Privacy notice

The CHEESE Project CIC is a Bristol-based not-for-profit community enterprise that aims to reduce domestic energy losses at low cost by providing thermal imaging surveys, to tackle the problems of climate change and fuel poverty. Read more about the aims and achievements of the project here.

Collection and analysis of data, some of which is personal, is an important aspect of the CHEESE Project. We strive to limit the privacy impact of our data collection and processing, doing only what is necessary for the aims of the project, and doing so transparently.

This privacy notice sets out, in line with the General Data Protection Regulation (GPDR), what data we collect, why is necessary for us to collect it, how we manage it and how the law protects your privacy rights. If you have any questions or comments about this privacy notice, including any requests to exercise your legal rights, then please get in touch via info@cheeseproject.co.uk.

Please note we have a separate privacy notice for staff and members, which can be accessed Privacy notice for staff and members

Why do we collect and process personal data?

Personal data means any information about an individual that can be used directly or indirectly to identify that person. We collect personal data as part of the the findings of our surveys and feedback from householders for two reasons:

To collect information on common thermal faults and their remedies in domestic buildings, so we can compile and maintain a publicly-accessible reference, thereby expanding the impact of the CHEESE Project nationally, or even internationally.
To validate, using quantitative and qualitative data from householders, whether our approach is effective in achieving our aims, since the project is unique, experimental and in continual development. This is essential to underpin our findings in the above point and in scaling up the project within Bristol and eventually replicating it elsewhere in the country.

What personal data do we collect?

We collect the following personal data, as part of our data collection activities within the project:

Survey organisation. Prior to the survey, we record the householder’s name, street address, email address, landline and mobile telephone numbers, the type of building they live in, the number of rooms in their home, whether they feel they can heat it comfortably, the benefit they expect from the survey, their availability (for the purposes of scheduling a date), whether they believe they qualify for a free survey, the fee paid, and any notes made by the coordinator to aid with organising the survey. After the survey, the contact details of the householder are possibly used to arrange collection of one-month and one-year feedback.
Video and photos of the survey. During the survey we record video (with audio of the surveyor’s narration and any discussions) and take still pictures of areas of interest.
Survey results. Following the survey, details of the building are recorded: year of construction, occupation type, number of occupants, the primary and secondary heating types, the primary type of water heating, the primary type of cooking, depth of loft insulation, number of open fireplaces, proportion of double glazing; details of the energy use of the home are recorded: annual use of gas, electricity and sold fuel energy types, and any renewable energy contribution; and details of the faults identified during the survey and any corresponding recommendations made. Notes are maintained with the results of a survey to record any details that might be useful to interpret the data.
One-month and one-year follow ups. One month after the survey, we collect from householder what remedial work they are planning, what work they have already done (if any) and their satisfaction with the survey. One year after the survey, we collect up-to-date annual energy consumption figures to compare with the previous ones, details of any remedial work they have done (including contractors used, approximate spends on DIY vs. professional), details of work they have planned, if they have noticed a wellbeing or health improvement and any changes in their behaviour. Notes are maintained to record any details that might be useful to interpret the data.

How do we process your data?

We use the survey organisation data to setup and schedule the survey, to organise the collection of the CHEESE box and collection of the one month and one year follow ups.

We use the videos from the survey for assessment of trainee surveyors as part of their Continuing Professional Development (CPD) qualification. Heatview Surveyors

With your permission, we select still photos from the survey, combined with details of the faults identified, to add to our record of common thermal faults and remedies (reason 1 for collecting data). We only choose photos that:

clearly display a building construction fault;
clearly display the effect of insulation or draught proofing; or
show anything else of interest or out of the ordinary.

We do not use any photos that clearly identify a specific person or place, and where photos do contain features of a home, they are only recognisable by the householder or their friends or family. The collection of common faults and remedies will be made publically available via our website. You may request an image taken during your survey be removed from the collection; please see the section on Privacy notice for details on how to do this.

Lastly, we use the survey results and one-month and one-year follow up data to perform an analysis of the effectiveness of our methods (reason 2 for collecting data). We are looking for ways to show how we are achieving the aims of the project: to reduce domestic energy consumption and improve the health and wellbeing of the fuel poor. New aggregated data will be created as a result of this processing, but it is no longer considered personal since it cannot be used to identify an individual.

How long do we retain your data?

The period for which we retain different types of personal data varies depending on what we are using it for. In all cases, we only retain personal data for as long as it is necessary to fulfil the purposes we collected it for.

We retain personal survey organisation data for as long as is required to perform the one-year follow ups.
The survey videos are deleted once we have used them for CPD assessment.
The survey photos that we select for publication are kept indefinitely.
The survey results and follow up data is kept for as long as we believe we can usefully extract information from it, potentially in collaboration with third parties.

What is our lawful basis for collecting and processing personal data?

The GDPR requires the collection and processing of personal data to have a lawful basis. The most appropriate basis for the operation of the CHEESE Project is legitimate interest on the basis of achieving the above goals, since they both have clear benefits to wider society and we cannot reasonably achieve the result in a less intrusive way. We have documented the details of this justification in our legitimate interest assessment.

Who do we share your data with?

We will only share the data we collect with third parties, such as a university or other community organisation, when they are collaborating with us to perform an analysis. We will make efforts to anonymise the data by removing names and direct contact details. We will always make the results of any such third-party collaboration and processing of our data freely available.

We may store our data on cloud storage services like Dropbox, Google Drive, or Amazon Webservices, but we will do so only when the service complies with the GDPR. Furthermore, these services are only accessible only by password-based authentication and are not available to the general public.

How do we keep your data safe?

We take necessary measures to ensure the security of the personal data we hold from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include limiting access to only staff of the CHEESE Project via password-based authentication, we keep the webserver that stores our data operational with basic security measures and up-to-date with the latest security patches, and access to the website is secured with SSL (an encrypted connection) so that any personal data is encrypted and cannot be intercepted by a third party. We review our security policy regularly to ensure it remains effective and to highlight areas for improvement.

What rights do I have over my data?

The GDPR provides rights to individuals over their personal data. Upon request, you can:

Access your data. We can provide a copy of all of the data we hold on you in a portable data format such as in text format, Microsoft Excel or CSV spreadsheet file.
Correct your data. It is important that the personal data we hold on you is accurate. If you believe any is incorrect, then please inform us so that we can correct it.
Delete your data. You have the right for any or all of your personal data that we hold on you to be deleted.

In some circumstances you can:

Restrict the processing of your data. This applies when the accuracy of the data is contested, the data has been unlawfully processed, the data is no longer useful for CHEESE but you require us to keep it in order to exercise or defend a legal claim, or you believe your privacy interests override our legitimate interests.
Object to the processing of your data. This applies when you believe your privacy interests override our legitimate interests.

In these two cases, where we have no grounds to refuse we will stop processing your data. This may involve deleting your data permanently.

If you wish to exercise any of your legal rights, then please email info@cheeseproject.co.uk with the details of your request. We may need to ask for specific information from you in order to confirm your identity.