Privacy notice

The CHEESE Project CIC is a Bristol-based not-for-profit community enterprise that aims to reduce domestic energy losses at low cost by providing thermal imaging surveys, to tackle the problems of climate change and fuel poverty. Read more about the aims and achievements of the project here.

Collection and analysis of data, some of which is personal, is an important aspect of the CHEESE Project. We strive to limit the privacy impact of our data collection and processing, doing only what is necessary for the aims of the project, and doing so transparently.

This privacy notice sets out, in line with the General Data Protection Regulation (GPDR), what data we collect, why is necessary for us to collect it, how we manage it and how the law protects your privacy rights. If you have any questions or comments about this privacy notice, including any requests to exercise your legal rights, then please get in touch via

Please note we have a separate privacy notice for staff and members, which can be accessed here.

Why do we collect and process personal data?

Personal data means any information about an individual that can be used directly or indirectly to identify that person. We collect personal data as part of the the findings of our surveys and feedback from householders for two reasons:

  1. To collect information on common thermal faults and their remedies in domestic buildings, so we can compile and maintain a publicly-accessible reference, thereby expanding the impact of the CHEESE Project nationally, or even internationally.

  2. To validate, using quantitative and qualitative data from householders, whether our approach is effective in achieving our aims, since the project is unique, experimental and in continual development. This is essential to underpin our findings in the above point and in scaling up the project within Bristol and eventually replicating it elsewhere in the country.

What personal data do we collect?

We collect the following personal data, as part of our data collection activities within the project:

How do we process your data?

We use the survey organisation data to setup and schedule the survey, to organise the collection of the CHEESE box and collection of the one month and one year follow ups.

We use the videos from the survey for assessment of trainee Energy Tracers as part of their Continuing Professional Development (CPD) qualification.

With your permission, we select still photos from the survey, combined with details of the faults identified, to add to our record of common thermal faults and remedies (reason 1 for collecting data). We only choose photos that:

We do not use any photos that clearly identify a specific person or place, and where photos do contain features of a home, they are only recognisable by the householder or their friends or family. The collection of common faults and remedies will be made publically available via our website. You may request an image taken during your survey be removed from the collection; please see the section on your rights for details on how to do this.

Lastly, we use the survey results and one-month and one-year follow up data to perform an analysis of the effectiveness of our methods (reason 2 for collecting data). We are looking for ways to show how we are achieving the aims of the project: to reduce domestic energy consumption and improve the health and wellbeing of the fuel poor. New aggregated data will be created as a result of this processing, but it is no longer considered personal since it cannot be used to identify an individual.

How long do we retain your data?

The period for which we retain different types of personal data varies depending on what we are using it for. In all cases, we only retain personal data for as long as it is necessary to fulfil the purposes we collected it for.

What is our lawful basis for collecting and processing personal data?

The GDPR requires the collection and processing of personal data to have a lawful basis. The most appropriate basis for the operation of the CHEESE Project is legitimate interest on the basis of achieving the above goals, since they both have clear benefits to wider society and we cannot reasonably achieve the result in a less intrusive way. We have documented the details of this justification in our legitimate interest assessment.

Who do we share your data with?

We will only share the data we collect with third parties, such as a university or other community organisation, when they are collaborating with us to perform an analysis. We will make efforts to anonymise the data by removing names and direct contact details. We will always make the results of any such third-party collaboration and processing of our data freely available.

We may store our data on cloud storage services like Dropbox, Google Drive, or Amazon Webservices, but we will do so only when the service complies with the GDPR. Furthermore, these services are only accessible only by password-based authentication and are not available to the general public.

How do we keep your data safe?

We take necessary measures to ensure the security of the personal data we hold from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include limiting access to only staff of the CHEESE Project via password-based authentication, we keep the webserver that stores our data operational with basic security measures and up-to-date with the latest security patches, and access to the website is secured with SSL (an encrypted connection) so that any personal data is encrypted and cannot be intercepted by a third party. We review our security policy regularly to ensure it remains effective and to highlight areas for improvement.

What rights do I have over my data?

The GDPR provides rights to individuals over their personal data. Upon request, you can:

In some circumstances you can:

In these two cases, where we have no grounds to refuse we will stop processing your data. This may involve deleting your data permanently.

If you wish to exercise any of your legal rights, then please email with the details of your request. We may need to ask for specific information from you in order to confirm your identity.