Privacy Policy

Homes England (the trading name adopted by the Homes and Communities Agency) is committed to protecting the privacy and security of your personal data.

This privacy notice aims to give you information on how Homes England collects and processes the personal data provided to us, including information that you provide directly, and tell you about your rights and how the law protects you.

Homes England’s websites are not intended for use by children and we do not knowingly collect personal data that could identify individual children.

Please use the Glossary to help you understand the meaning of some of the terms used in this privacy notice.

Our specific processing notices

For ease of use, this privacy notice is provided in a layered format. Please refer to the sections of this notice that are relevant to you. Alternatively you can download a full pdf version of the notice below.

Homes England Privacy Notice - Full

PDF, 694KB, 38 pages

This file may not be suitable for users of assistive technology.

Request an accessible format.

• Users of our website and web portals
• Help to Buy
• Contractors and agency workers
• Information Governance and enquiries (making a Freedom of Information Request, exercising Data Subject Rights, making a complaint or making a general enquiry)
• Applicants for employment
• Former employees
• Home Building Fund and Affordable Housing Programmes (and legacy programmes)
• Visitors to our buildings/sites/premises

It is important that you read this privacy notice together with the specific section of the notice that governs the processing activity that is relevant to you, in addition to any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.

How we keep your personal data secure

Homes England takes the security of all the data we hold very seriously. We adhere to internationally recognised security standards. Our Information Security Management System (ISMS), utilises ISO/IEC27001:2013 as a framework and the Plan-Do-Check-Act (PDCA) model is adopted.

We have policies, procedures and training in place covering data protection, confidentiality and security and regularly review the appropriateness of the measures we have in place to keep the data we hold secure.

Disclosures of your personal data

We may share your personal data with Third Parties including Third-Party service providers, regulatory bodies, the Police and other Government departments and agencies. Where we do so, we will require all Third Parties to respect the security of your personal data and to treat it in accordance with the law.

We or our Third Parties may transfer your personal data outside the EU. Where we do so, we have put in place measures to ensure your personal information is provided with adequate protection in accordance with data protection legislation.

For more information about the purposes for which we may share your data with Third Parties, please refer to the relevant section of this privacy notice that governs each specific processing activity.

Retention

Homes England will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory accounting, or reporting requirements.

• To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.
• By law we have to keep basic information about our customers and suppliers for tax and VAT purposes for a certain period after the last transaction.
• In some circumstances you can ask us to delete your data: see the Data Rights section for further information.
• In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Our role as Data Controller

The Homes and Communities Agency, trading as Homes England, is a “data controller” for the purposes of the General Data Protection Regulation (GDPR) and the Data Protection Act 1998 (as updated, amended and re-enacted from time to time). This means that we are responsible for deciding how we hold and use your personal data.

Data Protection Officer

The contact details for our data protection officer are as follows:

• By post: For the attention of the Data Protection Officer, Homes England, Windsor House, 50 Victoria Street, London , SW1H 0TL
• By email: DPO@homesengland.gov.uk
• By phone: 0300 1234 500

Data Rights

Under the data protection legislation, with effect from 25 May 2018, you have certain rights with regard to your personal data. Homes England must respond to a request to exercise these rights within one month. If you would like to request details of the personal data we hold about you, please contact the Data Protection Officer.

Under certain circumstances and with effect from 25 May 2018, by law you have the following rights in regard to your personal data:

• Right to be informed – you have the right to request details of how your personal data is processed. This privacy notice is a proactive document designed to meet this right.
• Right to request access – you can request copies of the personal data we hold about you. This is commonly known as a “subject access request” or SAR. The purpose of this request is to establish the accuracy of the personal data we hold and to check we are processing it lawfully.
• Right to request correction or rectification – if you think that some or all of the personal data we hold on you is incorrect or incomplete, you can ask for it to be corrected.
• Right to request erasure – you have to right to ask us to delete your personal data if you think that we do not have a legal reason to continue to process it.
• Right to request suspension of processing – this enables you to request we suspend processing your personal data; for example while we establish the accuracy of the data.
• Right to object – you have the right to object to the processing of your personal data for direct marketing purposes.
• Right to request data portability – you can request that your personal data is transferred to a third party directly in a readable format.

In the limited circumstances where you may have been asked for, and provided, your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another lawful basis for doing so.

Complaints

If you are unhappy with how any aspect of this privacy notice, or how your personal information is being processed, please contact the Data Protection Officer.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

• Tel: 0303 123 1113
• Email: casework@ico.org.uk
• Website: ICO

Glossary

LAWFUL BASIS

Public Interest - a data controller may process personal data without consent where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

SPECIAL CATEGORIES OF PERSONAL DATA

Personal data revealing race or ethnicity, political opinions, religion or beliefs, trade union membership, health or sex life, sexual orientation, genetic data or biometric data.

THIRD PARTIES

• Service providers who provide IT and system administration services to Homes England. In particular, Homes England’s e-tendering tool (ProContract) is hosted by ProActis (Due North). If you register to use the e-tendering system, you will be required to agree to the ProActis Terms and Conditions of using the system, and also their privacy notice.
• Professional advisers including lawyers, bankers, auditors and insurers based who provide consultancy, banking, legal, insurance and accounting services.
• Ministry for Housing, Communities and Local Government who are the sponsor body for Homes England and commissions Homes England to administer and deliver Government programmes
• HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances, including those involved in the prevention or detection of fraud and money laundering.
• The Police
• HM Treasury and National Audit Office
• Credit reference, CDD providers and rating agencies who may help us decide whether to provide you with a product or a service
• Third parties to whom we may choose to outsource, sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.