Guidance

Homes England: privacy notice

Updated 21 May 2025

Applies to England

Homes England (the trading name adopted by the Homes and Communities Agency) is committed to protecting the privacy and security of your personal data.

This privacy notice aims to give you information on how Homes England collects and processes the personal data provided to us, including information that you provide directly, and tell you about your rights and how the law protects you.

Homes England’s websites are not intended for use by children and we do not knowingly collect personal data that could identify individual children.

Use the glossary to help you understand the meaning of some of the terms used in this privacy notice.

1. Users of our website and web portals

This section of our privacy notice applies to all individuals who visit our websites or provide information to us via one of our web portals.

It is important that you read this section of our privacy notice together with the main section of our privacy notice, or any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you. This is so that you are fully aware of how and why we are using your data.

1.1 GOV.UK and third party links

Our GOV.UK web address is provided to us by the Government Digital Service (GDS). Ensure that when visiting this website that you read the GOV.UK privacy notice to understand how this may affect your personal data.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

1.2 Information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data, data such as:

• Identity data — includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, nationality and gender
• Contact data — includes billing address, residential address, delivery address, email address and telephone numbers
• Financial data — includes bank account and payment card details and information about the financial status of you or your business, including ownership structures and shareholdings and so on.
• Transaction data — includes details about payments to and from you and other details of products and services you have purchased from us
• Technical data — includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
• Profile data — includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Procurement data — includes information that we may need to obtain and consider to ascertain in connection with UK and European Union (EU) public procurement legislation (for example, whether grounds for exclusion under the Public Contracts Regulations 2015 may apply)
• Usage data — includes information about how you use our website, products and services
• Marketing and Communications data — includes your preferences in receiving marketing from us and our third parties and your communication preferences

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data is data that may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity.

For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

We do not request any ‘special categories’ of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).

However, we recognise that where you are applying for a service or product, or tendering to provide goods, services or works, you may choose to provide us with information that falls within the definition of special categories of personal data.

For example, when you are using our Property Consents web portal to apply for our consent to make alternations to a property, you may decide to supply information about any mobility related issues faced by occupants in support of your application.

You are not required to provide any special category information as part of any application you make to us and your application will still be processed if you do not provide it.

Special categories of particularly sensitive personal information require higher levels of protection than other personal data. Where you do supply such information, we will rely on the ground that it is being processed by us in furtherance of the establishment and exercise of your legal rights.

1.3 If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested by us, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services).

In this case, we may have to cancel a product or service you have with us, or decline your application, but we will notify you if this is the case at the time.

1.4 How is your personal data collected?

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, Contact, Financial Data and Procurement Data by filling in forms (for example, Know your customer form) or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide or that you may have provided when you:
  • apply for our products or services
  • complete KYC (know your customer) or CDD (customer due diligence)
  • create an account on our website
  • subscribe to our service or publications
  • request marketing to be sent to you
  • enter a competition, promotion or survey
  • submit a tender or quote
  • give us feedback
  • have applied for products in the past, such as the Get Britain Building funding or Build to Rent funding
• Automated technologies or interactions. As you interact with our website, or those of third parties, we may automatically collect Technical Data and Procurement Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.
• Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources as set out in the GOV.UK cookie settings information and as detailed below:
  
  • Technical data from the following parties:
    • analytics providers such as Google based outside the EU
    • search information providers inside or outside the EU
  • Contact, Procurement Financial and Transaction data from providers of technical, payment and delivery services inside or outside the EU
  • Identity Procurement and Contact data from data brokers or aggregators based inside or outside the EU
  • Identity Procurement and Contact data from credit reference agencies and CDD providers, publicly availably sources such as Companies House and the Electoral Register based inside the EU

1.5 How we process your information

We will only process your personal information if there is a lawful basis to do so. Most commonly, we will use your personal information in the following circumstances:

• when processing is necessary for the performance of a contract or when processing is required prior to entering into a contract with you
• when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions
• when processing is necessary for compliance with a legal or regulatory obligation
• to prevent and detect crime, including fraud

Generally we do not rely on consent as a legal basis for processing your personal data.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may process your personal information without your knowledge or consent, in compliance with the above rules, where it is this is required or permitted by law.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

1.6 Ways that we can use your personal data

Purpose or activity	Type of data	Lawful purpose for processing
To register you as a new customer or supplier and to comply with our customer due diligence and “know your customer” (CDD and, or, KYC) processes	— Identity — Contact — Procurement	— Performance of a contract with you — Necessary in the public interest to prevent and detect fraud and money laundering — Necessary to comply with a legal obligation
To process and deliver your application for a service or product (or process a tender or quote supplied by you in response to our tendering an opportunity to provide goods, works or services, and to enter into a contract for the supply of any of these) including: — To manage payments, fees and charges — To collect and recover money owed to us — To evaluate and monitor our exposure to you including credit risk — To evaluate a tender or quote that you submit in accordance with our procurement policies and the Public Contracts Regulations 2015	— Identity — Contact — Financial — Transaction — Marketing and Communications — Procurement	— Performance of a contract with you — Necessary in the public interest (eg to recover debts due to us or to perform our statutory functions) — Necessary to comply with a legal obligation
To manage our relationship with you which will include: — Notifying you about changes to our terms or privacy notice — Asking you to leave a review or take a survey	— Identity — Contact — Profile — Marketing and Communications — Procurement	— Performance of a contract with you — Necessary to comply with a legal obligation including obligations to prevent and detect fraud and money laundering — Necessary in the public interest (to keep our records updated and to study how customers use our products and, or, services) or how suppliers interact with us when we are considering purchasing goods, service and works from them
To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	— Identity — Contact — Technical	— Necessary for the public interest (for running our business, provision of administration and IT services, network security, to prevent and detect fraud and money laundering and in the context of a business reorganisation or group restructuring exercise) — Necessary to comply with a legal obligation
To use data analytics to improve our website, products and, or, services, marketing, customer and supplier relationships and experiences	— Technical — Usage	Necessary in the public interest (to define types of customers for our products and services, and suppliers from whom we purchase goods, works and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To provide information to Government about the take-up and effectiveness of our programmes and to compile National Statistics	— Identity — Contact — Financial — Transaction — Marketing and Communications — Procurement	Necessary in the public interest to compile National Statistics (compiled from Aggregated Data) and provide information to Government

1.7 Disclosures of your personal data

We require all Third Parties to respect the security of your personal data and to treat it in accordance with the law.

We may share your personal data with Third Parties for the purposes set out in the table above including third-party service providers, regulatory bodies and other Government departments and agencies.

For example, our e-tendering tool (ProContract) is hosted by ProActis (Due North). If you register to use the ProContract e-tendering system, you will be required to agree to the ProActis Terms and Conditions of using the system, and also their privacy notice.

We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We or our Third Parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

1.8 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.

Details of retention periods for different aspects of your personal data are available in our retention schedule.

By law we have to keep basic information about our customers and suppliers (including Contact, Identity, Financial and Transaction Data) for a certain period after they cease being customers for tax and VAT purposes.

In some circumstances you can ask us to delete your data: see the Data Rights section for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

2. Help to Buy: Equity Loan

You should read this information if you applied for or took out a Help to Buy: Equity Loan between 1 April 2013 and 31 May 2023.

You should also read this part of the privacy notice if you applied for or took out one of the following schemes:

• London-Wide Initiative (2003 to 2005)
• First Time Buyers’ Initiative (2006 to 2012)
• HomeBuy Direct (2008 to 2012)
• Armed Forces Homes Ownership Scheme (2010 to 2014)
• First Buy (2011 to 2013)

We refer to these schemes collectively as ‘Equity Loan’ in this section of the privacy notice.

You can no longer apply for a Help to Buy: Equity Loan, or any of the above listed schemes, in England. For more information on how to manage your Help to Buy: Equity Loan or other scheme account, visit: www.gov.uk/manage-equity-loan.

2.1 What information we collect and where we get it from

We collected personal information about you from your local Help to Buy Agent when you applied for your equity loan. We also collect information about you directly from you, and from your legal representatives when you contact us and manage your equity loan.

We also collect information about you from the third parties, listed:

• the joint account holder on your equity loan account (if applicable)
• third parties that provide services to you such as your conveyancer or any agent that acts on your behalf
• third parties that provide services to us, such as our mortgage administrator Lenvi, debt collection agencies and conveyancers
• credit reference, fraud prevention and law enforcement agencies
• the Financial Ombudsman Service and Parliamentary and Health Service Ombudsman
• other government agencies, such as the Ministry of Defence (MOD) and Ministry of Housing, Communities and Local Government (MHCLG)

We collect the following information about you, directly from you and from third parties:

• basic personal information (including name, date of birth, address)
• contact details including phone number and email address
• financial information (including bank details, income, details of any shared credit, financial situation and history)
• property information (including purchase price, address, developer)
• equity loan account performance (including payments, arrears)
• opinions (including surveys and market research)

For more information about how we use credit reference and fraud prevention agencies, read the dedicated sections of this notice.

2.2 How we use personal information and your rights

This section explains how we use the personal information we collect (our purpose) and the types of information we use for that purpose. It also explains what lawful basis we rely on to use your personal information.

We also explain what rights you have when we process your information. Read ‘your rights’ for more information.

To help us administer your equity loan account, we process your information for the following purposes:

Processing your application for your equity loan

This includes when you applied for your loan, collecting information about you via the local Help to Buy agent, deciding whether to accept or decline your application and creating your account if your application is successful. You can no longer apply for an Equity Loan.

Administering your equity loan account

This includes managing any requests from you, such as transferring your equity loan to another person or asking for permission to make structural alterations to your property. It also includes managing payments, arrears and applying to redeem your equity loan and closing your account.

Share information about you with a credit reference agency

This includes conducting identity and eligibility checks, verifying the accuracy of your information and managing your account with us. For more information, read the ‘our use of credit reference agencies’ section.

Detect, investigate, report and prevent financial crime or breaches of contract

This includes verifying the information you have provided to us, protecting public money and complying with our legal obligations.

Send marketing material to you

This includes telling you about products or services which we think might be of interest to you.

Conduct research and evaluation

This includes contacting you and using the answers you give to understand more about you and our equity loan products, and to help inform future government policy.

The tables sets out each purpose we use your information for, the types of information we use about you to fulfil that purpose, what lawful basis we rely on to do so and what rights you have. Where we rely on contract as our lawful basis, we require your information to fulfil our contractual obligations. If you don’t provide the necessary information, we can’t make changes to your equity loan account.

Read the ‘your rights’ section for more information.

Processing your application for your equity loan

Types of information	Lawful basis for processing	The rights you have
— Basic personal identifiers, contact details, financial information, and property information — Information relating to ethncity and disability	— Contract — we collect or use the information so we can enter into or carry out a contract with you — Public Task — necessary in the public interest to understand and inform government policy	Access, Rectification, Restrict, Object, Data Portability and Automated Decision Making

Administering your equity loan account, including any further applications from you, management of arrears and account closure

Types of information	Lawful basis for processing	The rights you have
Administering your equity loan account, including any further applications from you, management of arrears and account closure	— Basic personal identifiers, contact details, financial information, property information, equity loan account performance, and opinions — Contract — we collect or use the information so we can enter into or carry out a contract with you	Access, Rectification, Restrict, Object, and Data Portability

Share information about you with a credit reference agency

Types of information	Lawful basis for processing	The rights you have
Basic personal identifiers, contact details, financial information	Legitimate interests — it is in our interest to ensure we are managing public money effectively	Access, Rectification, Erasure, Restrict, Data Portability, Object, and Automated Decision Making

Detect, investigate, report and prevent financial crime or breaches of contract

Types of information	Lawful basis for processing	The rights you have
Basic personal identifiers, contact details, financial information, property information, equity loan account performance, and opinions	Contract — we collect or use the information so we can enter into or carry out a contract with you Legal Obligation — we collect or use your information so we can comply with the law	Access, Rectification, Erasure, Restrict and Data Portability

Send marketing material to you

Types of information	Lawful basis for processing	The rights you have
Basic personal identifiers and contact details	Consent — we have permission from you after we gave you all the relevant information	Access, Rectification, Erasure, Restrict, Data Portability, Object, Automated Decision Making, Right to withdraw consent

Conduct research and evaluation

Types of information	Lawful basis for processing	The rights you have
Basic personal identifiers, contact details, opinions, financial information, property information, equity loan account performance	Public task — necessary in the public interest to understand and inform government policy	Access, Rectification, Restrict, Object, and Automated Decision Making

2.3 Who we share your information with

We share your information with third parties that provide services to you or us, such as our mortgage administrator, Lenvi, and your conveyancer. We may share your information with other third-party organisations such as credit reference agencies, debt collection agencies and other government agencies.

We share your information to help us manage and administer your equity loan account, ensure the information we hold about you is accurate and complies with our own legal obligations. We also share your information with MHCLG to enable research and evaluation into the performance and effectiveness of government programmes.

Our service providers and why they need your information are listed in the table:

Service provider	Purpose
Help to Buy agents	To process your application for your equity loan
Lenvi (our equity loan mortgage administrator)	To administer your equity loan account
Conveyancers and other legal representatives	To process your application, administer your equity loan account
Property professionals (such as an approved valuer)	To administer your equity loan account
HM Land Registry	To administer your equity loan by registering and removing any charges on the property
Credit reference agencies	To process and administer your equity loan account and detect and investigate financial crime and breaches of contract
Debt collection agencies	To manage and recover debt and arrears on accounts
Direct Debit scheme	To recover debt and arrears on your account
Fraud prevention agencies	To detect and investigate fraud and financial crime
Financial Ombudsman Service and Parliamentary and Health Service Ombudsman	To investigate and respond to customer complaints
Law enforcement agencies	Where necessary to cooperate with criminal or other investigations
First charge mortgage lenders	Who also hold a charge on the property — to administer equity loan accounts
Organisations providing data services to support us in managing our relationship with customers and operating the business	To process and administer the portfolio
Our IT infrastructure, including communication systems	All purposes mentioned

We may share information with third party organisations in an anonymous way to help us conduct our work as a public authority. When we do this, we will remove all personal information to make sure no one can be identified from the information. This might include removing some types of information such as name and full address or grouping people together by age or location.

Sometimes we might be legally required to provide copies of your personal information to other organisations, such as the police or a public inquiry.

We might not be always able to tell you that we have shared your information in this way, but we’ll always make sure that any information about you is only shared lawfully.

2.4 Where we store your information and how long we keep it for

We store and process all information about you and your equity loan account in the UK.

If you applied for an equity loan, your information is kept for 6 years after the end of your relationship with us. Beyond administering your equity loan, we store your information for 6 years for the following reasons:

• to understand the equity loan scheme as a government-backed homes ownership scheme
• to respond to questions, complaints or public inquiries
• to keep records for tax and managing public money purposes

We may keep your personal information for longer than 6 years if we can’t deliver for legal or regulatory reasons.

We may remove your personal information from your records so that you cannot be identified but keep information about your account and the equity loan schemes for public records and future development of public policy.

2.5 Our use of credit reference agencies

This section explains how we work with credit reference agencies (CRAs) to decide whether to lend you money, and to help us manage our products and your accounts during your relationship with us.

We may have carried out credit and identity checks using CRAs when you applied for your equity loan product. And from time to time, we may also share your personal information with CRAs, and they may give us information about you. We use this data to:

• verify the accuracy of the data you give us, including details of your identity
• help detect and prevent financial crime
• manage your account with us

You can find out more detailed information about the CRAs on their websites, including:

• the identities of the CRAs
• their role also as fraud prevention agencies
• the data they hold
• the ways they use and share personal information
• data retention periods
• your data protection rights

You can also find out more information in the Credit Reference Agency Information Notice (CRAIN), created jointly by the CRAs. This can be found on their websites:

• Experian — www.experian.co.uk/crain
• TransUnion — www.transunion.co.uk/crain
• Equifax – www.equifax.co.uk/privacy-hub/crain

2.6 Our use of Fraud Prevention Agencies

During the lifetime of your equity loan, from application to repayment, we verify your identity and complete checks to prevent fraud and money laundering. These checks require us to process your personal data that we have collected for you, your legal representatives, or through third parties.

We process personal data such as your:

• name
• address
• date of birth
• contact details
• financial information
• employment details
• device identifiers including IP address

We may share your personal data with Fraud Prevention Agencies (FPAs), who are data controllers in their own right. They, and we, may enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

We process your personal data in this way when it is in the public interest, or to prevent fraud and money laundering, and to verify identity. We do this to protect ourselves and to comply with UK law.

FPAs can hold your personal data for different periods of time. Your data can be held for up to 6 years if you are considered to pose a fraud or money laundering risk.

FPAs may store your personal data outside the UK. This may be in a country where your data is protected to UK standards but if not, then the FPAs will ensure your data is protected.

2.7 Your rights

This section explains your rights and how to contact us about them. We have listed all of your rights here and described what they mean for you. These rights do not apply in all circumstances and we tell you which rights apply to you when we tell you how we process your personal information.

The right to be informed

This means that we should provide you with information about how and why we use your personal information. This privacy notice is an example of this.

The right of access

This is also known as a Subject Access Request (SAR). It means you can ask us to provide a copy of the information we hold about you.

The right to rectification

You can ask us to correct any information we hold about you that you think is incorrect or incomplete.

The right to erasure

This is also known as the right to be forgotten. You can ask us to delete your personal information.

The right to restrict processing

You can ask us to temporarily limit what we use your information for. This might mean we are not able to provide you with some services while the restriction is in place.

The right to data portability

You have the right to get information from us as a digital file that you can give to other organisations if you wish to.

The right to object

You can object if you do not agree with how we are using your information. You must tell us why you object and how it affects you. If you object to us using your information for marketing purposes, we must agree with your objection.

Rights in relation to automated decision making and profiling

Automated decisions mean decisions made about you without any human involvement. Profiling means the automated processing of your information to evaluate you. You have the right to challenge any decisions made about you by automated means and ask a human to review an automated decision.

The right to withdraw consent

Where you give your permission for us to use your data, you can withdraw it at any time.

3. Help to Build: Equity Loan

3.1 About this notice

This privacy notice explains how we collect, use and protect your personal data; and also the rights you have with regards to that data.

This notice applies to the processing of your personal data through the Help to Build: Equity Loan scheme.

Refer to Homes England’s main privacy notice for further information on how we process personal data for other purposes.

3.2 Who we are

Homes England is the trading name adopted by the Homes and Communities Agency, our legal entity.

We are the data controller of the personal data processed. This means that we are responsible for deciding how we collect, use and store your personal data.

3.3 Information we collect

Customer(s)

We collect personal data from you directly when you express an interest in or apply for a Help to Build: Equity Loan to build a property under the scheme. The types of data we collect are:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information (such as bank details, purchase price and income(s))
• opinions (that may lead to identification)
• equal opportunities data
• Help to Build: Equity Loan account number

We also collect data about you from other sources, such as joint applicants, the Land Registry, credit reference or fraud prevention agencies. This data includes:

• the types of data listed above from the joint applicant. This should have been discussed with you by them prior to completing and submitting the application
• either confirmation of accuracy or identification of irregularities of the types of data listed above
• details that identify your suitability and, or, eligibility for the product you have applied for

3.4 How we process your information

We use the personal data stated above for the following purposes:

Register your interest in the Help to Build: Equity Loan scheme

Data processed:

• name(s)
• contact details

Lawful basis for processing:

• contract

To assist you to manage your Help to Build: Equity Loan application

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information

Lawful basis for processing:

• contract

Assessing your application, including performing identity, credit, and fraud checks

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• financial information
• data from other sources

Lawful basis for processing:

• public task
• legal obligation

Transferring your data to a credit reference or fraud prevention agency

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• financial information

Lawful basis for processing:

• public task

Deciding as to whether to accept your application

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information
• data from other sources

Lawful basis for processing:

• contract

Administration of your equity loan via our equity loan administrator, mortgage provider, conveyancing solicitors and RICS valuers

Data processed:

• name(s)
• date of birth
• contact details
• address
• financial information
• Help to Build: Equity Loan account number

Lawful basis for processing:

• contract

To detect, investigate, report, and prevent financial crime such as fraud or breaches of contract

Data processed:

• name(s)
• date of birth
• address history up to 3 years at the point of application
• contact details
• address details of the property to be purchased
• financial information
• data from other sources

Lawful basis for processing:

• contract
• legal obligation
• public task

Sending marketing material relevant to your relationship with us

Data processed:

• name(s)
• contact details

Lawful basis for processing:

• consent

To allow you to participate in market research

Data processed:

• name(s)
• contact details

Lawful basis for processing:

• legitimate interests

To allow us to monitor the effectiveness of equal opportunities to the scheme

Data processed:

• equal opportunities data

Lawful basis for processing:

• consent (explicit consent)

3.5 What lawful basis do we have to process your personal data?

We are only able to use your personal data when the law allows us to. This is called the lawful basis. Regarding the above purposes, the lawful basis stated for each are explained below:

Contract — Processing your data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

Legal obligation — Processing your data is necessary for compliance with a legal obligation.

Public task — Processing your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions.

Legitimate interests — Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.

Consent — You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so contact the Data Protection Officer using the details provided below.

What about more sensitive data?

As part of the Help to Build: Equity Loan scheme, we may ask you to provide more sensitive personal data known as ‘special category personal data’ under the law. Where we do this, we rely on the ‘condition for processing’ stated in brackets for the purpose. These conditions are explained below:

Explicit consent - you have given us your explicit consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so, contact the Data Protection Officer using the details provided.

What about criminal offence data?

When performing checks on applicants as part of the assessment process, we may collect personal data related to criminal convictions. When we do so, we also rely on the following legal basis:

Unlawful acts - processing your data to prevent or detect whether a law has been broken.

Fraud - processing your data to prevent fraud from taking place.

3.6 Who is the information shared with?

We use service providers to help deliver and administer the Help to Build scheme. When we use these service providers, it is necessary for us to share your personal data with them.

The main service providers and why they need your personal data are listed below:

Our IT infrastructure providers

To provide secure data storage and power our internal systems such as our email and phone service.

The mortgage lender you have chosen

To log and process your application.

The Help to Build: Equity Loan administrator

To administer your equity loan.

Legal advisers and. or, solicitors

To collect relevant information required to process your application, such as identity and proof of funds.

A RICS (Royal Institution of Chartered Surveyors) approved valuer

When we need to discuss or process your valuation.

Credit reference and fraud prevention agencies

Read ‘Credit Reference and Fraud Prevention’ for more detail.

Our communication systems

To provide Help to Build specific communications to you, such as account updates, research projects and, if consent if provided, marketing material.

Sometimes, we may be legally obliged to provide copies of personal information to other organisations. For example, to provide information to the police, or to a public inquiry. We might not be always able to tell you that we have shared your information in this way, however we will ensure this is only shared in accordance with the law.

3.7 Where is your personal data stored and processed?

All personal data is stored and processed by Homes England within offices in the UK and using systems that utilise data centres in the UK.

If one of our service providers ever processes data outside the UK, we will ensure this is only where we can ensure that your personal data is adequately protected.

3.8 How long do we keep your personal data?

We will store your data for period of 6 years after the end of your relationship with us. This is so we can comply with our general legal obligations and for the exercise or defence of any legal claims.

3.9 Credit Reference and Fraud Prevention

Credit Reference Checks

We carry out credit and identity checks when you apply for a Help to Build: Equity Loan. We use credit reference agencies (CRAs) to help us with this. We will share your personal data with CRAs, and they will give us information about you.

If you are successful in your application, from time to time we may also search information that the CRAs have, to help us manage those accounts. We will go on sharing your personal data with CRAs for as long as you are a customer.

When we ask CRAs about you, they will note it on your credit file. This is called a credit search. Other lenders may see this, and we may see credit searches from other lenders.

If you apply for a product with someone else, we and the CRAs will link your records with theirs. You should tell them about this before you apply for a product or service.

For more detail on how your personal data will be used by us and the CRAs, read ‘Our use of Credit Reference Agencies’.

Fraud Prevention Agencies (FPAs)

The personal data we have collected from you will be shared with FPAs who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment.

Further details of how your information will be used by us and FPAs, and your data protection rights, can be found by reading the ‘Our use of Fraud Prevention Agencies (FPAs)’ section of our main privacy notice.

3.10 Your rights

Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data as described in this notice:

• right to withdraw consent
• right of access to personal data
• right to correction or rectification
• right to request deletion
• right to data portability

Homes England must respond to a request to exercise these rights within 1 month. If you would like to submit a request, contact the data protection officer.

3.11 Data Protection Officer

The contact details for our data protection officer are as follows:

Post:
The Data Protection Officer, Homes England, 2nd Floor, The Lumen, St James' Boulevard, Newcastle upon Tyne, NE4 5BZ.

Telephone:
0300 1234 500

Email:
DPO@homesengland.gov.uk

3.12 Complaints

If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, contact our data protection officer.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Post:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Telephone:
0303 123 1113

Email:
icocasework@ico.org.uk

https://ico.org.uk/global/contact-us/

4. Contractors and agency workers

This section of our privacy notice applies to all contractors and agency workers

4.1 Information we collect

Homes England collects personal data about contractors and agency workers during the engagement process, either directly from contractors, tenderers or sometimes from an employment agency, intermediary or background check provider. We may sometimes collect additional information from third parties including former employers, former clients, credit reference agencies or other background check agencies.

We will collect additional personal information in the course of job-related activities throughout the period of your engagement.

We may collect, store, and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Gender
• Next of kin and emergency contact information
• National insurance number
• Copy of identification (passport or driving licence)
• Bank account details
• Tax status information
• Start date
• Location of engagement or workplace
• Right to work documentation
• References and other information included in a CV or cover letter or as part of the tendering or engagement process)
• Prior employment records (including job titles, work history, working hours, training records and professional memberships)
• CCTV footage and other information obtained through electronic means such as swipe card records
• Information about your use of our information and communications systems
• Photographs

4.2 How we process your information

We will only use your personal information when the law allows us to.

Most commonly, we will useyour personal information in the following circumstances:

1. Where we need to perform the contract we have entered into with you or the employment agency or intermediary through whom you are working.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official purposes.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may process your data for the following purposes:

• Making a decision about your engagement
• National Security Vetting and BPSS checking
• Determining the terms on which you are engaged to work for us
• Checking you are legally entitled to work in the UK
• Paying you or any agency or intermediary
• Deducting tax and National Insurance contributions and other lawful deductions where required by law (for example, under Chapter 10 ITEPA 2003)
• To notify you of any disaster or business continuity event, and recovery action
• Making decisions about the terms of your engagement
• Assessing your suitability or qualifications for a particular job or task
• Making decisions about your continued engagement
• Making arrangements for the termination of the engagement
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work
• Complying with health and safety obligations
• To prevent and detect fraud
• To monitor your use of our information and communication systems to ensure compliance with our IT policies
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• Equality and diversity monitoring
• Publicising our activities (for example, group photos of events, site visits, and so on)
• To ensure that gifts and hospitality you receive are documented in accordance with our policy
• To ensure that any potential conflicts between your work-related interests and your personal interests are identified and managed appropriately. This includes making a declaration of interest periodically or as requested and whenever a new conflict or potential conflict is identified and also in relation to investment information where required under the Market Abuse Regulation.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

4.3 How we process ‘special categories’ of more sensitive personal information

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Information about your health, including any medical condition, health and sickness records
• Biometric data
• Information about criminal convictions and offences

These ‘special categories’ of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. Our data protection policy contains details of the safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

1. Where we need to carry out our legal obligations or exercise rights in connection with your engagement. For example:

• We will use information personal information relating to medical conditions and disability to comply with employment and other laws (insofar as applicable to agency workers and contractors)
• We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to comply with employment law and other laws (insofar as applicable to agency workers and contractors)

1. Where it is needed in the public interest: for example, we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality and diversity monitoring and reporting.
2. In limited circumstances, with your explicit written consent. We do not need your consent to use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law (insofar as applicable to agency workers and contractors).

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

You should be aware that it is not a condition of your engagement with us that you agree to any request for consent from us. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

4.4 Who is the information shared with

We may share your data with third parties, including third-party service providers and other Government departments and agencies. We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

Homes England shares your data with:

• A number of learning and development providers such as:
  • Eukleia
  • Cardinus
  • Civil Service Learning
  • IAM Roadsmart (essential car users)
  • Interactive Driving System
• Service providers such as:
  • Concur
  • Edenred
  • Eventbrite
  • Redfern
  • Occupational Health provider
• Social Media Providers such as:
  • Facebook Workplace
  • X (formerly Twitter)

4.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

Homes England has a records retention schedule that outlines how long we will retain information. To determine the appropriate retention period for personal data collected as part of your engagement, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer engaged by us we will retain and securely destroy your personal information in accordance with our records retention schedule.

5. Information Governance (Freedom of Information, Data Subject Request, Complaints, General Enquiries)

This section of our privacy notice will inform you about how we look after your personal data when you contact us to make a freedom of information request, or exercise your data subject rights under data protection legislation, make a complaint or submit a general enquiry.

5.1 Information we collect

Complaints

When you contact us to make a complaint, we will use the information you have provided to investigate your complaint in accordance with our complaints procedure and to respond to you with the outcome.

Freedom of Information Request

When you contact us to make a freedom of information request, we will use the information provided to respond to you. It is our policy to publish our responses to freedom of information requests on our web site but we will not publish any information that identifies you as the requestor. We will also redact from the information that we provide in response to any freedom of information request all personal data that could identify any individual.

Data Subject Request

When you contact us to make a data subject request, we will ask you to provide evidence of your identity and copies of identity documentation, to ensure that we only provide your personal information to you and not to third parties.

We do not request any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

However, we recognise that you where you write to us with a complaint, you may choose to provide us with information that falls within the definition of Special Categories of Personal Data.

You are not required to provide this information and your complaint will still be processed if you do not provide it.

5.2 How we process your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (for example, for one of our statutory functions)
• Where we need to comply with a legal or regulatory obligation including the Freedom of Information Act 2000, the Environmental Information Regulations 2004 and data protection legislation

Generally we do not rely on consent as a legal basis for processing your personal data.

5.3 Disclosures of your personal data

We may share your personal data with third parties including third-party service providers and other Government departments and agencies. This includes:

• Service providers who provide IT and system administration services to Homes England. For example, our complaints, freedom of information requests and data subject requests are processed using a cloud-based system (Microsoft Dynamics 365)
• Professional advisers including lawyers and auditors
• Ministry for Housing, Communities and Local Government who are the sponsor body for Homes England and commissions Homes England to administer and deliver Government programmes
• HM Revenue and Customs, National Audit Office, regulators and other authorities who require reporting of processing activities in certain circumstances, including agencies involved in the prevention or detection of fraud and money laundering
• Third parties who are mentioned in your complaint, including your landlord (but only if your landlord is a local authority or registered provider). If your landlord is not a local authority or registered provider, then we will not contact your landlord without your consent.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. You can find Microsoft’s contractual commitments in their Online Services Terms. Microsoft’s terms commit Microsoft to the requirements on processors in GDPR Article 28 and other Articles of GDPR. Read frequently asked questions about GDPR.

We or the third parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information. Microsoft relies on the Standard Contractual Clauses (also known as the Model Clauses) as a basis for transfer of data. The Standard Contractual Clauses are standard terms provided by the European Commission that can be used to transfer data outside the European Economic Area in a compliant manner.

Microsoft has incorporated the Standard Contractual Clauses into all of its Volume Licensing agreements via the Online Services Terms. The Article 29 Working Party has found Microsoft’s implementation of the Standard Contractual Clauses is compliant.

5.4 Retention

We retain personal information related to complaints for a period of 3 years after the resolution of the complaint.

We retain information related to freedom of information requests and data subjects requests (including copies of identity documents provided in connection with a data subject request) for a period of 18 months after the response has been provided.

6. Applications for employment

This section of our privacy notice applies to all individuals who apply for a position at Homes England.

6.1 Information we collect

Homes England collects personal data about applicants through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider.

We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies.

We will collect additional personal information in the event that your application to Homes England is successful. After you start work, your information will be processed in accordance with our employee privacy notice, a copy of which will be provided to you with your offer letter.

We will collect, store, and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Gender
• Copies of right to work documentation (evidence to demonstrate your entitlement to work in the United Kingdom)
• References or other information that you may have included in a CV, cover letter or application form
• Records of your previous employment (including job titles, work history, working hours, training records and professional memberships and salary details)

6.2 How we process your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. To process your application and to help us decide whether to make an offer of employment to you.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official purposes.

We may process your data for the following purposes:

• Making a decision about your recruitment or appointment
• National Security Vetting and BPSS checking
• Determining the terms on which you work for us
• Checking you are legally entitled to work in the UK
• To prevent and detect fraud
• To conduct data analytics studies (such as recruitment trends) to review and better understand the profile of candidates who apply to us; and who amongst them are successful.
• Equality and diversity monitoring

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

6.3 How we process ‘special categories’ of more sensitive personal information

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Trade union membership (only where you have mentioned this in your application, for example, where you list being a union representative in ‘positions of responsibility’)
• Information about your health, including any medical condition, health and sickness including pre-employment screening
• Biometric data
• Information about criminal convictions and offences

These ‘special categories’ of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information.

Our data protection policy contains details of the safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

1. Where we need to carry out our legal obligations or exercise rights in connection your application. For example, we will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
2. Where it is needed in the public interest: for example, we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality and diversity monitoring and reporting.
3. In limited circumstances, with your explicit written consent. However, we do not need your consent to use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of any offer of employment with us that you agree to any request for consent from us.
4. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process your personal information without your knowledge or consent, in compliance with the rules mentioned above, where this is required or permitted by law.

6.4 Who is the information shared with

We may share your data with third parties, including third-party service providers and other Government departments and agencies. We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

6.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Unsuccessful applicants’ personal data will usually not be stored for longer than 6 months from the date of application.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. If you accept an offer of employment with us then our employee privacy notice will govern how we process your personal information.

Records will be retained and destroyed in accordance with our records retention schedule, which you will be able to access from our intranet.

7. Former employees

This section of our privacy notice applies to former employees of Homes England.

7.1 Information we collect

Homes England does not collect personal data from former employees after they have left our employment, but it may hold the information that was collected before and during the employment relationship, including:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Gender
• Marital status and dependants
• Next of kin and emergency contact information
• National Insurance number
• Copy of identification (passport or driving licence)
• Bank account details, payroll records and tax status information
• Salary, annual leave, pension and benefits information
• Start date
• Location of employment or workplace
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Employment records (including job titles, work history, working hours, training records and professional memberships)
• Compensation history
• Performance information
• Disciplinary and grievance information
• CCTV footage and other information obtained through electronic means such as swipecard records
• Information about your use of our information and communications systems
• Photographs

7.2 How we process your information

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. Where we need to perform the obligations in a contract we have entered into with you, such as the employment contract, or a settlement agreement. Some of the contractual obligations in these contracts continue after your employment has terminated, such as the duty to observe confidentiality.
2. Where we need to comply with a legal obligation.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest or for official purposes.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may process your data for the following purposes:

• Paying you and deducting tax and National Insurance contributions and other lawful deductions
• Providing you with any employee related benefits to which you are entitled after the termination of your employment
• To reimburse you for expenses incurred in the course of your employment
• Liaising with your pension provider and the trustees and, or, administrators of pension schemes
• Administering any contract we have entered into with you
• Business management and planning, including accounting and auditing
• Gathering evidence for possible grievance or disciplinary hearings
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work
• To prevent and detect fraud
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• To conduct data analytics studies (such as the staff survey) to review and better understand employee retention and attrition rates
• Equality and diversity monitoring
• Publicising our activities (for example, group photos of events, site visits, and so on)

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

7.3 How we process ‘special categories’ of more sensitive personal information

We may also store and use the following ‘special categories’ of more sensitive personal information that we have collected from you:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Trade union membership
• Information about your health, including any medical condition, health and sickness records
• Biometric data
• Information about criminal convictions and offences

These ‘special categories’ of particularly sensitive personal information require higher levels of protection. We need to have further justification for storing and using this type of personal information. Our data protection policy contains details of the safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

1. Where we need to carry out our legal obligations or exercise rights in connection with employment.
2. Where it is needed in the public interest: for example, we will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality and diversity monitoring and reporting. Where possible, we would seek to anonymise this data.
3. In limited circumstances, with your explicit written consent. However, we do not need your consent to use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law.

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

7.4 Who is the information shared with

We may share your data with third parties, including third-party service providers and other Government departments and agencies.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

Homes England shares your data with:

• Occupational Pension Scheme Trustees and Administrators
• Service providers such as:
  • Concur – employee expenses
  • Edenred – employee benefits, for example, childcare vouchers
  • OH Assist – employee assistance programme
  • Equifax – BPSS identity check
  • Redfern – employee travel and accommodation service
• Occupational Health providers
• Nuffield – employee health screening
• Trade Unions of which you are a member including PCS, Unison and Unite
• Social Media Providers for employee engagement and communication such as:
  • Facebook Workplace
  • X (formerly Twitter)

7.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

Homes England has a records retention schedule that outlines how long we will retain information.

To determine the appropriate retention period for personal data collected as part of your employment, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee we will retain and securely destroy your personal information after the following periods:

• 12 months from date of leaving for employees; except
• payroll, tax and NIC records which must be retained required for 6 years. This is a legal requirement.

However, these periods only apply to your employment records and not for example to images and materials created and use for marketing and communication purposes (eg group photographs taken at away days and so on). If you are concerned about the retention and use of any such materials see the Data Rights section below.

8. Home Building Fund and Affordable Housing Programme

This section of our privacy notice aims to give you information on how Homes England collects and processes your personal data when you contact us in connection with an enquiry about, or an application for, Home Building Fund funding or Affordable Housing funding (AHP), including any data you may provide to us when you apply.

In this privacy notice, references to the Home Building Fund should also be taken as including 2 legacy programmes, ‘Get Britain Building’ and ‘Build to Rent’, which are closed to new applications. It also includes the other legacy programmes that have been amalgamated into the Home Building Fund (Builders Finance Fund, Custom Build Serviced Plots Loan Fund, Housing Zones, Local Growth Fund (Housing Infrastructure) and Large Sites Infrastructure Programme).

8.1 Information we collect (or may have collected from you in the past)

Personal data, or personal information, means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data, data such as:

• Identity data — includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, nationality and gender
• Contact data —includes residential address, email address and telephone numbers
• Financial data — includes bank account and, or, statement details and information about the financial status of you or your business, including ownership structures and shareholdings and so on.
• Transaction data — includes details about payments to and from you and other details of products and services you have acquired from us
• Technical data — includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
• Profile data — includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Usage data — includes information about how you use our website, products and services.
• Marketing and communications data — includes your preferences in receiving marketing from us and our third parties and your communication preferences

8.2 How we process your information

We will only process your personal information if there is a lawful basis to do so. Most commonly, we will use your personal information in the following circumstances:

• when processing is necessary for the processing of your application or in connection with any loan or funding agreement or when processing is required prior to entering into an agreement with you (such as Customer Due Diligence or completing a Know your client form)
• when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions
• when processing is necessary for compliance with a legal or regulatory obligations.

Generally we do not rely on consent as a legal basis for processing your personal data.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process your personal information without your knowledge or consent, in compliance with the above rules, where it is this is required or permitted by law.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.

We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out examples of which are provided in the table below.

8.3 Ways that we can use your personal data

Purpose or activity	Type of data	Lawful purpose for processing
To register you as a customer or applicant for the Home Building Fund or AHP funding and to comply with our customer due diligence and ‘know your customer’ (CDD and, or, KYC) processes	— Identity and Address verification — Contact — Profile — Financial	— Performance of a contract with you — Necessary in the public interest to prevent and detect fraud, money laundering, Terrorism Financing and other Financial Crime related activity. — Necessary to comply with a legal or regulatory obligation
To process and deliver your application for a Home Building Fund loan, or AHP funding or other product including: — To manage payments, fees and charges — To collect and recover money owed to us — To evaluate and monitor our exposure to you including credit risk	— Identity and Address verification — Contact — Financial — Transaction — Marketing and Communications	— Performance of a contract with you — Necessary in the public interest (for example, to recover debts due to us or to perform our statutory functions) — Necessary to comply with a legal obligation
To manage our relationship with you which will include: — Notifying you about changes to our terms or privacy notice — Asking you to leave a review or take a survey	— Identity and Address verification — Contact — Profile — Marketing and Communications	— Performance of a contract with you — Necessary to comply with a legal obligation including obligations to prevent and detect fraud, money laundering, Terrorism Financing and other Financial Crime related activity. — Necessary in the public interest (to keep our records updated and to study how customers use our products and, or, services)
To administer and protect our business and our Home Building Fund website or AHP application portals (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	— Identity and address verification — Contact — Technical	— Necessary for the public interest (for running our business, provision of administration and IT services, network security, to prevent and detect fraud and money laundering and in the context of a business reorganisation or group restructuring exercise) — Necessary to comply with a legal obligation
To use data analytics to improve our Home Building Fund website or any AHP portal, products and, or, services, marketing, customer relationships and experiences	— Technical — Usage	Necessary in the public interest (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To provide information to Government about the take-up and effectiveness of the Home Building Fund or AHIP funding and to compile National Statistics	— Identity — Contact — Financial — Transaction — Marketing and Communications	Necessary in the public interest to compile National Statistics (compiled from Aggregated Data) and provide information to government

8.4 Disclosures of your personal data

We may share your personal data with Third Parties for the purposes set out in the table above, including third-party service providers, regulatory bodies and other Government departments and agencies.

We require all Third Parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We or our Third Parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

8.5 Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available in our retention schedule which you can request from us by contacting the Data Protection Officer. By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for a certain period after their relationship ceases for tax and VAT purposes.

In some circumstances you can ask us to delete your data: see the Data Rights section for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. Cladding Safety Scheme (previously known as the Medium Rise Scheme)

9.1 About this notice

This privacy notice explains how we collect, use and protect your personal data; and also the rights you have with regards to that data.

This notice applies to the processing of your personal data through the Cladding Safety Scheme (CSS) only. Refer to Homes England’s main privacy notice for further information on how we process personal data for other purposes.

9.2 Who we are

Homes England is the trading name adopted by the Homes and Communities Agency, our legal entity.

We are the data controller of the personal data processed. This means that we are responsible for deciding how we collect, use and store your personal data.

9.3 Information we collect

We collect personal data from you directly when you or your business register interest, create an account and, or, apply for grant funding from the Cladding Safety Scheme via GOV.UK. The types of data we collect are:

• name(s)
• application ID (unique reference created for each application for the CSS)
• contact details
  • email address
  • telephone number
• information regarding the building to be remediated
  • full building address
• information regarding the Responsible Entity or Representative of the building to be remediated
  • confirmation that you are the firm responsible for repairs and maintenance or that you represent them
  • name, address, email address, job title and telephone number of the person responsible for repairs and maintenance
  • name, email address and telephone number for a secondary contact on the application
• financial information
• Responsible Entity or Representative bank account details
• Fire Risk Appraisal of External Walls (FRAEW)
• technical data relating to the building in line with regulation PAS9980

We also collect data about you from other sources, such as fraud prevention agencies, such as:

• either confirmation of accuracy or identification of irregularities of the types of data listed above
• details that identify your suitability and, or, eligibility for the product you have applied for

9.4 How we process your information

We use the personal data stated above for the following purposes:

Purpose	Data processed	Lawful basis for processing
Register interest in the Cladding Safety Scheme	— name(s) — contact details — address of building to be remediated	public task
To assist you to progress your Cladding Safety Scheme application	— name(s) — contact details	public task
Assessing your application, including performing identity, credit and fraud checks	— name(s) — contact details — details of the building to be remediated — Responsible Entity details (company name, registered address and so on) — bank details — Fire Risk Assessment of External Walls report	contract
Transferring your data to a fraud prevention agency	— name(s) — contact details — details of the building to be remediated — Responsible Entity details (company name, registered address and so on) — bank details	public task
Administration of your Cladding Safety Scheme grant funding agreement	— name(s) — contact details — details of the building to be remediated — Responsible Entity details (company name, registered address and so on) — bank details — Fire Risk Assessment of External Walls report — works package information — contract information — transaction information	contract
Market research – asking for your feedback on the scheme and the process	— name(s) — contact details — details of the building to be remediated — Responsible Entity details (company name, registered address and so on)	legitimate interest
Communications and updates about the CSS	— name(s) — contact details — details of the building to be remediated — Responsible Entity details (company name, registered address and so on)	consent

9.5 What lawful basis do we have to process your personal data?

We are only able to use your personal data when the law allows us to. This is called the lawful basis. In regards to the above purposes, the lawful basis stated for each are explained below:

Contract – Processing your data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

Legal obligation – Processing your data is necessary for compliance with a legal obligation.

Public task – Processing your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions.

Legitimate interests – Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.

Consent – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so, contact the Data Protection Officer using the details provided below.

9.6 Who is the information shared with?

We use service providers to help deliver and administer the grant funding agreement. When we use these service providers, it is necessary for us to share your personal data with them.

The main service providers and why they need your personal data are listed below:

Provider	Reason your data is shared	What data may be shared
Cladding Safety Scheme Service Administrator	To assess your application for grant funding and progress the delivery of an agreed package of fire safety mitigation and, or, remediation works in line with the funding agreement	All data submitted to CSS (including personal information such as name, email and so on)
Department of Levelling Up, Housing and Communities (DLUHC)	To update DLUHC on progress on the scheme and provide information they will need to respond to ministerial questions	All data submitted to CSS (including personal information such as name, email and so on)
Northern Ireland Assembly	To update the Northern Ireland Assembly on progress on buildings entering the CSS that are based in Northern Ireland	All data submitted to CSS from buildings based in Northern Ireland (including personal information such as name, email and so on)
Our IT infrastructure providers	To provide secure data storage and power our internal systems such as our email and phone service	All data submitted to CSS (including personal information such as name, email and so on)
Fraud prevention agencies	To prevent fraud, money laundering and to verify your identity	All data submitted to CSS (including personal information such as name, email and so on)
Building Safety Regulator	To update on works undertaken to buildings and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email and so on)
Fire Safety Service	To update on works undertaken to buildings and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email and so on)
Cladding Safety Scheme cost consultants	To verify costs of a work package where it may fall outside expected benchmarks as required	All data submitted to CSS (including personal information such as name, email and so on)
Cladding Safety Scheme legal advisors	To undertake eligibility checks and contract negotiation of complex cases	All data submitted to CSS (including personal information such as name, email and so on)
Cladding Safety Scheme client-side support providers	To provide bespoke technical support to applicants as required	All data submitted to CSS (including personal information such as name, email and so on)
Cladding Safety Scheme FRAEW Assessor Panel	To undertake or peer review a FRAEW to progress your CSS application	All data submitted to CSS (including personal information such as name, email and so on)
Local authorities (including the Greater London Authority)	To update local authorities on remediation works undertaken to buildings in their area and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email and so on)
Local Authority Building Control	To update local authorities on remediation works undertaken to buildings in their area and to work with us to progress applications as required	All data submitted to CSS (including personal information such as name, email and so on)
Mortgage lenders	To update mortgage lenders on remediation works undertaken to buildings they have an interest in	Building-level information such as building address and works undertaken
Insurance companies	To update insurance companies on remediation works undertaken to buildings they have an interest in	Building-level information such as building address and works undertaken
Royal Institution of Chartered Surveyors and their members	To update on remediation works undertaken to buildings	Building-level information such as building address and works undertaken

In the future we may choose or be obligated to share your information with third parties that are not listed above. If so, we will update this notice and let you know.

Sometimes, we may be legally obliged to provide copies of personal information to other organisations. For example, to provide information to the police or to a public inquiry. We might not be always able to tell you that we have shared your information in this way; however, we will ensure this is only shared in accordance with the law.

9.7 Where is your personal data stored and processed?

All personal data is stored and processed by Homes England and our Service Administrator within offices in the UK and using systems that utilise data centres in the UK.

If one of our service providers ever processes data outside the UK, we will ensure this is only where we can ensure that your personal data is adequately protected.

9.8 How long do we keep your personal data?

We will store your data for period of 6 years from the end of your relationship with us. This is so we can comply with our general legal obligations and for the exercise or defence of any legal claims.

9.9 Fraud prevention

Fraud prevention agencies (FPAs)

The personal data we have collected from you may be shared with FPAs who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment.

Further details of how your information will be used by us and these FPAs, and your data protection rights, can be found by reading the ‘Our use of Fraud Prevention Agencies (FPAs)’ section of our main privacy notice.

9.10 Your rights

Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data as described in this notice:

• right to withdraw consent
• right of access to personal data
• right to correction or rectification
• right to request deletion
• right to data portability

Homes England must respond to a request to exercise these rights within 1 month. If you would like to submit a request, contact the data protection officer.

9.11 Data Protection Officer

Post:
The Data Protection Officer, Homes England, 2nd Floor, The Lumen, St James' Boulevard, Newcastle upon Tyne, NE4 5BZ.

Telephone:
0300 1234 500

Email:
DPO@homesengland.gov.uk

9.12 Complaints

If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, contact our data protection officer.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Post:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Telephone:
0303 123 1113

Email:
icocasework@ico.org.uk

ico.org.uk/global/contact-us/

10. Buildings, sites and premises

This section of our privacy notice applies to visitors to buildings, sites or other premises owned or controlled by Homes England.

10.1 Information we collect and how it is processed

We have security measures in place at our buildings and sites, including in some cases the use of CCTV and building access controls. This is to deter, prevent and detect crime at our premises and ensure only those people who are entitled to be admitted gain access to our premises.

Where CCTV is in use, there are signs in place to notify any individuals. The images captured are securely stored and only accessed on a need to know basis (for example, to look into an incident).

We require visitors to our offices to sign in at reception and we keep a record of visitors for a short period of time.

10.2 Retention

CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft).

Our visitor records are securely stored and only accessible on a need to know basis (for example, to look into an incident).

11. Our use of Credit Reference Agencies

We carry out credit and identity checks when you apply for a product or services for you or your business. We may use Credit Reference Agencies (CRAs) to help us with this. If you use our services, from time to time we may also search information that the CRAs have, to help us manage those accounts.

To do this, we’ll supply your personal data to CRAs and they’ll give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply us with both public (including the electoral register) and shared credit information, financial situation, history and fraud prevention information.

We’ll use this data to:

• assess whether you or your business is able to afford to make repayments
• verify the accuracy of the data you’ve provided to us, including details of your identity
• help detect and prevent financial crime
• manage your accounts with us
• trace and recover debts
• ensure any offers provided to you are appropriate to your circumstances.

We will go on sharing your personal data with CRAs for as long as you are a customer. This will also include details of funds going into the account, and the account balance. If you borrow, it will also include details of your repayments and whether you repay in full and on time. We will also tell the CRAs when you settle your accounts with us. The CRAs may give this information to other organisations that want to check your financial status.

When we ask CRAs about you or your business, they will note it on your credit file. This is called a credit search footprint. Other lenders may see this and we may see credit searches from other lenders.

If you apply for a one of our products or services (such as where you apply for Help to Buy: Equity Loan), we’ll get details of your credit history from a CRA (and share information about you with the CRA) and use this information to work out whether you or your business can afford to borrow or pay back.

We may also carry out further credit checks on you while you’re a customer to maintain an accurate and up-to-date record of your credit history.

If you’re making a joint application, or tell us that you have a spouse, partner or civil partner – or that you are in business with other partners or directors, we’ll link your records together. You should discuss this with them, and share this information with them before submitting the application.

CRAs will also link your records together and these links will remain on your and their files until you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail on their websites.

They’ve created a joint document called the Credit Reference Agency Information Notice (CRAIN) which is accessible from each of the 3 CRAs — going to any of these 3 links will also take you to the same CRAIN document:

11.1 Credit reference agencies

TransUnion – www.transunion.co.uk/crain
Equifax – www.equifax.co.uk/privacy-hub/crain
Experian – www.experian.co.uk/legal/crain/

12. Our use of Fraud Prevention Agencies

Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.

We will process personal data such as your name, address, date of birth, contact details, financial information, employment details and device identifiers including IP address.

We and Fraud Prevention Agencies (FPAs), who are data controllers in their own right, may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

We process your personal data on the basis that it is necessary in the public interest or in exercising official authority for us to prevent fraud and money laundering, and to verify identity, in order to protect ourselves and to comply with laws that apply to us.

FPAs can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to 6 years.

12.1 How you may be affected

If we, or an FPA, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you.

A record of any fraud or money laundering risk will be retained by the FPAs, and may result in others refusing to provide services, financing or employment to you.

12.2 Data transfers outside the UK

FPAs may allow the transfer of your personal data outside the UK. This may to be a country where the UK government has decided that your data will be protected to UK standards, but if the transfer is to another type of country then the FPAs will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

12.3 Your rights

Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data; request that your personal data is erased or corrected; request access to your personal data.

For more information or to exercise your data protection rights, contact our Data Protection Officer:

Post:
The Data Protection Officer, Homes England, 2nd Floor, The Lumen, St James' Boulevard, Newcastle upon Tyne, NE4 5BZ.

Telephone:
0300 1234 500

Email:
DPO@homesengland.gov.uk

Alternatively, refer to the information notice of CIFAS, the main Fraud Prevention Agency we use.

13. Homes England external events

This privacy notice explains how we collect, use and protect your personal data; and the rights you have with regards to that data.

This notice applies to the processing of your personal data where you either:

• register for, participate in, or attend an event hosted by Homes England
• attend an external event organised by a third party, where you will be participating in a Homes England activity such as a seminar, talk, presentation, networking event, or visiting a Homes England exhibition stand.

Refer to Homes England’s main privacy notice for further information on how we process personal data for other purposes.

Who are Homes England?

Homes England is the trading name adopted by the Homes and Communities Agency, our legal entity.

We are the data controller of the personal data processed. This means that we are responsible for deciding how we collect, use and store your personal data.

Information we collect

Prior to an event, or at an event, we may collect, store and use the following categories of personal data:

• your first and last name
• your work title
• your work email address
• your dietary requirements, if you feel this is required
• your accessibility requirements, if you feel this is required
• feedback provided by attendees about an event, following attendance to support report writing and further event planning
• photographs may be taken during the events to support internal and external promotion of Homes England. You can opt out of your photograph being published.

Why we process your information

We use the personal data stated above for the following purposes:

• to plan the event, including the registration process
• to facilitate the event, including meeting accessibility and catering needs
• to respond to any questions or enquiries you raise
• to share similar events or related information you may be interested in (based on your preferences)

If you have any questions about the event, you can contact the Events and External Relations Team by emailing events@homesengland.gov.uk.

What lawful basis do we have to process your personal data?

We will only use your personal data for reasons recognised in data protection law. These are known as lawful bases and we rely on the following lawful bases to manage external events:

• legal obligation – processing your data is necessary for compliance with a legal obligation, such as to support venue accessibility and fire risk assessment needs
• legitimate Interests – processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests
• consent – you have given us your consent to process your personal data for the specific purpose we have explained to you. We also rely on your explicit consent to collect information about your accessibility or dietary requirements, as this may include more sensitive information (known as special category data). You have the right to withdraw your consent at any time. To do so contact Homes England’s Data Protection Officer

Who is the information shared with?

Homes England collects your personal data through our data processor, Ticket Tailor, which is a UK-based event ticketing platform. This is for the purpose of effectively managing event registrations, ensuring proper event logistics, and providing a seamless experience for attendees. You can find privacy information about Ticket Tailor at: www.tickettailor.com/legal/privacy-policy.

We don’t share information about dietary or accessibility requirements in an identifiable way with the venue.

Sometimes, we may be legally obliged to provide copies of personal information to other organisations. For example, to provide information to the police, or to a public inquiry. We might not be always able to tell you that we have shared your information in this way, however we will ensure this is only shared in accordance with the law.

Where is your personal data stored and processed?

All personal data is stored and processed by Homes England within offices in the UK and using systems that utilise data centres in the UK.

If one of our service providers ever processes data outside the UK, we will ensure this is only where we can ensure that your personal data is adequately protected.

How long do we keep your personal data?

For the purposes of effective event management, Homes England will only retain your personal data for 1 year after the event occurs.

Your rights

Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data as described in this notice: 

• right to withdraw consent
• right to access your personal  data
• right to have your personal data corrected or rectified
• right to request your personal data is deleted
• right to data portability

Homes England must respond to a request to exercise these rights within one month. If you would like to submit a request, contact the Data Protection Officer.

Data Protection Officer

The contact details for our Data Protection Officer are as follows: 

Post:
The Data Protection Officer, Homes England, 2nd Floor, The Lumen, St James' Boulevard, Newcastle upon Tyne, NE4 5BZ.

Telephone:
0300 1234 500

Email:
DPO@homesengland.gov.uk

Complaints

If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, contact our Data Protection Officer. If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): 

Post:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Telephone:
0303 123 1113

Email:
icocasework@ico.org.uk

14. Glossary

Definitions of certain terms in this privacy notice.

14.1 ‘Lawful Basis’

Public Interest - a data controller may process personal data without consent where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

14.2 ‘Special categories of personal data’

Personal data revealing race or ethnicity, political opinions, religion or beliefs, trade union membership, health or sex life, sexual orientation, genetic data or biometric data.

14.3 ‘Third parties’

Service providers who provide IT and system administration services to Homes England. In particular, Homes England’s e-tendering tool (ProContract) is hosted by ProActis (Due North). If you register to use the e-tendering system, you will be required to agree to the ProActis Terms and Conditions of using the system, and also their privacy notice.

Professional advisers including lawyers, bankers, auditors and insurers based who provide consultancy, banking, legal, insurance and accounting services.

Ministry for Housing, Communities and Local Government who are the sponsor body for Homes England and commissions Homes England to administer and deliver Government programmes.

HM Revenue and Customs, regulators and other authorities who require reporting of processing activities in certain circumstances, including those involved in the prevention or detection of fraud and money laundering.

The Police

HM Treasury and National Audit Office

Credit reference, CDD providers and rating agencies who may help us decide whether to provide you with a product or a service.

Third parties to whom we may choose to outsource, sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.