We keep the Healthy and Sustainable Homes Service Privacy Notice under review. It was last reviewed and updated in December 2021.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
- collecting personal data
- using personal data
- our legal basis for using personal data
- sharing personal data
- retaining personal data
- further processing of personal data
- your rights relating to personal data
Collecting personal data
- only ask for what is necessary to provide our Healthy and Sustainable Homes services
- protect it and make sure nobody has access to it who shouldn’t
- ensure you know if you have a choice about giving us information
- only share your personal information with other City of York Council departments or with external partners, agencies and contractors involved in delivering services on our behalf
- delete or destroy it securely when we no longer have a need to keep it
We ask that you:
- give us accurate information
- tell us as soon as possible of any changes
- tell us as soon as possible if you notice mistakes in the information we hold about you
See further details about the steps we take when we collect your personal data.
Using personal data
We will use the personal data you give us to provide the following:
- advice and regulatory services in connection with the private rented sector and caravan sites
- energy efficiency and fuel poverty assistance
- disabled adaptations and falls prevention services
- repair loans for homeowners and handyperson services
- improved services through analysis of customer satisfaction survey data
Our legal basis for using personal data
Our legal basis for using personal data falls under the following categories:
- Consent - for some data such as personal data stored by the service, including contact preferences and financial information, we require explicit consent from you as the data subject to allow us to store and process your data
- Legal Obligation - certain data we have a legal obligation to process and keep in accordance with legislation, for example to make licensing decisions in relation to Houses in Multiple Occupation (HMO) or Caravan/Park Home Sites
- Public Task - in some cases it will be necessary to process your data in order to carry out a public task which the service has a duty, or power, to carry out
- Contract - we have to keep some data for contractual reasons, such as supplier contracts or other agreements between you and us
- Vital Interests - in very rare situations we can process personal information in order to protect an individuals life
- Special Category Data - we will only process special category data in order meet our Public Services Equality Duty, and if you have provided explicit consent
- Criminal Offence Data – we will only process criminal offence data to inform a ‘fit and proper person’ decision in relation to the licensing of Houses in Multiple Occupation (as required under section 66 Housing Act 2004)
Sharing personal data
Your personal data will be treated as strictly confidential and will only be shared with third parties in order to carry out a service to you that you have requested. We will only share your data with third parties with your explicit consent (for example, a contractor who you want a quote from for work that we are funding), OR where we have good reason to believe that failing to do so would put you or someone else at risk.
We do NOT sell any data to third party organisations, however we do charge a reasonable fee for a full copy of the HMO licence register, in line with section 232 Housing Act 2004.
We have an agreement in place with Attend Anywhere to provide secure online conversations. See the Attend Anywhere privacy statement.
As a rule, we do not transfer your personal data to third party processors outside the European Economic Area (EEA).
We may use Zoom Pro or Business version of Zoom (version 5) to host some public facing meetings, training sessions etc across different services in the council. Where these meetings are recorded, recordings will be kept locally on our server and will not be retained by Zoom.
Some personal data will be stored securely on Zoom’s system in the USA (that is, outside the EEA) in compliance with the EU, USA Privacy Shield Framework. This data may include a user's:
- email address
- telephone number where applicable
- IP address
- MAC address
- other device ID (UDID)
- device type
- operating system type and version
- client version
- type of camera, microphone or speakers
- connection type
Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
We will keep your personal data only for a long as is necessary for the purpose it was obtained. In general we only hold your personal data for a minimum of 1 year and a maximum of 7 years.
The exception to this is data relating to the following, which are subject to their own retention periods:
- disabled facilities grants
- loans for owner occupiers
- HMO and Caravan Site licences
- works in default
- Prohibition and Closing Orders
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Where your personal data is held
The locations where your personal data is stored include:
- the Civica APP database, a customer and case management computer system
- Verso, a third party web software managing online HMO Licence applications
- Mosaic Social Services database
In a few cases this information will also be held in a paper file. Other information, including emails, photographs and letters may be held on the council’s email and document servers. All personal information about you that is held by us is subject to appropriate security policies and restrictions.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.