1. INTRODUCTION
1.1 Homebaked is a Community Land Trust, company number 08025135 registered with Companies House/ registered with the Financial Conduct Authority as a Community Interest Company, with our registered office at Castle Chambers, Castle St, Liverpool L2 9TL.
1.2 For the purpose of the General Data Protection Regulation 2016/279 (GDPR), Homebaked through its Directors is the Data Controller in respect of your Personal Data.
1.3 Homebaked is committed to ensuring that personal data is properly and securely managed in accordance with the relevant data protection laws. We believe this is an important part of achieving trust and confidence with everyone we work with. Please read this Privacy Notice to understand how we use and protect the information that you provide to us, or that we obtain or hold about you. Also, this Notice explains what your rights are in relation to information that we hold. This Notice applies to information about living identifiable individuals only.
2. WHAT PERSONAL DATA DO WE COLLECT?
2.1 We collect some Personal Data from you, for example when you first apply for a property, use our website, volunteer for us or contact us. We may collect and process the following categories of information about you:
– name and contact details
– gender, age, date of birth, nationality and socio-economic
– information about your education/work history and professional qualifications
– information about your family and any dependants or your lifestyle and social circumstances
– financial information including income, expenditure details, bank details, your national insurance number
– banking card details if you pay by card (however card details are not stored)
– it may also be necessary to collect additional information to ensure we can meet the specific needs of our tenants e.g. disabilities or vulnerabilities
– information obtained as a result of any background checks on volunteers
– we operate CCTV, which collects and records images, and is used in accordance with CCTV codes of practice
– we may hold Special Categories of Personal Data e.g. information about your religious beliefs, information about your health and wellbeing, information revealing racial or ethnic origins, information concerning your sexual orientation or in the case of background checks, information about criminal records or proceedings
– any other information which you choose to provide to us or that we are provided by others, for example, medical professionals, the police and other law enforcement bodies
3. WHY WE PROCESS YOUR PERSONAL DATA
3.1 The Personal Data which we hold about you, whether it is collected directly from you or whether we receive it from a third party, may be processed in a number of ways, for example:
– to enable us to manage our accommodation
– to enable us to administer community shares
– to communicate with you in relation to news about our activities and events taking place
– to fulfil contractual obligations e.g. to process payments to us
– to ensure we comply with our legal obligations (e.g. by providing information to the HMRC)
– in the case of CCTV recordings, to prevent or detect crime and to help create a safer environment for our tenants, volunteers and visitors
– we take photographs at our events, to publicise our activities and encourage future involvement or to report to funders
– to support community-based fundraising and campaigning
– to fulfil reporting requirements of funders
– to ensure we are representative and take action as appropriate if not
– to keep people safe, whether they are visitors, volunteers or people who attend our events
3.2 Any information gathered through cookies and similar technologies via our Homebaked website, is used to measure and analyse information on visits to the website, to tailor the website to make it better for visitors and to improve technical performance. We will not use the data to identify you personally or to make any decisions about you.
4. PROCESSING YOUR PERSONAL DATA
4.1 We must have a lawful basis for processing your information. This will vary according to the circumstances of how and why we have your information but typical examples include:
– the activities are within our legitimate interests in operating as a community and trust, in ways which might reasonably be expected, whilst ensuring that we balance your rights and freedoms with the needs of our business
– you have given your consent (which can be withdrawn at any time by contacting us using the details below) for us to process your information (e.g. to send you marketing or fundraising communications by email or SMS)
– we are carrying out necessary steps in relation to a contract to which you are party or prior to you entering into a contract (e.g. where you enter into a tenancy agreement with us)
– the processing is necessary for compliance with a legal obligation (e.g. where we pass on information to a local authority for safeguarding or other reasons);
– the processing is necessary for carrying out a task in the public interest
– to protect your vital interests (e.g. if you were unfortunate enough to fall ill or suffer an injury on our premises, then we may pass on information to the NHS for treatment purposes and to family members)
4.2 If we process any Special Categories of Personal Data, we must have a further lawful basis for the processing. This may include:
– where you have given us your explicit consent to do so (e.g. to cater for your medical or dietary needs at an event, or as part of your application for accommodation)
– where the processing is necessary to protect your vital interests or someone else’s vital interests (e.g. passing on information to the Police)
– where the processing is carried out in the course of our legitimate interests as a community land trust and the information is not shared outside of Homebaked, i.e. only with Trustees and volunteers as appropriate other than with your consent
– you have made the information public
– where the processing is necessary for the establishment, exercise or defence of legal claims
– where the processing is necessary for carrying out Homebaked’s employment and social security obligations
– the processing being necessary for reasons of substantial public interest (e.g. where steps are taken to prevent fraud or other dishonest activity);
The above processing is provided that the legal basis is proportionate to the aim pursued and provides for suitable and specific measures to safeguard your rights, or as part of our legitimate interests as a community land trust.
4.3 If we process any Personal Data comprising criminal convictions or offences, we must also have a further lawful basis for the processing. Usually this is where you have given your consent to the processing.
5. SHARING YOUR PERSONAL DATA
5.1 We use your Personal Data within Homebaked CLT, for the purposes for which it was obtained, unless you have explicitly agreed that we may share your Personal Data with another organisation or we are otherwise permitted or as set out in this Notice. Some examples of where your Personal Data will be shared, is where we are providing a service to you:
Homebaked Trustees and volunteers – Personal Data is restricted on a need to know basis (people are only given access to data that they need in order to perform their role).
Third parties – we do share Personal Data with some third parties/our partners but these will always be subject to General Data Protection Regulation (GDPR) compliant sharing agreements. Where we ask third parties to process your data on our behalf, we will be clear about how they should use your data and they will not be permitted to use it for any other purpose. Any third parties processing your data are obliged to be GDPR compliant and look after your Personal Data.
Contractors carrying out work for Homebaked e.g. we have a number of contractors who support us with the repair and maintenance of our property and consultants to support and advise on the development of the CLT.
Government departments and agencies Department for Work and Pensions (DWP), the HMRC for tax purposes or law enforcement agencies for the prevention and detection of crime and the Regulator of Social Housing and Homes England.
5.2 We have in place administrative, technical and physical measures designed to guard against and minimise the risk of loss, misuse or unauthorised processing or disclosure of the Personal Data that we hold.
5.3 In the course of processing your Personal Data, or disclosing it to the recipients referred to above, we may transfer it to countries which may not have laws which provide the same level of protection to your Personal Data as laws inside Europe. In such cases we will take steps to ensure that the transfers comply with the GDPR and that your Personal Data is appropriately protected.
5.4 We don’t give anyone access to your information in return for payment for their marketing or commercial purposes.
6. DATA RETENTION
6.1 We will only keep your Personal Data for as long as is necessary and we will delete it when it is no longer required. We will retain it according to our data retention periods, for example we retain a copy of your tenancy agreement for six years after your tenancy has ended.
7. YOUR DATA RIGHTS
7.1 You have rights in respect of the Personal Data you provide to us. In particular:
– the right to request a copy of some or all of the Personal Data that we hold about you
– if we process your Personal Data on the basis that we have your consent, the right to withdraw that consent
– the right to ask that any inaccuracies in your Personal Data are corrected
– the right to have us restrict the processing of all or part of your Personal Data
– the right to ask that we delete your Personal Data where there is no compelling reason for us to continue to process it
– the right to object to us processing your Personal Data for direct marketing purposes e.g. in relation to fundraising carried out by Homebaked
– the right not to be subject to legal or other significant decisions being taken about you on the basis of an automated process (i.e. without human intervention)
7.2 Please note that the above rights may be limited in some situations; for example, where we can demonstrate that we have a legal requirement to process your Personal Data. Also, we may need you to provide us with proof of identity for verification and data security purposes before you can exercise your rights.
8. Rights may only be exercised by the individual whose information is being held by Homebaked or with that individual’s express permission.
9. COOKIES
9.1 Cookies, also known as browsers or tracking cookies, are small text files that are added to your computer when you visit a website. They help websites to perform certain functions e.g. to know who you are if you log into a restricted part of a website, for shopping carts and for tracking purposes.
9.2 We use the following cookies:
– Google analytics. We use Google analytics cookies on the website for tracking purposes. The cookies allow us to understand general traffic to our website for example number of visitors and length of time on site. This process does collect data, but in an anonymous form, to help us make improvements, develop the website and enhance the user experience.
– Privacy preferences. We use a tracking cookie, which is added to your computer, to remember your cookie preferences if you have allowed them.
10. CHANGES TO THIS NOTICE
10.1 We may make changes to this Notice from time to time as our organisational practices and/or applicable laws change.
11. CONTACT DETAILS
11.1 If you have any questions, require further information about how we protect your Personal Data, if you wish to exercise any of the above rights or if you would like to provide feedback or make a complaint about the use of your information, please mail us at [email protected]
11.2 We hope that we can satisfy any queries you may have about the way in which we process your Personal Data. However, if you have unresolved concerns you also have the right to complain to the Information Commissioner (‘ICO’) (ICO.org.uk).