Privacy notice

Introduction

The C.H.E.E. S.E. Project CIC (company number 11204415) is a Bristol-based community interest company that has developed its thermal imaging survey service for homes and other buildings. This company is referred to in this privacy notice as “The CHEESE Project”.

This privacy notice sets out what personal data we may collect from you and how we will process that personal data. Personal data means any information about an individual that can be used directly or indirectly to identify that person.

It is possible that The CHEESE Project may wish to use your personal data for purposes that are not directly connected with The CHEESE Project’s surveying service. For example, The CHEESE Project may offer other services which involve helping people make energy-efficiency improvements to their homes. This should only apply to customers who have opted in to sharing this kind of data.

We should also make clear that our website may include links to third-party websites, plug- ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices. When you leave our website, we encourage you to read the privacy notice (also referred to commonly as privacy policies) of every website you visit.

Contact details for The CHEESE Project are as follows:

28, Seawalls Road
Bristol
BS9 1PG

info@cheeseproject.co.uk

What data do we collect?

We may collect the following data from you, some of which will be your personal data:

Survey organisation data. Prior to the survey, we will collect, either via our website or various follow-up communications with you, your name, street address, email address, landline, and mobile telephone numbers, the type of building you live in, the number of rooms in your home, whether you feel you or other people living there can heat it comfortably, the benefit you expect from the survey, your availability (for the purposes of scheduling a date for the survey), whether you believe you qualify for a free survey or (as the case may be) the amount you have paid for the survey, and any notes made by our survey co-ordinator to aid with organising the survey. After the survey, your contact details will be used to arrange the collection of one-month and one-year feedback.
Video and photos of the survey. During the survey, we will record video (with audio of the surveyor’s narration and any discussions) and take still pictures of areas of interest. There are different levels of opt-in at the time of booking as to whether we keep this material or not.
Survey results. Following the survey, details of the building are recorded: year of construction, occupation type, number of occupants, the primary and secondary heating types, the primary type of water heating, the primary type of cooking, depth of loft insulation, number of open fireplaces, the proportion of double glazing; details of the energy use of the home are recorded: annual use of gas, electricity and sold fuel energy types, and any renewable energy contribution; and details of the faults identified during the survey and any corresponding recommendations made. Notes are maintained with the results of a survey to record any details that might be useful to interpret the data. There are different levels of opt-in for use of this data on completion of the questionnaire.
One-month and one-year follow-up data. One month after the survey, we will ask you for information about any remedial work you are planning, any work you may already have already done (if any), and your satisfaction with the survey. One year after the survey, we will ask you for up-to-date annual energy consumption figures to compare with the previous ones, details of any remedial work you may have done (including contractors used, approximate spends on DIY vs. professional), details of work you may have planned and information about whether you or other people have noticed wellbeing or health improvement and about any changes in your behaviour. Notes are maintained to record any details that might be useful to interpret the data. There are different levels of opt-in for use of this data on completion of the questionnaire.

How do we process your data?

We will use the survey organisation data to set up and schedule the survey, to carry out the one-month and one-year follow-ups, and to deal with other aspects of managing and administering our relationship with you as a CHEESE Project service customer.

We may use the videos from the survey for the assessment of training surveyors as part of their Continuing Professional Development (CPD) qualification.

We may select still photos from the survey, where the customer has opted in, combined with details of the faults identified, to add to our record of common thermal faults and remedies (reason 1 for collecting data). We only choose photos that:

clearly display a building construction fault;
clearly display the effect of insulation or draught-proofing; or
show anything else of interest or out of the ordinary.

We do not use any photos that clearly identify a specific person or place, and where photos do contain features of a home, they are only recognisable by the householder or their friends or family. The collection of common faults and remedies will be made publicly available via our website. You may request an image taken during your survey be removed from the collection.

With permission, we use the survey results and one-month and one-year follow-up data to perform an analysis of the effectiveness of our methods (reason 2 for collecting data). We are looking for ways to show how we are achieving the aims of the project: to reduce domestic energy consumption and improve the health and well-being of the fuel-poor. New aggregated data may be created as a result of this processing, but it is no longer considered personal data since it cannot be used to identify an individual.

As noted in the “Introduction” section above, it is possible that The CHEESE Project may wish to use your personal data for purposes that are not connected with CHEESE Project service arrangements. Where this is the case, The CHEESE Project will notify you about the personal data they intend to process, and the way in which they intend to process it, for these other purposes.

How long do we retain your data?

The period for which we will retain different types of personal data will vary depending on what we are using it for. In all cases, we will only retain personal data for as long as it is necessary to fulfil the purposes we collected it for.

We retain personal survey organisation data for as long as is required to perform the one-year follow-ups and deal with any other aspects of managing and administering our relationship with you as a CHEESE Project customer.
Where a customer has opted-in to use of their survey videos, these are deleted two years after the end of that survey season.
The survey photos where the customer has opted-in for our use are kept indefinitely.
The survey results and follow-up data where the customer has opted-in are kept for as long as we believe we can usefully extract information from it, potentially in collaboration with third parties

What is our lawful basis for collecting and processing personal data?

Data protection laws require the collection and processing of personal data to have a lawful basis.

One lawful basis for the processing we will do of the survey organisation data is that this is required for the performance of a contract with you i.e. the contract between you and The CHEESE Project for delivery of the survey.

A further lawful basis for all of the processing activities described in this privacy notice is that they are necessary for our “legitimate interests” (including carrying out our business activities as part of The CHEESE Project arrangements and meeting our wider goals of reducing fuel poverty and tackling climate change).

Who do we share your data with?

As noted in the “Introduction” section above, your personal data may be transferred between The CHEESE Project and our surveyors and team members. Personal data which needs to be used for the purposes of organising your survey will also be passed to the individual surveyors who are engaged to carry out the survey.

We will only share the data we collect with third parties, such as a university or other community organisation, when they are collaborating with us to perform an analysis. We will make efforts to anonymise the data by removing names and direct contact details. We will always make the results of any such third-party collaboration and processing of our data freely available.

We may store our data on cloud storage services like Dropbox, Google Drive, or Amazon Webservices, but we will do so only when the service complies with data protection laws. Furthermore, these services are only accessible by password-based authentication and are not available to the general public.

How do we keep your data safe?

We have put in place appropriate measures to ensure the security of the personal data we hold and prevent it from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. These measures include limiting access to only our staff via password-based authentication, keeping the web server that stores our data operational with basic security measures and up-to-date with the latest security patches, and making sure that access to the website is secured with SSL (an encrypted connection) so that any personal data is encrypted and cannot be intercepted by a third party. We review our security policy regularly to ensure it remains effective and to highlight areas for improvement.

What rights do I have over my data?

Data protection laws provide rights to individuals over their personal data. Upon request, you can:

Access your data. We can provide a copy of all of the data we hold on you in a portable data format such as in text format, Microsoft Excel, or CSV spreadsheet file.
Correct your data. It is important that the personal data we hold on you is accurate. If you believe any is incorrect, then please inform us so that we can correct it.
Delete your data. You have the right for any or all of the personal data that we hold on you to be deleted.

In some circumstances you can:

Restrict the processing of your data. This applies when the accuracy of the data is contested, the data has been unlawfully processed, the data is no longer useful for us but you require us to keep it in order to exercise or defend a legal claim, or you believe your privacy interests override our legitimate interests.
Object to the processing of your data. This applies when you believe your privacy interests override our legitimate interests.

In these two cases, where we have no grounds to refuse we will stop processing your data. This may involve deleting your data permanently.

If you wish to exercise any of your legal rights, we recommend that you contact The CHEESE Project by email at info@cheeseproject.co.uk with the details of your request. We may need to ask for specific information from you in order to confirm your identity.