Housing Standards and Adaptations Privacy Notice

We keep the Housing Standards and Adaptations Privacy Notice under review. It was last reviewed and updated in July 2020.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy and transparency information for all of the City of York Council (CYC).

Collecting personal data


  • only ask for what is necessary to provide our Housing Standards and Adaptations services
  • protect it and make sure nobody has access to it who shouldn’t
  • ensure you know if you have a choice about giving us information
  • only share your personal information with other City of York Council departments or with external partners, agencies and contractors involved in delivering services on our behalf
  • delete or destroy it securely when we no longer have a need to keep it

We ask that you:

  • give us accurate information
  • tell us as soon as possible of any changes
  • tell us as soon as possible if you notice mistakes in the information we hold about you

See further details about the steps we take when we collect your personal data.

Using personal data

We will use the personal data you give us to provide the following:

  • advice and regulatory services in connection with the private rented sector and caravan sites
  • energy efficiency and fuel poverty assistance
  • disabled adaptations and falls prevention services
  • repair loans for homeowners and handyperson services
  • improved services through analysis of customer satisfaction survey data

Our legal basis for using personal data

Our legal basis for using personal data falls under the following categories:

  • Consent - for some data such as personal data stored by the service, including contact preferences and financial information, we require explicit consent from you as the data subject to allow us to store and process your data
  • Legal Obligation - certain data we have a legal obligation to process and keep in accordance with legislation, for example to make licensing decisions in relation to Houses in Multiple Occupation (HMO) or Caravan/Park Home Sites
  • Public Task - in some cases it will be necessary to process your data in order to carry out a public task which the service has a duty, or power, to carry out
  • Contract - we have to keep some data for contractual reasons, such as supplier contracts or other agreements between you and us
  • Vital Interests - in very rare situations we can process personal information in order to protect an individuals life
  • Special Category Data - we will only process special category data in order meet our Public Services Equality Duty, and if you have provided explicit consent
  • Criminal Offence Data – we will only process criminal offence data to inform a ‘fit and proper person’ decision in relation to the licensing of Houses in Multiple Occupation (as required under section 66 Housing Act 2004)

Sharing personal data

Your personal data will be treated as strictly confidential and will only be shared with third parties in order to carry out a service to you that you have requested. We will only share your data with third parties with your explicit consent (for example, a contractor who you want a quote from for work that we are funding), OR where we have good reason to believe that failing to do so would put you or someone else at risk.

We do NOT sell any data to third party organisations, however we do charge a reasonable fee for a full copy of the HMO licence register, in line with section 232 Housing Act 2004.

We have an agreement in place with Attend Anywhere to provide secure online conversations. See the Attend Anywhere privacy statement.

As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA). However, for as long as the provisions of the Local Authorities and Police and Crime Panels (Coronavirus) (Flexibility of Local Authority and Police and Crime Panel Meetings) (England and Wales) Regulations 2020/392 remain in effect we will be hosting training webinars and we are currently using Zoom Pro or Business version of Zoom to host meetings (version 5) for that purpose.

Where meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom. Some personal data, such as user’s names, email addresses; telephone numbers where applicable, IP address, MAC address, other device ID (UDID), device type, operating system type and version, client version, type of camera, microphone or speakers, connection type, etc. will be stored securely on Zoom’s system in the US (that is, outside the EEA) in compliance with the EU – US Privacy Shield Framework. Zoom’s certification may be viewed online.

Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services. Zoom’s privacy policy can be viewed online.

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.

Retaining personal data

We will keep your personal data only for a long as is necessary for the purpose it was obtained. In general we only hold your personal data for a minimum of 1 year and a maximum of 7 years.

The exception to this is data relating to the following, which are subject to their own retention periods:

  • disabled facilities grants
  • loans for owner occupiers
  • HMO and Caravan Site licences
  • works in default
  • Prohibition and Closing Orders

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.

Where your personal data is held

The locations where your personal data is stored include:

  • the Civica APP database, a customer and case management computer system
  • Verso, a third party web software managing online HMO Licence applications
  • Mosaic Social Services database

In a small number of cases this information will also be held in a paper file. Other information, including emails, photographs and letters may be held on the council’s email and document servers. All personal information about you that is held by us is subject to appropriate security policies and restrictions.

Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.

Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145