The following is to explain your rights and give you the information you are entitled to under UK data protection legislation.
MHCLG is the data controller. The Data Protection Officer can be contacted at [email protected]
If you follow a link to a service provided by another government department, agency or local authority, that organisation will:
A data controller determines how and why personal data is processed. For more information, read the MHCLG's (formerly DLUHC) entry in the Data Protection Public Register.
We collect information about how you use our website to help us improve the site and ensure it meets the needs of its users.
We use cookies and page tagging techniques to enable Google Analytics 4 to collect information such as:
We do not store your personal information through Google Analytics 4, for example, your name, address or internet protocol (IP) address. We do not allow Google Analytics 4 to use or share data about how you use the site. We will not identify you through analytics information, and we will not combine analytics information with other datasets in a way that would identify who you are.
Sentry is a third party tool used for error tracking and performance monitoring of our website. Sentry collects the following types of information:
We use feedback forms on the site to allow you to send direct feedback or queries to our communication team. You can find a link to the feedback page in the footer or in the phase banner. As part of this service, we collect information such as:
We only use the personal data you provide to respond to your query.
We collect information through these tools to help:
The legal basis for processing personal data in relation to site security, error-handling and performance are our legitimate interests, and the legitimate interests of our users, in ensuring the security and integrity of our site.
The legal basis for processing data collected with Google Analytics and on-site feedback forms is your consent.
The legal basis for processing all other personal data is that it’s necessary:
The data we collect may be shared with other government departments, agencies and public bodies. It may also be shared with our technology suppliers, for example our hosting provider.
We will share your data if we are required to do so by law - for example, by court order, or to prevent fraud or other crime.
The data we collect with Google Analytics cookies is transferred and stored with Google where we analyse it with Google Analytics software (Google Analytics 4). We do not allow Google to use or share this data for their own purposes.
We will not:
Data collected by Google Analytics 4 are retained by Google for 14 months. After this point, the data are deleted from the Google Analytics 4 server.
Data are extracted from Google Analytics 4 and stored in secure MHCLG databases where the retention period is for as long as necessary to fulfill the purposes outlined above.
The data collected by Sentry is retained for as long as necessary to fulfill the purposes outlined above.
The data we are collecting is your personal data, and you have rights that affect what happens to it. You have the right to:
In some circumstances you may also have the right to withdraw your consent to us having or using your data, to have all data about you deleted, or to object to particularly types of use of your data. We will tell you when these rights apply.
If you have any of these requests, contact [email protected]
We will not use your data for any automated decision making.
We design, build and run our systems to make sure that your data are as safe as possible at all stages, both while they are processed and when they are stored.
All personal data are stored in the European Economic Area (EEA). Data collected by Google Analytics 4 may be transferred outside the UK and EEA for processing.
Where data processing happens in the United States (US), suppliers need to meet the certification standards set out in the UK-US data bridge agreement. This facilitates flows of personal data to certified US companies that have opted in to the EU-US Data Privacy Framework.
We are committed to doing all that we can to keep your data secure. We have set up systems and processes to prevent unauthorised access or disclosure of your data.
We also make sure that any third parties that we deal with keep all personal data they process on our behalf secure.
When we ask you for information, we will keep to the law, including the Data Protection Act 2018 and UK General Data Protection Regulation.
If you are unhappy with the way the Department has acted, you can make a complaint.
If you are not happy with how we are using your personal data, you should first contact [email protected].
If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:
The Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow, Cheshire, SK9 5AF,
Telephone: 0303 123 1113 or 01625 545 745
https://ico.org.uk/
We may change this privacy policy. In that case, the 'last updated' date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.
Last updated Wednesday 29th October 2025