First Homes privacy statement

Effective Date: 28 January 2025

Cheltenham Borough Council (CBC) is committed to protecting and respecting your privacy. This privacy notice explains how we collect, use, store, and share your personal data when providing First Homes services.

1. Contact details

For general First Homes enquiries:

Email: [email protected]

For data protection queries related to First Homes:

Email: [email protected]

For general data protection queries:

Email: [email protected]

2. What information we collect

We collect and process the following personal data for different purposes:

2.1. To provide services and goods, including delivery

  • Personal identifiers: Name, address, date of birth, and contact details.
  • Property details: Purchase or account history, account information.
  • Financial and legal records: Identification documents related to home purchase.

2.2. For service updates and marketing

  • Personal identifiers: Name, address, contact details.

2.3. For research or archiving purposes

  • Personal identifiers: Name, address, contact details.
  • Other data: Information used for research and statistical purposes.

2.4. To handle queries, complaints, or claims

  • Personal identifiers: Name, address, contact details.
  • Account details: Customer or client accounts and records.
  • Correspondence: Emails, letters, and recorded communications.

3. Why we collect your information (lawful basis)

Under UK GDPR, we must have a lawful basis for processing your personal data. The lawful basis depends on the purpose of processing:

3.1. Providing services and goods

  • Legal obligation (UK GDPR Article 6(1)(c)) – Processing is required under Section 106 of the Town and Country Planning Act 1990.
  • Public task (UK GDPR Article 6(1)(e)) – Processing is necessary for a task in the public interest.

3.2. Service updates and marketing.

  • Legal obligation (UK GDPR Article 6(1)(c)) – Where required under planning regulations.
  • Public task (UK GDPR Article 6(1)(e)) – Where required to inform service users of relevant updates.

3.3. Research and archiving.

  • Legal obligation (UK GDPR Article 6(1)(c)) – Where required by law.
  • Public task (UK GDPR Article 6(1)(e)) – For planning and statistical purposes.

3.4. Handling queries, complaints, or claims

  • Legal obligation (UK GDPR Article 6(1)(c)) – Processing is required under the Freedom of Information Act 2000 and other relevant laws.
  • Public task (UK GDPR Article 6(1)(e)) – To respond to official requests.

Note: Where we rely on consent (UK GDPR Article 6(1)(a)) (e.g., marketing communications), you can withdraw your consent at any time.

4. Where we get personal information from

We collect personal data from:

  • You – When you contact us, apply for First Homes, or engage with CBC.
  • Legal and judicial sector organisations – For compliance with housing regulations.
  • Developers and their legal representatives – As part of housing agreements.

5. Who we share your information with

We may share your personal data with:

  • Cheltenham Borough Council’s internal teams – To provide relevant services.
  • One Legal (CBC’s legal services provider) – To ensure legal compliance.
  • Regulatory bodies – If required by law.
  • Other public authorities – Where necessary for planning and housing regulations.

We do not sell your personal data to third parties.

6. Data retention – How long we keep your information

Cheltenham Borough Council follows the principle of data minimisation and will retain your personal data only for as long as necessary.

  • First Homes buyers' data: Retained for two years from the date of collection, after which it is securely deleted.
  • Information relating to First Homes buyer incomes, savings and occupations will be retained to assist local authorities in developing Local Plans for five years from the date of data collection
  • Complaints and query data: Retained for the period required by legal or regulatory obligations.

We securely erase or anonymise data when no longer needed.

7. Data security

We have implemented appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse, including:

  • Encryption – Ensuring data security during storage and transfer.
  • Access controls – Restricting access to authorised personnel only.
  • Regular security audits – Assessing vulnerabilities and enhancing security.
  • Secure disposal – Ensuring proper deletion of data when no longer required.

If a data breach occurs that poses a risk to your personal data, we will notify you and the ICO within 72 hours, where required by law.

8. International data transfers

We do not routinely transfer your personal data outside the UK.

However, if data needs to be transferred internationally (e.g., to third-party service providers using cloud storage), we ensure:

  • Adequate safeguards are in place, such as:
    • UK Data Protection Agreements with relevant entities.
    • International Data Transfer Agreements (IDTAs) in compliance with UK GDPR.
    • UK government-approved adequacy decisions (where applicable).

If an international transfer is necessary, we will notify you and ensure your data is protected to UK standards.

9. Your data protection rights

Under UK GDPR, you have the following rights regarding your personal data:

  1. Right of access – Request copies of your data.
  2. Right to rectification – Ask for corrections to inaccurate data.
  3. Right to erasure – Request deletion of your data (subject to legal exemptions).
  4. Right to restrict processing – Limit how we use your data.
  5. Right to object – Object to processing under "public task" or "legitimate interest."
  6. Right to data portability – Request transfer of your data to another organisation.
  7. Right to withdraw consent – If consent is the legal basis, you can withdraw it anytime.

If you make a rights request, we will respond within one month.

Contact us to exercise your rights: [email protected]

10. How to complain

If you are unhappy with how we handle your data, you can make a complaint using the contact details above.

If you remain dissatisfied, you can escalate your complaint to the Information Commissioner’s Office (ICO):

Address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline: 0303 123 1113

Website: www.ico.org.uk/make-a-complaint

11. Changes to this privacy notice

We may update this privacy notice from time to time. The latest version will always be available on our website.