1. Introduction

1.1 This Privacy Policy describes how and why Persimmon Plc (which for the purposes of this note includes all companies in the Persimmon Group including but not limited to Persimmon Homes Limited, Charles Church Developments Limited and Space 4 Limited) (we or the Company) acquire and use personal information about you (Personal Data).

1.2 For the purpose of the Data Protection Act 2018 (the Act) and the provisions of Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR), the Company is the Data Controller. We are registered with the Information Commissioner’s Office. The sites under the domain names and associated sub-domains of persimmonhomes.com, charleschurch.com and fibrenest.com (the Sites) are operated by Persimmon Plc.

1.3 This Privacy Policy (together with the terms of the Sites and any other documents referred to on them) set out how we acquire, use and process your Personal Data in accordance with data protection laws.

2. How we collect your Personal Data

2.1 We collect Personal Data directly from you via the Sites or when we meet with you at our sales sites and via other communications between us when you make enquiries with, or purchase a property from us, or when you enter one of our competitions or prize draws; including:

2.1.1 your name, date of birth, home address(es), home and mobile telephone number(s), email address(es) and employment information;

2.1.2 information about your transactions with us;

2.1.3 information and documentation you provide when you respond to requests to submit personal information about yourself, such as identity documents;

2.1.4 records of written and verbal communications between us either electronic or written;

2.1.5 information regarding your use of the Sites, including when you access the Sites, which parts of the Sites you access most often and the developments and properties that you view on the Sites or save. This information is collected by actively tracking and recording your browsing activity and collected through the use of cookies (please see section 9 for further details);

2.1.6 CCTV images if you attend on our premises where we use CCTV recording (see under 'CCTV' below);

2.2 We may also collect your Personal Data from third parties, for example:

2.2.1 from searches of Credit Reference Agencies (CRAs) and Fraud Prevention Agencies (FPAs) of their records relating to you;

2.2.2 from public records (e.g. the electoral roll);

2.2.3 from other third parties with your consent (for example your solicitor or mortgage broker).

3. How we use your Personal Data

3.1 We may use the information we collect about you in order to:

3.1.1 provide you with our products and services or enter you into one of our competitions or prize draws;

3.1.2 communicate with you by telephone, email, SMS, or post;

3.1.3 meet our legal, regulatory and contractual obligations, including verifying your identity for the purposes of preventing fraud and money laundering in the event that you wish to reserve one of our properties and passing your personal data to the relevant warranty provider in order that they can discharge their legal obligation to administer the warranty provided to you as a new homeowner;

3.1.4 manage shared equity loan products you may have in place with us;

3.1.5 provide you with updates you have requested including keeping track of specific developments and properties;

3.1.6 deliver marketing information to you about other products and services we offer that are similar to those that you have already purchased, requested or enquired about, unless you have opted out of receiving such communications (see under 'Marketing' below);

3.1.7 ensure that any content on the Sites is presented to you in the most effective manner for you, your requirements and your computer;

3.1.8 contact you for your views on our services and events and notify you occasionally about important changes or developments to the Sites or our services;

3.1.9 provide and improve customer service and support;

3.1.10 administer, monitor, support, improve and develop our Sites to enhance operational capabilities and for internal operations;

3.1.11 verify or enforce compliance with this Privacy Policy and applicable laws.

4. Sharing your Personal Data

4.1 We may share your Personal Data with:

4.1.1 third parties which provide services for us where necessary for the delivery of our products and services, for example:

• a) contractors who undertake snagging work on our behalf;
• b) collection agents who act on our behalf (for example to collect ground rent);
• c) third parties who administer agreements on our behalf (for example shared equity loans if you have entered into such an agreement with us);
• d) suppliers who provide or make provisions to provide services to, or in relation to your property;
• e) managing agents appointed in accordance with the terms of your home purchase agreement;
• f) one or more specified estate agents where you enter into a Home Change agreement with us or where we arrange the marketing of your existing home in a part exchange deal;
• g) home warranty suppliers such as LABC and Premier Guarantee in order to support the administration of the relevant warranty;
• h) NHBC in order to support the administration of your Buildmark Policy where applicable;

4.1.2 other third parties with your consent and where you request we introduce you to them, for example mortgage brokers and bodies including the NHBC for the purposes of undertaking market research analysis in respect of purchasers of new homes;

4.1.3 law enforcement agencies or regulatory bodies where we are required to do so in order to comply with a regulatory or legal provision;

4.1.4 Credit Reference Agencies and Fraud Prevention Agencies;

4.1.5 our professional advisers;

4.1.6 those companies named in the definition of Data Controller under paragraph 1.1 of this Notice (all of those companies being in the same group of companies) for fulfilling those purposes set out in paragraph 3 above;

4.1.7 local authorities and utility companies where we are under a legal obligation to do so.

5. Our legal basis for using your Personal Data

5.1 Our use of your Personal Data as outlined above is subject to different legal bases for processing, including where necessary for:

5.1.1 The purposes of the performance of our contractual agreement with you or to take steps at your request prior to entering into an agreement with you. If you do not provide such information we will be unable to sell a property to you or provide other services, for example under the Home Change scheme;

5.1.2 Our legitimate interests, for example in managing and monitoring the operation of our Sites and for preventing fraud and for marketing our services and offers to you (subject in this case to offering you an ability to opt out);

5.1.3 Compliance with a legal obligation, for example under consumer, anti-money laundering and data protection laws and making reports to regulatory authorities and to law enforcement agencies;

5.1.4 Where you have consented to do so, for example in relation to data we provide to home warranty providers for them to undertake customer satisfaction surveys.

5.2 Where our use of your data is not necessary for one of the purposes outlined above we may seek your consent to use it in a particular way (as outlined at 4.1.2 above). Where we ask for your consent you are free to refuse our use of the data for those purposes and you may withdraw your consent at any time by contacting us using the details set out below.

6. Credit Reference Agencies (CRAs) & Fraud Prevention Agencies (FPAs)

6.1 We may undertake searches of CRAs to verify your identity when you apply to reserve a property on one of our sites. We do this by submitting your Personal Data to them. We need to undertake such searches in accordance with anti-money laundering laws. If we undertake such a search for these purposes it will leave a 'soft’ footprint on your credit file.

6.2 If you apply for a shared equity loan with us, we will undertake fuller searches with CRAs and FPAs which go beyond verification of your identity and enable us to review your credit history. We do this to assess creditworthiness and product suitability, manage your account, trace and recover debts and prevent criminal activity and this may leave a 'hard’ footprint on your credit file.

6.3 Where you borrow from us under a shared equity loan, we may give details of your accounts and how you manage it to CRAs. If you borrow and do not repay in full and on time, in accordance with the terms of your loan, CRAs may record the outstanding debt. This information may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe. Records remain on file for 7 years after they are closed.

6.4 If you provide false or inaccurate information to us and fraud is identified, details will be passed to FPAs.

6.5 You can find more information about the various CRAs and the ways in which they use and share your personal information at http://www.experian.co.uk/crain/index.html or you can contact the agencies directly:

Callcredit Consumer Services Team, PO Box 491, Leeds, LS3 1WZ Tel: 0330 024 7579 or visit www.callcredit.co.uk

Equifax PLC Credit File Advice Centre, PO Box 3001, Bradford, BD1 5US Tel: 0870 010 0583 or visit www.myequifax.co.uk

Experian Consumer Help Service, PO Box 8000, Nottingham, NG80 7WF Tel: 0870 241 6212 or visit www.experian.co.uk

7. Competitions & prize draws

7.1 When you enter one of our competitions or prize draws, we collect your name, email address and the IP address of the device or network used to access the competition (where this is done online). We obtain this information from the entry form completed by you and from your device.

7.2 We process your personal data in accordance with the terms of this Privacy Policy and in accordance with the terms and conditions of the competition or prize draw which you have entered.

7.3 We use your personal data to:

• 7.3.1 Manage your entry;
• 7.3.2 Contact you in the event that you are a winner;
• 7.3.3 Contact you about similar follow-up competitions/prize draws and activity days in which we think you may be interested; and
• 7.3.4 For marketing and publicity purposes in the event that you are a winner.

7.4 We process your personal data as outlined above on the basis of our legitimate interests, for contractual necessity and (in the case of 7.3.4) with your consent.

8. CCTV

8.1 We may use CCTV recording on some of our premises, including site offices, for the purposes of security, crime prevention, health and safety and performance monitoring.

8.2 Wherever CCTV is in operation there will be appropriate signage.

8.3 We retain the images recorded only for so long as is necessary and will normally keep them for no longer than 12 months, unless there is a specific requirement to retain them longer. The images are recorded for our internal use and will only be shared with any third parties to protect the legitimate business interests of the Company or where required, for example for the purposes of the prevention or detection of crime.

9. Use of cookies

9.1 A cookie is a small file which is sent to your browser by the Sites and which is then stored on your computer’s hard disk. When you browse the Sites cookies record your activity to enables us to keep a record of any personal data submitted. We use this to understand more about you and your preferences, to optimise your browsing experience and deliver content to you in the most appropriate way. The cookie for this website, FibreNest, will last for 1 year (365 days).

9.2 We may work with third parties to track and research, on our behalf, your usage and activity on the Sites. No personal information about you is shared, however in the course of conducting this research these third parties may place a unique “cookie” on your computer’s hard disk.

9.3 We use cookies solely to gather information on IP addresses such as geographic location, to analyse trends, administer the Sites, track users’ movements on the Sites and gather broad demographic information for aggregate use as set out in paragraph 9.1. IP addresses are not linked to other personally identifiable information and will not be used to deliver targeted marketing messages.

9.4 For information about blocking the use of cookies, please refer to the instructions/help screen on your internet browser. You may not be able to use or access certain parts of the Sites or online services however if you block the use of cookies.

9.5 We advise you of our use of cookies when you first access our Sites via an automated ‘pop-up’, which explains the cookies we use and what we use them for. If you continue to use our Sites you implicitly accept our use of cookies. If you set your web browser to decline the use of cookies, you may experience limited functionality in the use of our Sites.

9.6 For information on how to remove cookies from your browser, please visit ico.org.uk/your-data-matters/online/cookies/ and scroll down to "How can I control my cookies?"

10. Links to other sites

10.1 In governing the use of your data in web browsing activity, this Privacy Policy relates specifically to the use of the Sites only and does not extend to your use of, provision of data to and collection of data on any site not connected to us to which you may access by following a hyperlink within the Sites or contained within any e-mail sent from or on behalf of the Persimmon Group.

10.2 If you follow a link to any other websites, they should have available their own privacy and/or cookie policies we do not accept any responsibility or liability for their operation or misuse of your personal data. You should review these policies before submitting any Personal Data to those websites.

11. How long we will keep your Personal Data

11.1 We will retain your Personal Data for up to six years from the end of our relationship with you (unless required by law to retain it longer)). In relation to identification data this will be retained for five years.

12. Transfer of your Personal Data

12.1 The Personal Data that we collect from you will not ordinarily be transferred to, or stored at, a destination outside the European Economic Area (EEA).

12.2 However, if we do need to transfer your Personal Data outside the EEA we will take all steps reasonably necessary to ensure that any such transfer is made securely and that there is adequate protection in place in order to protect your Personal Data, as required by the Act and Chapter V of the GDPR, including requiring the transferee to enter into model contractual clauses or (if US based) being a member of the Privacy Shield.

12.3 Please contact us if you wish to find out more; if we ever transfer your Personal Data outside the EEA you can ask us for a copy of relevant safeguards.

13. Security

13.1 The information you supply to us will be held on our servers located in datacentres hosted by one or more approved providers. The internet is not a secure medium, however we take all reasonable care to prevent any unauthorised access to your Personal Data.

13.2 We take reasonable technical and organisational measures to protect Personal Data in our possession from loss, misuse and unauthorised access, disclosure, alteration and destruction.

13.3 Personal Data stored electronically is secured by us in the following ways:

13.3.1 Stored in a restricted access format;

13.3.2 Secured within networks that have certified firewalls in a multi-layered manner and which are penetration-tested at least annually;

13.3.3 Personal Data can only be accessed by staff on an as-needed basis, and;

13.3.4 All network and computer equipment is secured with passwords and servers are only physically and logically accessible by authorised personnel, systems and software.

13.4 We will require third parties acting on our behalf who collect or use your Personal Data under our instructions to agree to safeguard your Personal Data in accordance with this Privacy Policy and comply with data protection laws.

14. Marketing & opting out

14.1 Unless you have opted out, we may contact you via email, SMS/text message or other electronic mail to inform you about other products or services provided by us that are similar to those that you have already agreed to, requested or enquired about.

14.2 You have the right at any time to ask us not to use your Personal Data for marketing purposes by notifying us using the contact details set out in the ‘Contact and Complaints’ section below.

15. Your rights

15.1 Your personal information is protected under data protection laws and you have a number of rights (see below) which you can seek to exercise. Please contact us in writing, by email or telephone using the details shown under 'Contact and Complaints' below if you wish to do so, or if you have any queries in relation to your rights. Please note these rights do not apply in all circumstances. We may need to verify your identity before we can respond to any request to exercise your rights.

15.2 Right of access - subject to certain exceptions, you have the right of access to your Personal Data that we hold.

15.3 Right to rectify your personal information - If you discover that the information we hold about you is inaccurate or incomplete, you have the right to have this information rectified (i.e. corrected).

15.4 Right to be forgotten - You may ask us to delete information we hold about you in certain circumstances. This right is not absolute and it may not be possible for us to delete the information we hold about you, for example, if we have an on-going contractual relationship or are required to retain information to comply with our legal obligations.

15.5 Right to restriction of processing - In some cases you may have the right to have the processing of your personal information restricted. For example, where you contest the accuracy of your personal information, its use may be restricted until the accuracy is verified.

15.6 Right to object to processing - You may object to the processing of your personal information when it is based upon our legitimate interests. You may also object to the processing of your personal information for the purposes of direct marketing and for the purposes of statistical analysis.

15.7 Right to data portability - You have the right to receive, move, copy or transfer your personal information to another controller when we are processing your personal information based on consent or on a contract and the processing is carried out by automated means.

16. Changes

16.1 We may edit or amend this Privacy Policy from time to time. If we make any substantial changes to the Privacy Policy, we will notify you by presenting on the home page of the Sites a notice to this effect. Please check our Sites frequently to see any updates or changes to this Policy.

16.2 As a result of improvements we make to our services, amendments to laws or regulation or developments in the technology or processes we use, we may change the way in which or the purposes for which we process such information. If we make any substantial changes in the way in which we use your Personal Data we will notify you by email or by post.

17. Contacts & complaints

17.1 If you have any questions about how we treat and protect your Personal Data and your privacy, if you have any comments, wish to seek to exercise any of your rights as outlined above or to complain, please contact Persimmon plc, Persimmon House, Fulford, York YO19 4FE, company.secretarial@persimmonhomes.com or by telephone on 01904 642199 (quoting the reference ‘GDPR’).

17.2 You may also lodge a complaint with the Information Commissioner's Office, Water Lane, Wilmslow, SK9 5AF telephone 0303 123 1113. www.ico.org.uk/

October 2019