Information Governance - privacy notice
This section of our privacy notice will inform you about how we look after your personal data when you contact us to make a freedom of information request, or exercise your data subject rights under data protection legislation, make a complaint or submit a general enquiry.
Applies to England
Documents
Details
It is important that you read this section of our privacy notice together with the main section of our privacy notice above, or any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you. This is so that you are fully aware of how and why we are using your data.
Information we collect
Complaint
When you contact us to make a complaint, we will use the information you have provided to investigate your complaint in accordance with our complaints procedure and to respond to you with the outcome.
Freedom of Information Request
When you contact us to make a freedom of information request, we will use the information provided to respond to you. It is our policy to publish our responses to freedom of information requests on our web site but we will not publish any information that identifies you as the requestor. We will also redact from the information that we provide in response to any freedom of information request all personal data that could identify any individual.
Data Subject Request
When you contact us to make a data subject request, we will ask you to provide evidence of your identity and copies of identity documentation, to ensure that we only provide your personal information to you and not to third parties.
We do not request any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
However, we recognise that you where you write to us with a complaint, you may choose to provide us with information that falls within the definition of Special Categories of Personal Data.
You are not required to provide this information and your complaint will still be processed if you do not provide it.
How we process your information
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
- Where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (for example, for one of our statutory functions).
- Where we need to comply with a legal or regulatory obligation including the Freedom of Information Act 2000, the Environmental Information Regulations 2004 and data protection legislation.
Generally we do not rely on consent as a legal basis for processing your personal data.
Disclosures of your personal data
We may share your personal data with third parties including third-party service providers and other Government departments and agencies. This includes:
- Service providers who provide IT and system administration services to Homes England. For example, our complaints, freedom of information requests and data subject requests are processed using a cloud-based system (Microsoft Dynamics 365)
- Professional advisers including lawyers and auditors.
- Ministry for Housing, Communities and Local Government who are the sponsor body for Homes England and commissions Homes England to administer and deliver Government programmes
- HM Revenue & Customs, National Audit Office, regulators and other authorities who require reporting of processing activities in certain circumstances, including agencies involved in the prevention or detection of fraud and money laundering.
- Third parties who are mentioned in your complaint, including your landlord (but only if your landlord is a local authority or registered provider). If your landlord is not a local authority or registered provider, then we will not contact your landlord without your consent.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. You can find Microsoft’s contractual commitments in the Online Services Terms. Microsoft’s terms commit Microsoft to the requirements on processors in GDPR Article 28 and other Articles of GDPR. For more information please click here.
We or the third parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information. Microsoft relies on the Standard Contractual Clauses (also known as the Model Clauses) as a basis for transfer of data. The Standard Contractual Clauses are standard terms provided by the European Commission that can be used to transfer data outside the European Economic Area in a compliant manner. Microsoft has incorporated the Standard Contractual Clauses into all of its Volume Licensing agreements via the Online Services Terms. The Article 29 Working Party has found Microsoft’s implementation of the Standard Contractual Clauses is compliant.
Retention
We retain personal information related to complaints for a period of 3 years after the resolution of the complaint.
We retain information related to freedom of information requests and data subjects requests (including copies of identity documents provided in connection with a data subject request) for a period of 18 months after the response has been provided.