Users of our website and web portals - privacy notice
This section of our privacy notice applies to all individuals who visit our websites or provide information to us through one of our web portals.
Applies to England
Documents
Details
It is important that you read this section of our privacy notice together with the main section of our privacy notice, or any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you. This is so that you are fully aware of how and why we are using your data.
Gov.uk and third party links
Please note that our gov.uk web address is provided to us by the Government Digital Service (GDS). Please ensure that when visiting this website that you read the GDS privacy notice to understand how this may affect your personal data.
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
Information we collect
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data, data such as:
- Identity Data – this includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, nationality and gender.
- Contact Data – this includes billing address, residential address, delivery address, email address and telephone numbers.
- Financial Data – this includes bank account and payment card details and information about the financial status of you or your business, including ownership structures and shareholdings etc.
- Transaction Data – this includes details about payments to and from you and other details of products and services you have purchased from us.
- Technical Data – this includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
- Profile Data – this includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
- Procurement Data – this includes information that we may need to obtain and consider to ascertain in connection with UK and EU public procurement legislation (eg whether grounds for exclusion under the Public Contracts Regulations 2015 may apply)
- Usage Data – this includes information about how you use our website, products and services.
- Marketing and Communications Data – this includes your preferences in receiving marketing from us and our third parties and your communication preferences.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data is data that may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
We do not request any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). However, we recognise that where you are applying for a service or product, or tendering to provide goods, services or works, you may choose to provide us with information that falls within the definition of Special Categories of Personal Data.
For example, when you are using our Property Consents web portal to apply for our consent to make alternations to a property, you may decide to supply information about any mobility-related issues faced by occupants in support of your application.
You are not required to provide any Special Category information as part of any application you make to us and your application will still be processed if you do not provide it.
Special categories of particularly sensitive personal information require higher levels of protection than other personal data. Where you do supply such information, we will rely on the ground that it is being processed by us in furtherance of the establishment and exercise of your legal rights.
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested by us, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services). In this case, we may have to cancel a product or service you have with us, or decline your application, but we will notify you if this is the case at the time.
How your personal data collected
We use different methods to collect data from and about you including through:
Direct interactions
You may give us your Identity, Contact, Financial Data and Procurement Data by filling in forms (eg Know your customer form) or by corresponding with us by post, phone, email or otherwise.
This includes personal data you provide or that you may have provided when you:
- apply for our products or services;
- complete Know your Customer (KYC) or Customer Due Diligence (CDD)
- create an account on our website;
- subscribe to our service or publications;
- request marketing to be sent to you;
- enter a competition, promotion or survey;
- submit a tender or quote;
- give us feedback; and
- have applied for products in the past, such as the Get Britain Building funding or Build to Rent funding
Automated technologies or interactions
As you interact with our website, or those of third parties, we may automatically collect Technical Data and Procurement Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.
Third parties or publicly available sources
We may receive personal data about you from various third parties and public sources as set out here and as detailed below:
- Technical Data from the following parties:
- analytics providers such as Google based outside the EU;
- search information providers inside or outside the EU.
- Contact, Procurement Financial and Transaction Data from providers of technical, payment and delivery services inside or outside the EU.
- Identity Procurement and Contact Data from data brokers or aggregators based inside or outside the EU.
- Identity Procurement and Contact Data from credit reference agencies and CDD providers, publicly availably sources such as Companies House and the Electoral Register based inside the EU.
How we process your information
We will only process your personal information if there is a lawful basis to do so. Most commonly, we will use your personal information in the following circumstances:
- when processing is necessary for the performance of a contract or when processing is required prior to entering into a contract with you.
- when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example, for one of our statutory functions.
- when processing is necessary for compliance with a legal or regulatory obligation.
- to prevent and detect crime, including fraud
Generally we do not rely on consent as a legal basis for processing your personal data.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where it is this is required or permitted by law.
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please email us on DPO@homesengland.gov.uk
If you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
Disclosures of your personal data
We require all Third Parties to respect the security of your personal data and to treat it in accordance with the law.
We may share your personal data with Third Parties for the purposes set out in the table above including third-party service providers, regulatory bodies and other Government departments and agencies.
For example, our e-tendering tool (ProContract) is hosted by ProActis (Due North). If you register to use the ProContract e-tendering system, you will be required to agree to the ProActis Terms and Conditions of using the system, and also their privacy notice.
We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We or our Third Parties may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
Retention
Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.
Details of retention periods for different aspects of your personal data are available in our retention schedule.
By law we have to keep basic information about our customers and suppliers (including Contact, Identity, Financial and Transaction Data) for a certain period after they cease being customers for tax and VAT purposes.
In some circumstances you can ask us to delete your data: see the Data Rights section for further information.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.