Privacy Policy

1.1. Maintaining the security of your data is a priority of Story Homes, and we are committed to respecting your privacy rights. We will handle your data fairly and legally at all times. We are also dedicated to being transparent about what data we collect from you and how we may use such data. We will only use your personal information in accordance with this privacy policy (Policy).

1.2. This Policy is for customers of Story Homes Limited (referred to as Story Homes, we, us or our) and aims to explain the types of personal data Story Homes may collect about you when you interact with us whether you visit our developments, offices, use your mobile device or go online. It also explains how and why we will process, share and keep your data.

1.3. By visiting this website or becoming a customer of Story Homes you’re agreeing to be bound by this Policy. You should read this Policy carefully so that you understand how we will handle your personal information.

2.1. During the course of our activities we, Story Homes Limited (a company registered in England and Wales under registered number 02275441) of Story House, Lords Way, Kingmoor Business Park, Carlisle, CA6 4SL, will process personal information (which may be held on paper, electronically, or otherwise) about you, and we recognise the need to treat it in an appropriate and lawful manner, in accordance with the UK’s General Data Protection Regulation (UK GDPR) and other UK data protection laws. The purpose of this Policy is to explain to you how we will handle your personal information and to provide you with necessary information about your rights and obligations.

2.2. If you have any questions regarding this Policy or how we process your personal data you can contact our Data Privacy Manager via email at dataprotection@storyhomes.co.uk or by telephone on 01228 404550.

2.3. Story Homes is registered on the Information Commissioner’s Office under registration number ZA156557.

2.4. This Policy is provided in a layered format so you can click through to the specific areas you’re interested in set out below. Alternatively, you can download a pdf version of the Policy here.

3.1. Personal data means any information about an individual from which that person can be identified. It does not include data which has been anonymised.

3.2. We will collect personal data from you when you call us, visit our website or interact with our social media platforms make enquiries, visit any of our offices or developments, or enter into any transaction with us including:

3.2.1. where you reserve a property to purchase from us;

3.2.2. where you discuss purchasing options and extras from us; and

3.2.3. during the course of purchasing a property from us and/or selling a property to us in part exchange;

or otherwise provide us with your personal data.

3.3. The categories of personal information we may collect for the purpose of managing your engagement with us as a customer include:

3.3.1. Contact Data: Your name and title, address, telephone number(s), personal e-mail address and any other contact details you may provide. If you are a corporate customer (such as a housing association) this could include the organisation you work for and details of your job title;

3.3.2. Identification Data: Any information we gather from you to help us identify who you are including passport, driving licence, bank account details, utility bills or other identification data we gather about you. This also includes your internet protocol (IP) address insofar as it is used to identify you;

3.3.3. Profile Data: purchases or orders made by you, your interests, preferences, feedback and survey responses;

3.3.4. Website Data: includes information about how you use our website, products and services, including how you navigate to, through and from our site (including date and time), and any products you viewed or searched for

3.3.5. Video Surveillance Data: We use CCTV on our sites for the safety and prevention of any crimes committed against our staff, customers, visitors equipment, and properties;

3.3.6. Marketing Preferences Data: We may collect information about your marketing preferences if we are entitled to send you marketing materials and your communication preferences (including social media messaging platforms);

3.3.7. Financial Data: includes mortgage, bank account and payment card details; and

3.3.8. Attendance Data: information related to your attendance at a Story Homes site, development or elsewhere for meetings or other events. This may include information about incidents which occur while you are attending our sites.

3.3.9. Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.

3.4. We also collect, use and share aggregated data such as statistical or demographic data for various purposes. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Website Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Policy.

4.1. We will collect your personal information in the following ways:

4.1.1. Information you (or a joint purchaser and/or owner) give us. This is information (including Contact Data, and Identification Data) you/they provide to us when:
you/they contact us in person, over the telephone, by email, by post or on our website; through the show home feedback and recommend a friend cards we ask you to complete; you/they reserve a property to purchase from us; you/they purchase options and extras from us; and during the course of purchasing a property from us and/or selling a property to us in part exchange. We will also get some of this information by you corresponding with us (for example, by email or text or using social media messaging services or where you tag us on social media).

4.1.2. Information acquired through automated technologies or interactions. As you interact with our website, we will automatically collect personal data about you that distinguishes you from other users by using cookies. We may also receive information about you if you visit other websites employing our cookies. Please see our Cookie Policy on our website for more details.

4.1.3. Information acquired through third parties. We may collect personal information about you from financial and legal advisors, and estate agents; We may get information about you from other individuals at the development where you have bought a home and from any workers or contractors who interact with you about any home or other products or services you have bought from us. Social media platforms provide us with data where you have allowed them to do so. We may also get data from analytics providers based outside the UK such as Google Ireland.

4.1.4. Information we observe. We will gather personal information about you through the monitoring of our systems including use of telephones, emails, our social media sites and the internet (including our website), and through the use of CCTV.

4.1.5. Information we create. We will create information about you where we create an account for you and where we keep records of our or our suppliers’ interactions with you including payments you make. We also create information about you where we create a customer profile about you so that we can better understand our customers’ behaviour, activities, preferences and needs, create and improve our products and services and send you marketing and advertising messages which match your profile.

4.2. We only collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data) where necessary to comply with any statutory duties we have.

5.1. We process your personal information for a variety of purposes indicated below.

5.2. In the table below, where we outline the lawful basis (processing condition) which we rely on to use your personal information, a number of bases are mentioned for processing personal information. All data needs one of the “General” processing conditions. However, where we are processing special category data we also need one of the legal bases set out in the special category processing conditions. The key to the lawful bases is set out below the table.

5.3. The purposes for which we process your personal information and the lawful bases for such processing are as follows:

6.1.1. Consent: we use this basis for processing where we have your consent to one or more specific purposes. We will set out the basis for consent in a consent notice or in some other form of notice where it is clear we are asking for your consent. Where we do not get your consent, we will not use your data for that purpose.

6.1.2. Contract: We use this basis for processing where it is necessary to process your data for the performance of a contract to which you are a party (for example the purchase of a house from us) or to meet our obligations under a contract between us.

6.1.3. Legal obligation: We use this basis where we are required by law to process this data.

6.1.4. Legitimate interests: We use legitimate interests as the basis for processing where we’ve identified the processing in those circumstances is a legitimate interest of ours or a third party. Where we consider that it is a legitimate interest, we have considered if the use of your personal information is necessary to achieve those legitimate interests and we’ve balanced all that against your interests, rights and freedoms. We only use legitimate interests where that balancing test demonstrates that the legitimate interest we’ve identified overrides your interests, rights and freedoms. We set out more detail on our legitimate interest processing below at section 5.5.

7.1.1. We sometimes process personal information on the basis that it is in our legitimate interests to do so. The occasions where we will rely on legitimate interests as our processing condition are set out above. The legitimate interests are as follows:

7.1.1.1. Customer correspondence and engagement: to keep and maintain various information about you which will allow us to respond to your queries, complaints and correspondence and improve our service for you and others;

7.1.1.2. Managing our contractual relationship with you: to keep various information about you which is in addition to that which we need to fulfil our contractual obligations to you;

7.1.1.3. Verifying identities: knowing who is at our sites, whose vehicles are on site and where they are parked. This enables us to maintain security and health and safety on site;

7.1.1.4. Investigations: to use personal information where necessary to investigate claims and to keep our business and customers secure including by protecting them against criminal or anti-social behaviour. This may involve sharing personal data with law enforcement agencies and our insurers. This will include monitoring you using CCTV;

7.1.1.5. .Marketing purposes: unless we have already sought or obtained consent from you to send you marketing messages, we rely on legitimate interests to keep various information about you which will allow us to market our properties and developments to you in order to make new sales;

7.1.1.6. Data Analytics: to analyse the data we hold about you to improve our products and services and to enable us to deliver content to you which takes account of your likes and dislikes;

7.1.1.7. Management of our IT systems: to ensure the effective running of our business and website, including troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting of data, provision of administration and IT services, measurement of the effectiveness of our website;

7.1.1.8. Network Security: we will monitor our network and your use of it. It is a legitimate interest of ours to make sure that your use of our network and systems does not compromise our information security;

7.1.1.9. Meeting Customers’ Needs and Requirements: we sometimes gather data about you which is useful for building a complete view of your use of our website and products. This includes understanding our customer’s behaviour, activities, preferences and needs. This helps to ensure the effective running of our business through the development, improvement and provision of products and services which meet our customer needs and expectations;

7.1.1.10. Insurance and claims: it is in our legitimate interests to use your personal information where necessary in the purchase of insurance policies and to respond to and defend legal claims.

7.2. Special Category Data
Occasionally we process special category data. We will only do so where we have a lawful basis to do so. For example, we may process special category personal data if you bring a legal claim against us which related to your health and safety or relating to your characteristics. We are allowed to use your special category data where it is necessary for the establishment, exercise or defence of legal claims.

7.3. Ensuring your personal information is accurate
We will keep the personal information we store about you accurate and up to date. We will take every reasonable step to erase or rectify inaccurate data without delay. Please tell us if your personal details change or if you become aware of any inaccuracies in the personal information we hold about you. We will contact you annually to check your details are still up-to-date. We will also contact you if we become aware of any event which is likely to result in a change to your personal information.

7.4. Retaining your personal information
We will not keep your personal information for longer than is necessary for the purpose(s) for which we process it. This means that information will be destroyed or erased from our systems when it is no longer required. For guidance on how long certain information is likely to be kept before being destroyed, contact the Data Privacy Manager on 01228 404550 or by email at dataprotection@storyhomes.co.uk. For further information on the retention of your personal information, please contact the Data Privacy Manager.

8.1. You have the right to:

8.1.1. Request access to any personal information we hold about you:

8.1.1.1. You have a right to access a copy of your own personal information. We try to respond to all requests within one (1) calendar month. Occasionally, it may take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you and keep you updated on the progress of your request.

8.1.1.2. We will request information from you in order to help us confirm your identity and ensure you have a right to access the personal information you have requested to see. This is a security measure to ensure that we do not disclose personal information to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request.

8.1.1.3. You will normally not have to pay a fee to access your personal information. However, we may charge a reasonable fee if your request is clearly unfounded or excessive (particularly where requests are repetitive). Alternatively, if your request is clearly unfounded or excessive, we may refuse to comply with your request.

8.1.2. Require us to rectify any personal information which we hold about you which is inaccurate.

8.1.2.1. Rectification enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

8.1.3. Have personal information erased, in certain circumstances.

8.1.3.1. This right enables you to have your data erased (the so-called “right to be forgotten”). The right relates only to personal information we hold at the time you make the request. There are also some important restrictions on this right.

8.1.3.2. The right to have personal information erased applies where:

8.1.3.2.1. our use of your personal information is no longer necessary for the purpose for which we gathered it. Most of the personal information we hold about you in the course of your engagement with us and we need it to manage you as a customer or supplier, site visitor, website user or social media user. However, we will review the information we hold about you if you ask us to erase it, to check we need all of the information we hold;

8.1.3.2.2. we have relied on consent as the basis for processing and you withdraw your consent;

8.1.3.2.3. we are processing your personal information on the basis of legitimate interests unless we have an overriding interest to continue the processing;

8.1.3.2.4. we are processing your personal information unlawfully;

8.1.3.2.5. we have to do it to comply with a legal obligation.

8.1.3.3. The right to erasure does not apply in certain circumstances including where:

8.1.3.3.1. we have to process the personal information to comply with a legal obligation; or

8.1.3.3.2. where we use the personal information to carry out a task in the public interest such as where we are investigating fraud or preventing or detecting other unlawful acts.

8.1.4. Have the processing of your personal information restricted, in certain circumstances.

8.1.4.1. This enables you to ask us to suspend the processing of your personal information in the following scenarios:

8.1.4.1.1. if you want us to establish the information’s accuracy;

8.1.4.1.2. where our use of the information is unlawful but you do not want us to erase it;

8.1.4.1.3. where you need us to hold the information, even if we no longer require it as you need it to establish, exercise or defend legal claims; or

8.1.4.1.4. you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.

8.1.5. In certain circumstances, be provided with the personal information that you have supplied to us, in a portable format that can be transmitted to another controller without hindrance.

8.1.5.1. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you

8.1.6. Object to certain types of processing, including direct marketing, legitimate interests based processing and automated processing (which includes profiling)

8.1.6.1. Where we are processing your data for direct marketing purposes (in other words where we are targeting adverts to you based on information we hold about you, or sending you direct communications, such as email, texts or social media messages to promote our goods or services), you have a right to object. However please note, even if you object to marketing messages we can still send you service messages which are direct communications with you which relate to the products or services we’re providing to you and which are reasonable for us to provide to you as part of the products or services we are providing; or

8.1.6.2. where we are processing your personal data on the basis of legitimate interests and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your interests, fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your interests, rights and freedoms or that the processing is required for the establishment, exercise or defence of legal claims.

8.1.7. The right to withdraw consent

8.1.7.1. If we are processing any of your personal information based on you having given us consent to do so, you have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing we may have undertaken based on your consent before it is withdrawn.

8.2. If you wish to exercise any of the rights set out above, you must make the request in writing to the Data Privacy Manager, email address dataprotection@storyhomes.co.uk

8.3. If you provided your consent to any of the processing of your personal information, you have the right to withdraw your consent to that processing at any time, where relevant. Please contact the Data Privacy Manager if you wish to do so.

9.1. Keeping your data secure is important to us. We use reasonable and up to date security methods to keep your personal information secure and to prevent unauthorised or unlawful access to your personal information, and against the accidental loss of, or damage to, personal information.

9.2. Maintaining data security means guaranteeing the confidentiality, integrity and availability (for authorised purposes) of the personal information.

9.3. We have in place procedures and technologies to maintain the security of all personal information from the point of collection to the point of destruction. These include adhering to various security standards, including physical and technological protection, data encryption, patching and software update management, management of access rights, network configuration and monitoring. We will ensure your personal information is only accessible by those who need to see your information for their specific role. We will only transfer personal information to a third party if that third party agrees to comply with those procedures and policies, or if they put in place adequate measures themselves.

10.1. Our employees who need to access your data will view it in order that we can manage your engagement with us and comply with our legal and statutory duties. All of our employees have been trained in data protection and understand the need to keep your information confidential.

10.2. In addition to our employees, we also use third-party providers who may process personal information on our behalf to fulfil our promise to you. These providers are carefully selected professional contractors (such as mailing or research companies) who help us provide you with our products and services and will only collect, use and disclose your information to the extent necessary to allow them to deliver those products and perform the services. We have legally binding contractual agreements in place with any providers we may use to ensure that your data is secure at all times and cannot be accessed for any other purpose. The third parties we use include:

10.2.1. External third parties include:

10.2.1.1. third party consultants, contractors and suppliers. For example, after you have completed the process of purchasing a home from us we will pass personal information to other parties as necessary to allow them to provide our after-sales support service. This will include subcontractors to fix faults and provide emergency call-out services, and warranty providers for your heating system and any other equipment or fittings under warranty or guarantee;

10.2.1.2. our financial and legal advisors and relevant mortgage advisors;

10.2.1.3. estate agents and estate managing agents;

10.2.1.4. utility suppliers and local authorities;

10.2.1.5. relevant government agencies to assist you to participate in any government schemes in which you have indicated you wish to take part

10.2.1.6. the New Home Warranty Provider, the Home Builders Federation (HBF) and similar organisations;

10.2.1.7. Thirdfort and other suppliers of identity and anti-money-laundering checks;

10.2.1.8. Space and Time and other marketing agencies who provide us with marketing services;

10.2.1.9. our analytics providers including Google Analytics and Google Consent;

10.2.1.10. our website developers Union Rooms who provide technical support to customers; and

10.2.1.11. the Home Builders Federation, Inhouse and any third party for the purposes of carrying out a market research survey in relation to your experience with us;

10.2.1.12. to our followers on our social media accounts if we repost your social media post, with your permission; and

10.2.1.13. to local authorities, consultants and third parties for the purposes of supporting the public consultation process undertaken for planning purposes in relation to any proposed new development schemes.

10.3. Apart from our employees and third-party providers, we will not disclose your personal information to a third party without your consent unless we are satisfied that they are legally entitled to the data. Where we do disclose your personal information to a third party, we will put in place arrangements to make sure your information is well protected and processed strictly in accordance with data protection laws.

10.4. We may disclose your personal information to third parties:

10.4.1. in the event that we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets;

10.4.2. if we or substantially all of our assets are acquired by a third party, in which case personal information held by us will be one of the transferred assets; and

10.4.3. if we are under a duty to disclose or share your personal information in order to comply with legal obligations or to protect our rights, property, or safety of our customers, suppliers or other employees. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

10.5. If your personal information is provided to any third parties, you are entitled to request details of the recipients of your personal information or the categories of recipients of your personal information.

11.1. We will not transfer your personal information outside the UK unless such transfer is compliant with the UK GDPR. This means that we cannot transfer any of your personal information outside the UK unless:

11.1.1. the UK government has decided that another country or international organisation ensures an adequate level of protection for your personal information or the data is being transferred to a company in the US which has signed up to the UK-US data bridge; or

11.1.2. the transfer of your personal information is subject to appropriate safeguards, which may include:

11.1.2.1. binding corporate rules; or

11.1.2.2. the International Data Transfer Agreement or the UK Addendum.

11.1.3. one of the derogations in the UK GDPR applies (including if you explicitly consent to the proposed transfer).

11.2. Google Analytics Ireland analyse website traffic and data from outside the UK for statistical or similar anonymous trend analysis in relation to our properties, products, the service we provide or the use of our website. This enables us to improve our website and our products and services.

11.3. We seek to minimise our data exports outside the UK. If you would like further information on when we export data outside the UK please contact us on dataprotection@storyhomes.co.uk .

If you consider that we have not complied with data protection laws in respect of personal information about yourself or others, you should raise the matter with our Data Privacy Manager, email address dataprotection@storyhomes.co.uk. Any breach of the UK GDPR will be taken seriously.

If you have any issues with our processing of your personal information and would like to make a complaint, please contact us and we will carefully consider your complaint and respond to you. You also have the right to contact the Information Commissioner’s Office to make a complaint on 0303 123 1113 or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.