Privacy notice

We collect your Personal Data:

• when you communicate with us
• when you apply to register with us
• when you wish to set up an account on any of our portals
• when you use any of our products and services
• when you purchase or book a conference or course with us
• when you complete any survey, questionnaire or feedback form
• when you use our website
• from our third-party partners and corporate customers
• when you make it publicly available on social media.

Information we collect from you includes:

• contact details - name, address, telephone number, email address
• personal details including your date of birth, job title and organisation
• Portal account details including usernames, passwords, account settings and preferences
• bank account and payment details
• details of your communications with us and any we send you
• recordings of phone calls made to/from us
• information about your health, life events, resilience, and capability (commonly referred to as vulnerability data)
• insolvency history and information about any associations with a previous NHBC registered business
• information about your use of the services we are providing
• the answers and information submitted in the completion of any surveys or feedback forms, including comments and requests
• device information such as operating system, unique device identifiers, the mobile network system, location data, IP (Internet Protocol) address, any requests you make on the browser and the pages and search engine terms you use
• hardware and browser settings

We use the information we collect from you:

• to provide you with our products and services
• to process and administer claims
• to take payment from you or provide a refund
• to process any applications for or changes to registration on the NHBC register,
• to carry out our obligations under any contract with you and to comply with our legal and regulatory requirements
• to answer any queries or concerns, monitor customer communications for quality and training purposes and to analyse and improve our services
• to help us identify if you require any special measures or adjustments
• to manage and administer our systems and portals and to provide user account support
• to identify products and services that may be of interest to you
• to undertake statistical analysis and research
• to onboard you as a delegate on a course and to notify you of future relevant courses/conferences
• to help us verify your identity and to prevent fraud or other financial crime
• to administer any prize draws etc
• to undertake internal operations (e.g. data analytics, testing etc), audit the website, monitor user experience, identify issues, and keep the website and portals secure.

We use Worldpay and Global Iris for payment services. If you purchase anything from us via Worldpay or Global Iris, they will collect your payment information. You provide this information directly to Worldpay or Global Iris, we do not collect or store this data. You can learn more about how Worldpay processes your Personal Data  in Worldpay's Privacy Notice and how Global Iris processes your Personal Data in Global Iris' Privacy Statement. We may also aggregate and anonymise your Personal Data. After this point, it is no longer considered Personal Data.

Under Data Protection laws, we can only process your Personal Data where we have one or more legal basis or condition for doing so as set out in the law. The lawful bases we rely on for processing this information are set out below:

• Where we have a contract with you. We will process your Personal Data when we enter and perform our contract with you, for example information in connection with claims under our Buildmark products or registration details for builders and developers to ensure compliance with the NHBC Rules.
• Some processing is required to comply with our legal obligations including to detect and prevent financial crime or making sure we verify your identity.
• We will process some information where we have a legitimate business interest, for example, improving our products and services. Where we rely on legitimate interests as our lawful basis, we carry out a balancing test to ensure that our interests do not override the rights and freedoms that you have as an individual.
• Some information is processed because you have given your consent. Your consent can be withdrawn at any time through the NHBC Preference Centre or by contacting dpo@nhbc.co.uk .

Some types of Personal Data are more sensitive than others. This is known as "special category data" or sometimes referred to as ‘sensitive data’. It includes information about health and disability issues, ethnicity, and religion. Where we process any special category data, we must have an additional legal condition for processing. The most commonly used conditions for us include:

• Your explicit consent for example, to document any adjustments you may need.
• Where it is not possible or appropriate to get your consent and there is substantial public interest to do so.
• In order for us to process any legal claims or judicial acts.

We have implemented technical and organisational measures to keep your Personal Data secure and prevent unauthorised access to it. All information you provide to us is held securely on our servers. Where you have a password which enables you to access certain parts of our website or portals, you are responsible for keeping this password confidential. Do not share your password with anyone.

Although we will do our best to protect your Personal Data, any transmission you make of your Personal Data is at your own risk.

We will also routinely refresh our information to ensure we keep it up to date. We will only retain your Personal Data for as long as it is needed for the purposes set out in this document or for as long as the law requires us to and in accordance with our internal Data Retention Policy.

We may disclose your Personal Data within the NHBC Group so that we can provide the best service across the group.

We may also share your Personal Data our third-party services providers such as IT suppliers, actuaries, auditors, lawyers, marketing agencies, research specialists, document management providers, certain contractors, suppliers, or service providers. Our suppliers and service providers will be required to meet our standards on processing information and security. The information we provide them will only be provided for the performance of their function.

Where we operate courses on behalf of third-party training providers and principals, we will pass your enrolment information and details of your performance to them. Information from completed homeowner surveys may be passed to the relevant builder where the homeowner has agreed to allow this on the survey form.

We may also share your Personal Data with certain third parties either when we receive your consent or because we need them to provide services or products to you. These include credit reference agencies, payment gateway providers, anti-financial crime screening companies and other partners we do business with.

Your Personal Data may also be shared if there is a reasonable request by a law enforcement or regulatory authority, body, or agency, to enforce or apply the terms of any contract or legal obligation with us or in the defence of a legal claim.

We may also disclose your Personal Data to third parties in the following circumstances:

• if there is a requirement for Personal Data to be passed to others involved with a claim made under the Buildmark policy such as the original builder, or a consultant or remedial works contractor
• if we sell or transfer any part of our business or assets
• if NHBC or all its assets are acquired by a third party,
• if we are defending a legal claim, your personal data may be transferred as required to defend such claim
• if we are under a duty to disclose or share your personal data to comply with any legal obligations, and other agreements; or to protect the rights, property, or safety of NHBC, our customers or others.

Where we transfer your Personal Data to a third party outside the United Kingdom, we will ensure there are appropriate safeguards in place, such as UK supervisory authority approved Standard Contractual Clauses and organisational and technical measures.

Under data protection law, you have the following rights:

• The right of access - You have the right to ask us for copies of your Personal Information.
• The right to rectification of your personal information - You have the right to ask us to correct or update any of your Personal Information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• The right to erasure or right to be forgotten - You have the right to ask us to delete your Personal Information in certain circumstances.
• The right to restriction of processing - You have the right to ask us to limit the processing of your Personal Information in certain circumstances.
• The right to object to processing - You have the right to ask us to stop processing your Personal Information in certain circumstances.
• The right to data portability - You have the right to ask that we transfer the Personal Information you gave us to another organisation, or to you, in certain circumstances.

You also have the right to complain to the relevant supervisory authority, the Information Commissioner's Office (ICO).

To exercise your rights, you can email your request to our Data Protection Officer at dpo@nhbc.co.uk.

Your ability to exercise these rights will depend on a number of factors, and in some instances, we may not be able to agree to your request (for example, if we have a legitimate or regulatory reason for not doing so or the right doesn’t apply to the particular Personal Data, we hold about you. Where we are unable to deal with your request as expected, we will explain this to you in our response.

We may change this privacy notice. Any changes to this privacy notice will take effect immediately.

Questions, comments, and requests can be directed to the Data Protection Officer at dpo@nhbc.co.uk.