PRIVACY NOTICE
Clear about how we use your information.
This notice explains what personal information Bright Sky Homes CIC collects, why we use it, where it comes from, who we may share it with, how long we keep it and the rights available to you.
At a glance
Data controller
Bright Sky Homes CIC
Company number
17223643
ICO registration reference
ZC206076
Last updated
23 July 2026
We do not sell personal information.
Who this notice covers
This notice covers people whose information we use while providing, arranging or discussing accommodation and housing-related support, as well as people who contact or work with us.
People seeking or using accommodation
Enquirers, people being referred, applicants, residents, former residents and people acting for or supporting them.
Professionals and organisations
Referrers, local authorities, funders, support and statutory services, property partners, suppliers, contractors and professional advisers.
Website and community contacts
Website visitors, form users, complainants, people making rights requests, neighbours, community contacts and job or volunteer applicants.
Our accommodation is for adults aged 18 and over. We may still receive limited information about a child where it is relevant to a household, safeguarding concern, emergency or legal duty.
Information we may collect
We collect only information that is relevant to the purpose. The exact information depends on the person’s relationship with us and the stage reached.
Identity and contact
Name, date of birth, contact details, address, identification checks, preferred communication method and details of a representative where relevant.
Housing, referral and support
Housing history, referral information, support needs, goals, accessibility requirements, household compatibility and information needed to assess suitability.
Health and other sensitive information
Relevant health, disability, racial or ethnic origin, religious belief, sexual orientation or other special category information where it is necessary and lawful to use it.
Safety, safeguarding and offending
Risk, incident, safeguarding, anti-social behaviour and criminal allegation, offence or conviction information where relevant to safety, suitability or legal responsibilities.
Accommodation, funding and service records
Occupancy and support records, benefits or funding information, payments, repairs, property access, complaints, incidents and records of decisions or actions.
Communications and technical information
Emails, calls, messages, form submissions, consent or preference records, device and browser information, IP address, security logs and cookie information.
Why we use information
We identify and document an appropriate lawful basis for each purpose before using personal information. The basis depends on the activity and the person’s relationship with us.
Enquiries, referrals and assessment
To respond, discuss needs, assess suitability and take requested steps before an accommodation or service arrangement. The basis may be steps before a contract, contract or legitimate interests.
Accommodation and housing-related support
To manage accommodation, agreed support, reviews, safety, repairs, communication and the working relationship. The basis may be contract, legal obligation or legitimate interests.
Safeguarding, emergencies and crime prevention
To protect people, respond to serious risk, meet safeguarding duties and prevent or investigate crime. The basis may be legal obligation, vital interests, recognised legitimate interest or legitimate interests, as applicable.
Funding, finance and compliance
To manage benefits or funding, payments, records, insurance, tax, audit, regulatory requirements and legal claims. The basis may be contract, legal obligation or legitimate interests.
Complaints, rights and accountability
To handle complaints and rights requests, keep appropriate records, investigate concerns and demonstrate compliance. The basis may be legal obligation or legitimate interests.
Website, systems and communication
To operate and protect the website and systems, respond to contact, prevent misuse and use optional cookies where permitted. The basis may be legitimate interests or consent where consent is required.
Our legitimate interests
Where we rely on legitimate interests, these may include operating safe and effective accommodation, responding to enquiries, managing working relationships, protecting people, property and systems, maintaining appropriate records, establishing or defending legal claims and improving our service. We consider necessity, proportionality and the impact on the person before relying on this basis.
If information is not provided
You do not have to provide personal information simply to browse the website. Some information is needed to assess a referral, enter into or manage an arrangement, confirm funding, meet legal or safety responsibilities or respond to a request. If relevant information is not provided, we may be unable to progress the enquiry, offer accommodation or provide part of the service. We will explain what is needed and why.
Sensitive and criminal-offence information
Special category and criminal-offence information receives additional protection. We use it only where it is necessary, proportionate and permitted by law. Alongside an Article 6 basis, we identify an applicable Article 9 condition or Data Protection Act 2018 Schedule 1 condition and maintain an appropriate policy document where required.
Where information comes from and who receives it
We use and share information only where there is a relevant purpose and lawful basis.
Where information may come from
- The person directly, including through forms, calls, meetings and messages.
- A referrer, representative, advocate, family member or other authorised contact.
- Local authorities, benefit or funding teams, support providers, health or social care services, criminal justice agencies and other professionals where lawful and relevant.
- Records created during an enquiry, assessment, occupancy, support relationship, complaint, incident or website visit.
- Publicly available or official sources where necessary and appropriate.
Who we may share information with
- Referrers, authorised representatives, support services, local authorities, funders and benefit teams where relevant.
- Emergency services, safeguarding authorities, police, courts, regulators or other statutory bodies where required or permitted.
- Property owners, maintenance contractors, security or other operational providers, limited to what they need.
- Website, hosting, form, email, cloud, case-management, backup, cyber-security and communications providers acting under contract.
- Insurers, solicitors, accountants, auditors and other professional advisers.
We do not routinely share more information than is needed. We do not sell personal information. Another organisation may be a separate data controller for its own use and should provide its own privacy information.
Security, transfers and retention
We protect information throughout its lifecycle and keep it only for a justified period.
Keeping information secure
We use proportionate technical and organisational measures such as access controls, secure systems, staff guidance, backups, supplier checks and incident-response arrangements. No method is completely risk-free, but suspected breaches are assessed and reported where the law requires.
International transfers
Some technology providers may process information outside the UK. Where this happens, we use an applicable adequacy arrangement or other lawful safeguard and carry out the checks required for the transfer. Contact us for information about safeguards that apply.
How long we keep information
We keep information only for as long as it is needed for the purpose, including legal, contractual, funding, safeguarding, insurance and accountability requirements. We then securely delete or anonymise it.
Retention criteria
- Website and general enquiries — while the enquiry is active and for a reasonable follow-up period.
- Referral and assessment records — while the referral is considered and afterward in line with the outcome, risk and complaints requirements.
- Resident, occupancy and support records — during the relationship and for the post-service period set by the approved retention schedule.
- Finance, contracts and funding records — for the applicable statutory, accounting and contractual period.
- Complaints, rights requests, safeguarding and incident records — until the matter and relevant follow-up, accountability or legal period have ended.
- Cookies, analytics and security logs — for the periods stated in the Cookie Policy or relevant system setting.
Your rights
Depending on the purpose and lawful basis, data protection law may give you the following rights. Some rights are not absolute, and we will explain if an exemption or limitation applies.
Access
Ask whether we use your information and request a copy.
Correction
Ask us to correct inaccurate or incomplete information.
Erasure
Ask us to delete information where the right applies.
Restriction
Ask us to limit how information is used in certain circumstances.
Objection
Object to processing based on legitimate interests or certain public-interest grounds.
Portability
Receive eligible information in a structured, commonly used format.
Withdraw consent
Withdraw consent at any time where consent is the basis.
Complain
Raise a data-protection complaint with us and complain to the ICO.
Automated decisions
We do not make decisions that have legal or similarly significant effects solely by automated means. People review referral and suitability decisions.
Your right to object
You may object to processing based on legitimate interests for reasons connected with your situation. If personal information is ever used for direct marketing, you can object at any time and that objection is absolute.
Making a rights request
A request can be made verbally or in writing. We may ask for proportionate information to confirm identity or authority. We normally respond without undue delay and within one calendar month once we have what is reasonably needed; the law permits an extension in some complex cases.
Contact, complaints and the ICO
You can make a rights request or raise a data-protection concern verbally or in writing.
Telephone:
07471 237 989
Post:
Privacy Lead
Bright Sky Homes CIC
15B Dorothy Avenue
Thurmaston
Leicester LE4 8AB
The registered office is a correspondence address. There is no public access without an appointment.
Data-protection complaints
If you think we have not handled personal information properly, email [email protected] or use the Complaints page. We aim to acknowledge complaints within one working day and will acknowledge a data-protection complaint within 30 days at the latest. We will investigate it without undue delay, keep you appropriately informed and communicate the outcome.
Information Commissioner's Office
You can complain to the Information Commissioner’s Office. We would welcome the opportunity to address the concern first, but you do not lose the right to contact the ICO.
Contact:
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Post: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF.
Telephone: 0303 123 1113
Post: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF.
Questions about your information?
Contact our Privacy Lead if you would like this notice in another format, want to exercise a right or need an explanation.