Privacy notice

This privacy notice tells you what to expect when we process personal information. It applies to information about applicants and customers. Beyond Housing is the data controller of all personal information you provide.

Why do we collect and store personal information?

We need to collect, process and store personal information about you and other household members* in order to fulfil our obligations and to deliver an efficient and effective service. Our legal basis for processing your information will be at least one of the following:

  • Contractual: The processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
  • Legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations)
  • Vital interests: The processing is necessary to protect someone’s life
  • Legitimate interests: The processing is necessary for our legitimate interests, or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests
  • Consent: You have given clear consent for us to process your personal data for a specific purpose.

*When you provide information about household members, it is your responsibility to ensure you do so with their full knowledge and consent.

What information do we collect about you?

The information we collect about you may vary based on what service we provide to you and the relationship we have with you. Typically, we need details like:

  • Your name, date of birth and information about your previous housing circumstances
  • Your contact details so we can communicate with throughout the buying process
  • Information about your needs and requirements to ensure our services are accessible, that we take account of any support needs in our dealings with you and to improve our communications with you.

This list is not exhaustive, as we hold records of most of the contact we have with you, or about you, and we process this information so we can deliver services to you.

We prefer to collect the information we need directly from you. That way, you know what we have and we can be sure you’ve provided us with the most accurate and up to date information.

Generally the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you). We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases, you can refuse to provide your details if you deem a request to be inappropriate. However, you should note this may impact our ability to provide some services to you if you refuse to provide information that stops us from doing so.

Processing of your personal information will be undertaken in accordance with the principles of the UK Data Protection Act 2018 (the Act) and the UK General Data Protection Regulation (the Regulation).

Access to personal information is restricted to authorised individuals on a strictly need to know basis. We will treat your personal information fairly and lawfully and we will ensure that information is:

  • Processed for limited purposes
  • Kept up-to-date, accurate, relevant and not excessive
  • Not kept longer than is necessary
  • Kept secure.

We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate. To help us to ensure confidentiality of your personal information, we may ask you security questions to confirm your identity when you call us and as may be necessary when we call you.

We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so. Anyone calling on your behalf may also be subject to security questions to ensure we’re taking adequate steps to protect your personal information.

We make every effort to keep your information safe by taking appropriate care to secure the information we hold about you.

  • We have robust technical security such as passwords and information encryption
  • We have policies and procedures to make sure your information is only available to our colleagues who need to see it to do their job, and we train those employees appropriately
  • Where we engage with third parties to process personal data on our behalf, they do so on the basis of data sharing agreements, data processing agreements or other written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

In everything we do with your information we try to be fair, lawful and open, and we take seriously our obligations towards your privacy and the protection of information we may hold about you.

  • Take all reasonable efforts to do so fairly
  • Never use information about you unless it is lawful for us to do so and we have a clearly defined need or purpose
  • Make sure we minimise what we collect
  • Try to collect enough accurate and up-to-date information so we can provide you with the excellent, efficient customer service you demand and no more
  • Not keep your information for longer than we need it and make sure the records we have about you are managed properly and deleted promptly and securely when we no longer need them.

We appreciate you have provided your information to us and may not want us to share it with other people or organisations, however sometimes it is necessary for us to do so. Our relationships with such providers are governed by our contracts with them which include strict data sharing and confidentiality protocols.

We only share your information where we have a legitimate interest in doing so, where we are permitted or required to by law, or where you have requested us to do so. We may share your information with, for example:

  • Our contractors, in order to undertake snagging work on our behalf
  • Third party service providers, in connection with services performed on our behalf
  • Third parties who administer agreements on our behalf (for example shared equity loans if you have entered into such an agreement with us)
  • Suppliers who provide or make provisions to provide services to, or in relation to your property
  • Managing agents appointed in accordance with the terms of your home purchase agreement
  • National House Building Council (NHBC) in order to support the administration of your Buildmark policy where applicable
  • Other third parties with your consent and where you request we introduce you to them, for example mortgage brokers and bodies
  • Utility companies and local authorities
  • Our professional advisors
  • Credit reference agencies
  • Local authorities and government departments, as necessary for administering justice, or for exercising statutory, governmental, or other public functions.

This list is not exhaustive as there are other circumstances where we may also be required to share information, for example:

  • To meet our legal obligations
  • In connection with legal proceedings (or where we are instructed to do so by court order)
  • To protect the vital interests of an individual (in a life or death situation).

We will only transfer or store your personal information outside of the UK where the country we send the information to is approved by the Information Commissioner’s Office as providing an adequate level of protection for personal information; or the recipient has agreed with us standard contractual clauses approved by the Information Commissioner’s Office, obliging the recipient to safeguard the personal information; or another situation exists where the transfer is permitted under applicable data protection legislation.

Right of access

You have the right of access to information we hold about or concerning you. If you would like to exercise this right, please contact us. If you are seeking to obtain specific information (e.g. about a particular matter or from a particular time period), it helps if you clarify the details of what you would like to receive in your written request.

If someone is requesting information on your behalf they will need written confirmation from you to evidence your consent for us to release this and proof of ID (both yours and theirs). We have one month to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible).

In response to subject access requests, we will provide you with a copy of the information we hold that relates to you. This will not generally include information about your property as this is unlikely to be ‘personal information’.

Right of rectification or erasure

If you feel any data that we hold about you is inaccurate you have the right to ask us to correct or rectify it. You also have a right to ask us to erase information about you where you can demonstrate that the data we hold is no longer needed by us, or if you withdraw the consent upon which our processing is based, or if you feel that we are unlawfully processing your data.

Your right of rectification and erasure extends to anyone we have disclosed your personal information to and we will take all reasonable steps to inform those with whom we have shared your data about your request for erasure.

Right to restriction of processing

You have a right to request that we refrain from processing your data where you contest its accuracy, or the processing is unlawful and you have requested its erasure, or where we don’t need to hold your data anymore but you need us to in order to establish, exercise or defend any legal claims, or we are in dispute about the legality of our processing your personal data.

Right to portability

You have a right to receive any personal data that you have provided to us in order to transfer it onto another data controller where the processing is based on consent and is carried out by automated means called a data portability request.

Right to object

You have a right to object to our processing of your personal data where the basis of the processing is our legitimate interests including but not limited to direct marketing and profiling.

For further information on how to request your personal information and how and why we process your information, you can contact us using the details below:

Data Protection Officer
Beyond Housing
Brook House
4 Gladstone Road
YO12 7BH
0345 060 5555 |

The Information Commissioner (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, and one of their primary functions is to administer the provisions of the UK Data Protection Act 2018 and the UK General Data Protection Regulation. You also have a right to lodge a complaint about any aspect of how we are handling your data with the ICO and can do so at the following address:


Information Commissioner’s Office
Wycliffe House
Water Lane
0303 123 1113 |

We may change this privacy notice from time to time, but if we change it in a way which significantly alters the terms upon which you have agreed, we will post notice of the change on our website and you will be deemed to have accepted such changes. This privacy notice was last updated October 2021.