GovTech Catalyst (Phase 2) privacy notice

GovTech Catalyst is a national, government-funded project. The aim of the project is to investigate new methods to improve housing maintenance through the use of innovative technology, leading to better housing and improved health and wellbeing of its tenants.

The data controller for this project

Leeds City Council is the data controller for all personal data you provide to us as part of the project. Leeds City Council appointed HomeLINK Limited (‘Homelink’) and Aware Technologies Ltd (‘AwareTag’) who will work in collaboration with Leeds City Council (‘the council’) to deliver the project and will act as data processors.

Homelink has also appointed sub-contractors, University of Leeds and University of York, to analyse the data collected on behalf of Homelink.

The data we will collect

The project will collect the following information about you and the property you live in as follows:

• name(s) / address of the residents of the tenants
• number of people in the household
• number of people under 16
• type of property
• property specification (including any adaptations)
• energy product used
• repairs data

The project will collect the following data from small sensors in your home:

• temperature
• humidity
• CO2
• fire alarm events
• carbon monoxide events
• electricity usage
• water leak events
• door and window status events

You will also be contacted from time to time, by contractors and their researchers, to seek your feedback, and invite you to participate in online surveys and personal interviews. You will be issued with a separate Privacy Notice to explain the process and the options available to you.

Why we process your data

We will use the data collected from sensors to provide an accurate and insightful overview of a property’s health and condition, to facilitate early identification and proactive resolution of issues that impact upon a tenant's health, safety and wellbeing.

Data provided by you in surveys and personal interviews will be used to prepare final report to include the results of the study. It will be shared with the council and their partners. The report will not contain any personal data about you or your individual responses which you provided during the project.

All the data collected during the project will be treated in strict confidence and in accordance with the requirements of the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR). The data provided by you will not be used for any purpose, other than this project.

Legal basis for processing

We will process your data based on your consent in accordance with UK GDPR Article 6(1)(a). The processing shall be lawful only if and to the extent that the following applies:

• the data subject has given consent to the processing of their personal data for one or more specific purposes

Withdrawing your consent

You have the right to withdraw your consent from participating in the project at any time. Withdrawing your consent will not affect any services or benefits you receive as a tenant of the council.

We will remotely disconnect the sensors installed in your property, so that we no longer receive any data from those sensors. If you decide that you no longer wish to participate in the project please contact us.

Data retention, storage and destruction

Our data retention policies and procedures are designed to help ensure that we comply with our legal obligations in relation to the retention, storage and deletion of personal data.

Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

We will retain your personal data as follows:

• the information collected from the sensors will be stored securely on the contractors’ Virtual Private Networks hosted by the Amazon Web Services (AWS) for a period of 12 months until December 2021 and then securely destroyed within 1 month of completion of the project
• the information collected during surveys and personal interviews, will be retained in accordance with Retention policies of the organisations conducting these surveys
• when we receive a request to delete your personal data, we will remotely disconnect the sensors so we no longer receive any data. Any other personal data obtained in the course of the project, will be deleted within 7 days. Your data stored on AWS will be fully deleted within 6 weeks due to the way the data is stored. Whilst we will delete all your personal data, we may not be able to remove all of that data retrospectively that has already been used within analysis and reports.

If you get in touch to opt-out of the project, we will treat this as withdrawal of your consent and will make arrangements to delete your personal data.

Who we can share your data with

The council will not share your personal data with any other party except with its contractors Homelink and AwareTag to fulfil their requirements of the project.

The contractors will share your data with their sub-contractors (University of York and University of Leeds), in order to analyse the data generated during the project and provide a report on these findings to the council, where you agreed to participate in the research.

In addition, we will share your personal data:

• where such disclosure is necessary for compliance with a legal obligation to which we are subject
• in order to protect your vital interests or the vital interests of another natural person
• for the purposes of security and prevention of fraud and other criminal activity
• where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure

Automated decision making

Your data will not be used for any automated decision making, including profiling.

Your rights

Your principal rights under data protection law are:

• the right to access - you can ask for copies of your personal data
• the right to rectification - you can ask us to rectify inaccurate personal data and to complete incomplete personal data
• the right to erasure - you can ask us to erase your personal data
• the right to restrict processing - you can ask us to restrict the processing of your personal data
• the right to object to processing - you can object to the processing of your personal data
• the right to data portability - you can ask that we transfer your personal data to another organisation or to you
• the right to complain to a supervisory authority - you can complain about our processing of your personal data
• the right to withdraw consent - to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent

These rights are subject to certain limitations and exceptions. You can learn more about the rights of data subjects through the Information Commissioner's Office external link.

You may exercise any of your rights in relation to your personal data by written notice to us, using the contact details set out below.

When your data gets sent to other countries

The information you provide will not be transferred to another country outside of the EU.

Contact us

Any queries in relation to this project should be forwarded to:

Leeds City Council

Homelink

AwareTag

Data Protection Officer

Our privacy notice is available to view.

Changes to this notice

We keep our privacy notice under regular review. We will notify you of significant changes to this notice by email or other means as appropriate. This privacy notice was last updated 10 February 2021.