 How we process ‘special categories’ of more sensitive personal information

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Information about your health, including any medical condition, health and sickness records
• Biometric data
• Information about criminal convictions and offences

These ‘special categories’ of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. Our data protection policy contains details of the safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

1. Where we need to carry out our legal obligations or exercise rights in connection with your engagement. For example:

• We will use information personal information relating to medical conditions and disability to comply with employment and other laws (insofar as applicable to agency workers and contractors)
• We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to comply with employment law and other laws (insofar as applicable to agency workers and contractors)

1. Where it is needed in the public interest: for example, we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality and diversity monitoring and reporting.
2. In limited circumstances, with your explicit written consent. We do not need your consent to use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law (insofar as applicable to agency workers and contractors).

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

You should be aware that it is not a condition of your engagement with us that you agree to any request for consent from us. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

4.4 Who is the information shared with

We may share your data with third parties, including third-party service providers and other Government departments and agencies. We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

Homes England shares your data with:

• A number of learning and development providers such as:
  • Eukleia
  • Cardinus
  • Civil Service Learning
  • IAM Roadsmart (essential car users)
  • Interactive Driving System
• Service providers such as:
  • Concur
  • Edenred
  • Eventbrite
  • Redfern
  • Occupational Health provider
• Social Media Providers such as:
  • Facebook Workplace
  • Twitter

4.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

Homes England has a records retention schedule that outlines how long we will retain information. To determine the appropriate retention period for personal data collected as part of your engagement, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer engaged by us we will retain and securely destroy your personal information in accordance with our records retention schedule.

5. Information Governance (Freedom of Information, Data Subject Request, Complaints, General Enquiries)

This section of our privacy notice will inform you about how we look after your personal data when you contact us to make a freedom of information request, or exercise your data subject rights under data protection legislation, make a complaint or submit a general enquiry.

5.1 Information we collect

Complaints

When you contact us to make a complaint, we will use the information you have provided to investigate your complaint in accordance with our complaints procedure and to respond to you with the outcome.

Freedom of Information Request

When you contact us to make a freedom of information request, we will use the information provided to respond to you. It is our policy to publish our responses to freedom of information requests on our web site but we will not publish any information that identifies you as the requestor. We will also redact from the information that we provide in response to any freedom of information request all personal data that could identify any individual.

Data Subject Request

When you contact us to make a data subject request, we will ask you to provide evidence of your identity and copies of identity documentation, to ensure that we only provide your personal information to you and not to third parties.

We do not request any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

However, we recognise that you where you write to us with a complaint, you may choose to provide us with information that falls within the definition of Special Categories of Personal Data.

You are not required to provide this information and your complaint will still be processed if you do not provide it.

5.2 How we process your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (for example, for one of our statutory functions)
• Where we need to comply with a legal or regulatory obligation including the Freedom of Information Act 2000, the Environmental Information Regulations 2004 and data protection legislation

Generally we do not rely on consent as a legal basis for processing your personal data.

5.3 Disclosures of your personal data

We may share your personal data with third parties including third-party service providers and other Government departments and agencies. This includes:

• Service providers who provide IT and system administration services to Homes England. For example, our complaints, freedom of information requests and data subject requests are processed using a cloud-based system (Microsoft Dynamics 365)
• Professional advisers including lawyers and auditors
• Ministry for Housing, Communities and Local Government who are the sponsor body for Homes England and commissions Homes England to administer and deliver Government programmes
• HM Revenue & Customs, National Audit Office, regulators and other authorities who require reporting of processing activities in certain circumstances, including agencies involved in the prevention or detection of fraud and money laundering
• Third parties who are mentioned in your complaint, including your landlord (but only if your landlord is a local authority or registered provider). If your landlord is not a local authority or registered provider, then we will not contact your landlord without your consent.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. You can find Microsoft’s contractual commitments in their Online Services Terms. Microsoft’s terms commit Microsoft to the requirements on processors in GDPR Article 28 and other Articles of GDPR. Read frequently asked questions about GDPR.

We or the third parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information. Microsoft relies on the Standard Contractual Clauses (also known as the Model Clauses) as a basis for transfer of data. The Standard Contractual Clauses are standard terms provided by the European Commission that can be used to transfer data outside the European Economic Area in a compliant manner.

Microsoft has incorporated the Standard Contractual Clauses into all of its Volume Licensing agreements via the Online Services Terms. The Article 29 Working Party has found Microsoft’s implementation of the Standard Contractual Clauses is compliant.

5.4 Retention

We retain personal information related to complaints for a period of 3 years after the resolution of the complaint.

We retain information related to freedom of information requests and data subjects requests (including copies of identity documents provided in connection with a data subject request) for a period of 18 months after the response has been provided.

6. Applications for employment

This section of our privacy notice applies to all individuals who apply for a position at Homes England.

6.1 Information we collect

Homes England collects personal data about applicants through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider.

We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies.

We will collect additional personal information in the event that your application to Homes England is successful. After you start work, your information will be processed in accordance with our employee privacy notice, a copy of which will be provided to you with your offer letter.

We will collect, store, and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Gender
• Copies of right to work documentation (evidence to demonstrate your entitlement to work in the United Kingdom)
• References or other information that you may have included in a CV, cover letter or application form
• Records of your previous employment (including job titles, work history, working hours, training records and professional memberships and salary details)

6.2 How we process your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. To process your application and to help us decide whether to make an offer of employment to you.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official purposes.

We may process your data for the following purposes:

• Making a decision about your recruitment or appointment
• National Security Vetting and BPSS checking
• Determining the terms on which you work for us
• Checking you are legally entitled to work in the UK
• To prevent and detect fraud
• To conduct data analytics studies (such as recruitment trends) to review and better understand the profile of candidates who apply to us; and who amongst them are successful.
• Equality and diversity monitoring

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

6.3 How we process ‘special categories’ of more sensitive personal information

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Trade union membership (only where you have mentioned this in your application, e.g. where you list being a union representative in ‘positions of responsibility’)
• Information about your health, including any medical condition, health and sickness including pre-employment screening
• Biometric data
• Information about criminal convictions and offences

These ‘special categories’ of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information.

Our data protection policy contains details of the safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

1. Where we need to carry out our legal obligations or exercise rights in connection your application. For example, we will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
2. Where it is needed in the public interest: for example, we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality and diversity monitoring and reporting.
3. In limited circumstances, with your explicit written consent. However, we do not need your consent to use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of any offer of employment with us that you agree to any request for consent from us.
4. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the rules mentioned above, where this is required or permitted by law.

6.4 Who is the information shared with

We may share your data with third parties, including third-party service providers and other Government departments and agencies. We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

6.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Unsuccessful applicants’ personal data will usually not be stored for longer than six months from the date of application.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. If you accept an offer of employment with us then our employee privacy notice will govern how we process your personal information.

Records will be retained and destroyed in accordance with our records retention schedule, which you will be able to access from our intranet.

7. Former employees

This section of our privacy notice applies to former employees of Homes England.

7.1 Information we collect

Homes England does not collect personal data from former employees after they have left our employment, but it may hold the information that was collected before and during the employment relationship, including:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Gender
• Marital status and dependants
• Next of kin and emergency contact information
• National Insurance number
• Copy of identification (passport or driving licence)
• Bank account details, payroll records and tax status information
• Salary, annual leave, pension and benefits information
• Start date
• Location of employment or workplace
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Employment records (including job titles, work history, working hours, training records and professional memberships)
• Compensation history
• Performance information
• Disciplinary and grievance information
• CCTV footage and other information obtained through electronic means such as swipecard records
• Information about your use of our information and communications systems
• Photographs

7.2 How we process your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. Where we need to perform the obligations in a contract we have entered into with you, such as the employment contract, or a settlement agreement. Some of the contractual obligations in these contracts continue after your employment has terminated, such as the duty to observe confidentiality.
2. Where we need to comply with a legal obligation.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official purposes.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may process your data for the following purposes:

• Paying you and deducting tax and National Insurance contributions and other lawful deductions *Providing you with any employee related benefits to which you are entitled after the termination of your employment
• To reimburse you for expenses incurred in the course of your employment
• Liaising with your pension provider and the trustees/administrators of pension schemes
• Administering any contract we have entered into with you
• Business management and planning, including accounting and auditing
• Gathering evidence for possible grievance or disciplinary hearings
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work
• To prevent and detect fraud
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• To conduct data analytics studies (such as the staff survey) to review and better understand employee retention and attrition rates
• Equality and diversity monitoring
• Publicising our activities (e.g. group photos of events, site visits, etc)

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

7.3 How we process ‘special categories’ of more sensitive personal information

We may also store and use the following ‘special categories’ of more sensitive personal information that we have collected from you:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Trade union membership
• Information about your health, including any medical condition, health and sickness records
• Biometric data
• Information about criminal convictions and offences

These ‘special categories’ of particularly sensitive personal information require higher levels of protection. We need to have further justification for storing and using this type of personal information. Our data protection policy contains details of the safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

1. Where we need to carry out our legal obligations or exercise rights in connection with employment.
2. Where it is needed in the public interest: for example, we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality and diversity monitoring and reporting. Where possible, we would seek to anonymise this data.
3. In limited circumstances, with your explicit written consent. However, we do not need your consent to use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law.

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

7.4 Who is the information shared with

We may share your data with third parties, including third-party service providers and other Government departments and agencies.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

Homes England shares your data with:

• Occupational Pension Scheme Trustees and Administrators
• Service providers such as:
  • Concur – employee expenses
  • Edenred – employee benefits, e.g. childcare vouchers
  • OH Assist – employee assistance programme
  • Equifax – BPSS identity check
  • Redfern – employee travel and accommodation service
• Occupational Health providers
• Nuffield – employee health screening
• Trade Unions of which you are a member including PCS, Unison and Unite
• Social Media Providers for employee engagement and communication such as:
  • Facebook Workplace
  • Twitter

7.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

Homes England has a records retention schedule that outlines how long we will retain information.

To determine the appropriate retention period for personal data collected as part of your employment, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee we will retain and securely destroy your personal information after the following periods:

• 12 months from date of leaving for employees; except
• payroll, tax and NIC records which must be retained required for 6 years. This is a legal requirement.

However, these periods only apply to your employment records and not for example to images and materials created and use for marketing and communication purposes (eg group photographs taken at away days etc). If you are concerned about the retention and use of any such materials please see the Data Rights section below.

8. Home Building Fund and Affordable Housing Programme

This section of our privacy notice aims to give you information on how Homes England collects and processes your personal data when you contact us in connection with an enquiry about, or an application for, Home Building Fund funding or Affordable Housing funding (AHP), including any data you may provide to us when you apply.

In this privacy notice, references to the Home Building Fund should also be taken as including two legacy programmes, ‘Get Britain Building’ and ‘Build to Rent’, which are closed to new applications. It also includes the other legacy programmes that have been amalgamated into the Home Building Fund (Builders Finance Fund, Custom Build Serviced Plots Loan Fund, Housing Zones, Local Growth Fund (Housing Infrastructure) and Large Sites Infrastructure Programme).

8.1 Information we collect (or may have collected from you in the past)

Personal data, or personal information, means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data, data such as:

• Identity data - includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, nationality and gender
• Contact data - includes residential address, email address and telephone numbers
• Financial data - includes bank account / statement details and information about the financial status of you or your business, including ownership structures and shareholdings etc.
• Transaction data - includes details about payments to and from you and other details of products and services you have acquired from us
• Technical data - includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
• Profile data - includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Usage data - includes information about how you use our website, products and services.
• Marketing and communications data - includes your preferences in receiving marketing from us and our third parties and your communication preferences

8.2 How we process your information

We will only process your personal information if there is a lawful basis to do so. Most commonly, we will use your personal information in the following circumstances:

• When processing is necessary for the processing of your application or in connection with any loan or funding agreement or when processing is required prior to entering into an agreement with you (such as Customer Due Diligence or completing a Know your client form)
• When processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions
• When processing is necessary for compliance with a legal or regulatory obligations.

Generally we do not rely on consent as a legal basis for processing your personal data.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where it is this is required or permitted by law.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please Contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out examples of which are provided in the table below.

8.3 Ways that we can use your personal data

Purpose or activity	Type of data	Lawful purpose for processing
To register you as a customer/applicant for the Home Building Fund or AHP funding and to comply with our customer due diligence and ‘know your customer’ (CDD/KYC) processes	* Identity & Address verification * Contact * Profile * Financial	* Performance of a contract with you * Necessary in the public interest to prevent and detect fraud, money laundering, Terrorism Financing and other Financial Crime related activity. * Necessary to comply with a legal or regulatory obligation
To process and deliver your application for a Home Building Fund loan, or AHP funding or other product including: * To manage payments, fees and charges * To collect and recover money owed to us * To evaluate and monitor our exposure to you including credit risk	* Identity and Address verification * Contact * Financial * Transaction * Marketing and Communications	* Performance of a contract with you * Necessary in the public interest (eg to recover debts due to us or to perform our statutory functions) * Necessary to comply with a legal obligation
To manage our relationship with you which will include: * Notifying you about changes to our terms or privacy notice * Asking you to leave a review or take a survey	* Identity and Address verification * Contact * Profile * Marketing and Communications	* Performance of a contract with you * Necessary to comply with a legal obligation including obligations to prevent and detect fraud, money laundering, Terrorism Financing and other Financial Crime related activity. * Necessary in the public interest (to keep our records updated and to study how customers use our products/services)
To administer and protect our business and our Home Building Fund website or AHP application portals (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	* Identity and address verification * Contact * Technical	* Necessary for the public interest (for running our business, provision of administration and IT services, network security, to prevent and detect fraud and money laundering and in the context of a business reorganisation or group restructuring exercise) * Necessary to comply with a legal obligation
To use data analytics to improve our Home Building Fund website or any AHP portal, products/services, marketing, customer relationships and experiences	* Technical * Usage	Necessary in the public interest (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To provide information to Government about the take-up and effectiveness of the Home Building Fund or AHIP funding and to compile National Statistics	* Identity * Contact * Financial * Transaction *Marketing and Communications	Necessary in the public interest to compile National Statistics (compiled from Aggregated Data) and provide information to Government

8.4 Disclosures of your personal data

We may share your personal data with Third Parties for the purposes set out in the table above, including third-party service providers, regulatory bodies and other Government departments and agencies.

We require all Third Parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We or our Third Parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

8.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available in our retention schedule which you can request from us by contacting the Data Protection Officer. By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for a certain period after their relationship ceases for tax and VAT purposes.

In some circumstances you can ask us to delete your data: see the Data Rights section for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. Cladding Safety Scheme (previously known as the Medium Rise Scheme)

9.1 About this notice

This privacy notice explains how we collect, use and protect your personal data; and also the rights you have with regards to that data.

This notice applies to the processing of your personal data through the Cladding Safety Scheme (CSS) only. Please refer to Homes England’s main privacy notice for further information on how we process personal data for other purposes.

9.2 Who we are

Homes England is the trading name adopted by the Homes and Communities Agency, our legal entity.

We are the data controller of the personal data processed. This means that we are responsible for deciding how we collect, use and store your personal data.

9.3 Information we collect

We collect personal data from you directly when you or your business register interest, create an account and/or apply for grant funding from the Cladding Safety Scheme via GOV.UK. The types of data we collect are:

• name(s)
• application ID (unique reference created for each application for the CSS)
• contact details
  • email address
  • telephone number
• information regarding the building to be remediated
  • full building address
• information regarding the Responsible Entity or Representative of the building to be remediated
  • confirmation that you are the firm responsible for repairs and maintenance or that you represent them
  • name, address, email address, job title and telephone number of the person responsible for repairs and maintenance
  • name, email address and telephone number for a secondary contact on the application
• financial information
• Responsible Entity or Representative bank account details
• Fire Risk Appraisal of External Walls (FRAEW)
• technical data relating to the building in line with regulation PAS9980

We also collect data about you from other sources, such as fraud prevention agencies, such as:

• either confirmation of accuracy or identification of irregularities of the types of data listed above
• details that identify your suitability/eligibility for the product you have applied for

9.4 How we process your information

We use the personal data stated above for the following purposes:

Purpose	Data processed	Lawful basis for processing
Register interest in the Cladding Safety Scheme	• name(s) • contact details • address of building to be remediated	public task
To assist you to progress your Cladding Safety Scheme application	• name(s) • contact details	public task
Assessing your application, including performing identity, credit and fraud checks	• name(s) • contact details • details of the building to be remediated • Responsible Entity details (company name, registered address etc) • bank details • Fire Risk Assessment of External Walls report	contract
Transferring your data to a fraud prevention agency	• name(s) • contact details • details of the building to be remediated • Responsible Entity details (company name, registered address etc) • bank details	public task
Administration of your Cladding Safety Scheme grant funding agreement	• name(s) • contact details • details of the building to be remediated • Responsible Entity details (company name, registered address etc) • bank details • Fire Risk Assessment of External Walls report • works package information • contract information • transaction information	contract
Market research – asking for your feedback on the scheme and the process	• name(s) • contact details • details of the building to be remediated • Responsible Entity details (company name, registered address etc)	legitimate interest
Communications and updates about the CSS	• name(s) • contact details • details of the building to be remediated • Responsible Entity details (company name, registered address etc)	consent

9.5 What lawful basis do we have to process your personal data?

We are only able to use your personal data when the law allows us to. This is called the lawful basis. In regards to the above purposes, the lawful basis stated for each are explained below:

Contract – Processing your data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

Legal obligation – Processing your data is necessary for compliance with a legal obligation.

Public task – Processing your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions.

Legitimate interests – Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.

Consent – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so, please contact the Data Protection Officer via the details provided below.

9.6 Who is the information shared with?

We use service providers to help deliver and administer the grant funding agreement. When we use these service providers, it is necessary for us to share your personal data with them.

The main service providers and why they need your personal data are listed below:

Provider	Reason your data is shared	What data may be shared
Cladding Safety Scheme Service Administrator	To assess your application for grant funding and progress the delivery of an agreed package of fire safety mitigation/remediation works in line with the funding agreement	All data submitted to CSS (including personal information such as name, email etc)
Department of Levelling Up, Housing and Communities (DLUHC)	To update DLUHC on progress on the scheme and provide information they will need to respond to ministerial questions	All data submitted to CSS (including personal information such as name, email etc)
Northern Ireland Assembly	To update the Northern Ireland Assembly on progress on buildings entering the CSS that are based in Northern Ireland	All data submitted to CSS from buildings based in Northern Ireland (including personal information such as name, email etc)
Our IT infrastructure providers	To provide secure data storage and power our internal systems such as our email and phone service	All data submitted to CSS (including personal information such as name, email etc)
Fraud prevention agencies	To prevent fraud, money laundering and to verify your identity	All data submitted to CSS (including personal information such as name, email etc)
Building Safety Regulator	To update on works undertaken to buildings and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email etc)
Fire Safety Service	To update on works undertaken to buildings and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email etc)
Cladding Safety Scheme cost consultants	To verify costs of a work package where it may fall outside expected benchmarks as required	All data submitted to CSS (including personal information such as name, email etc)
Cladding Safety Scheme legal advisors	To undertake eligibility checks and contract negotiation of complex cases	All data submitted to CSS (including personal information such as name, email etc)
Cladding Safety Scheme client-side support providers	To provide bespoke technical support to applicants as required	All data submitted to CSS (including personal information such as name, email etc)
Cladding Safety Scheme FRAEW Assessor Panel	To undertake or peer review a FRAEW to progress your CSS application	All data submitted to CSS (including personal information such as name, email etc)
Local authorities (including the Greater London Authority)	To update local authorities on remediation works undertaken to buildings in their area and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email etc)
Local Authority Building Control	To update local authorities on remediation works undertaken to buildings in their area and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email etc)
Mortgage lenders	To update mortgage lenders on remediation works undertaken to buildings they have an interest in	Building-level information such as building address and works undertaken
Insurance companies	To update insurance companies on remediation works undertaken to buildings they have an interest in	Building-level information such as building address and works undertaken
Royal Institution of Chartered Surveyors and their members	To update on remediation works undertaken to buildings	Building-level information such as building address and works undertaken

In the future we may choose or be obligated to share your information with third parties that are not listed above. If so, we will update this notice and let you know.

Sometimes, we may be legally obliged to provide copies of personal information to other organisations. For example, to provide information to the police or to a public inquiry. We might not be always able to tell you that we have shared your information in this way; however, we will ensure this is only shared in accordance with the law.

9.7 Where is your personal data stored and processed?

All personal data is stored and processed by Homes England and our Service Administrator within offices in the UK and using systems that utilise data centres in the UK.

If one of our service providers ever processes data outside the UK, we will ensure this is only where we can ensure that your personal data is adequately protected.

9.8 How long do we keep your personal data?

We will store your data for period of 6 years from the end of your relationship with us. This is so we can comply with our general legal obligations and for the exercise or defence of any legal claims.

9.9 Fraud prevention

Fraud prevention agencies (FPAs)

The personal data we have collected from you may be shared with FPAs who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment.

Further details of how your information will be used by us and these FPAs, and your data protection rights, can be found by reading the ‘Our use of Fraud Prevention Agencies (FPAs)’ section of our main privacy notice.

9.10 Your rights

Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data as described in this notice:

• right to withdraw consent
• right of access to personal data
• right to correction or rectification
• right to request deletion
• right to data portability

Homes England must respond to a request to exercise these rights within 1 month. If you would like to submit a request, please contact the data protection officer.

9.11 Data Protection Officer

The contact details for our Data Protection Officer are as follows:

For the attention of the Data Protection Officer
Homes England
Windsor House
50 Victoria Street
London
SW1H 0TL

Email: DPO@homesengland.gov.uk

Phone: 0300 1234 500

9.12 Complaints

If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, please contact our data protection officer.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113

Email: casework@ico.org.uk

ico.org.uk/global/contact-us/

10. Buildings, sites and premises

This section of our privacy notice applies to visitors to buildings, sites or other premises owned or controlled by Homes England.

10.1 Information we collect and how it is processed

We have security measures in place at our buildings and sites, including in some cases the use of CCTV and building access controls. This is to deter, prevent and detect crime at our premises and ensure only those people who are entitled to be admitted gain access to our premises.

Where CCTV is in use, there are signs in place to notify any individuals. The images captured are securely stored and only accessed on a need to know basis (e.g. to look into an incident).

We require visitors to our offices to sign in at reception and we keep a record of visitors for a short period of time.

10.2 Retention

CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft).

Our visitor records are securely stored and only accessible on a need to know basis (e.g. to look into an incident).

11. Our use of Credit Reference Agencies

We carry out credit and identity checks when you apply for a product or services for you or your business. We may use Credit Reference Agencies (CRAs) to help us with this. If you use our services, from time to time we may also search information that the CRAs have, to help us manage those accounts.

To do this, we’ll supply your personal data to CRAs and they’ll give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply us with both public (including the electoral register) and shared credit information, financial situation, history and fraud prevention information.

We’ll use this data to:

• assess whether you or your business is able to afford to make repayments
• verify the accuracy of the data you’ve provided to us, including details of your identity
• help detect and prevent financial crime
• manage your accounts with us
• trace and recover debts
• ensure any offers provided to you are appropriate to your circumstances.

We will go on sharing your personal data with CRAs for as long as you are a customer. This will also include details of funds going into the account, and the account balance. If you borrow, it will also include details of your repayments and whether you repay in full and on time. We will also tell the CRAs when you settle your accounts with us. The CRAs may give this information to other organisations that want to check your financial status.

When we ask CRAs about you or your business, they will note it on your credit file. This is called a credit search footprint. Other lenders may see this and we may see credit searches from other lenders.

If you apply for a one of our products or services (such as where you apply for Help to Buy: Equity Loan), we’ll get details of your credit history from a CRA (and share information about you with the CRA) and use this information to work out whether you or your business can afford to borrow or pay back.

We may also carry out further credit checks on you while you’re a customer to maintain an accurate and up-to-date record of your credit history.

If you’re making a joint application, or tell us that you have a spouse, partner or civil partner – or that you are in business with other partners or directors, we’ll link your records together. You should discuss this with them, and share this information with them before submitting the application.

CRAs will also link your records together and these links will remain on your and their files until you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail on their websites.

They’ve created a joint document called the Credit Reference Agency Information Notice (CRAIN) which is accessible from each of the three CRAs – going to any of these three links will also take you to the same CRAIN document:

11.1 Credit reference agencies

TransUnion – www.transunion.co.uk/crain
Equifax – www.equifax.co.uk/crain
Experian – www.experian.co.uk/crain

12. Our use of Fraud Prevention Agencies

Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.

We will process personal data such as your name, address, date of birth, contact details, financial information, employment details and device identifiers including IP address.

We and Fraud Prevention Agencies (FPAs), who are data controllers in their own right, may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

We process your personal data on the basis that it is necessary in the public interest or in exercising official authority for us to prevent fraud and money laundering, and to verify identity, in order to protect ourselves and to comply with laws that apply to us.

FPAs can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

12.1 How you may be affected

If we, or an FPA, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the FPAs, and may result in others refusing to provide services, financing or employment to you.

12.2 Data transfers outside the UK

FPAs may allow the transfer of your personal data outside the UK. This may to be a country where the UK government has decided that your data will be protected to UK standards, but if the transfer is to another type of country then the FPAs will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

12.3 Your rights

Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data; request that your personal data is erased or corrected; request access to your personal data.

For more information or to exercise your data protection rights, please contact our Data Protection Officer:

• Post: For the attention of the Data Protection Officer, Homes England, Windsor House, 50 Victoria Street, London , SW1H 0TL
• Email: DPO@homesengland.gov.uk
• Tel: 0300 1234 500

Alternatively, please refer to the information notice of CIFAS, the main Fraud Prevention Agency we use.

13. Glossary

Definitions of certain terms in this privacy notice.

13.1 ‘Lawful Basis’

Public Interest - a data controller may process personal data without consent where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

13.2 ‘Special categories of personal data’

Personal data revealing race or ethnicity, political opinions, religion or beliefs, trade union membership, health or sex life, sexual orientation, genetic data or biometric data.

13.3 ‘Third parties’

Service providers who provide IT and system administration services to Homes England. In particular, Homes England’s e-tendering tool (ProContract) is hosted by ProActis (Due North). If you register to use the e-tendering system, you will be required to agree to the ProActis Terms and Conditions of using the system, and also their privacy notice.

Professional advisers including lawyers, bankers, auditors and insurers based who provide consultancy, banking, legal, insurance and accounting services.

Ministry for Housing, Communities and Local Government who are the sponsor body for Homes England and commissions Homes England to administer and deliver Government programmes.

HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances, including those involved in the prevention or detection of fraud and money laundering.

The Police

HM Treasury and National Audit Office

Credit reference, CDD providers and rating agencies who may help us decide whether to provide you with a product or a service.

Third parties to whom we may choose to outsource, sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.