Privacy Policy and GDPR
Our Commitment
Harcourt White Limited takes your data protection seriously. We want you to know how we look after and protect the data you provide us/send to us and that we hold on you.
The data that we hold on you is data you have provided to us in the course of delivering services to you and what we collect during our referencing and credit check process.
One tenant example: your application form that you provided us with when you applied for a property.
One landlord example: the management agreement that you signed to give us authority to manage your property.
We will never sell your data.
In order to provide our services to you, we use a number of third-party/sub-processors who may have access to your data. We want to be clear and transparent with you about the third party/sub-processors we use and what we have done to ensure that they take your data protection as seriously as we do.
How we use personal information
We will not use your personal information unless we have first told you how we will use it or it is obvious how we will use it.
As a property company we need to collect and use your personal information for:
- Processing applications
- Providing event information, campaigning, keeping a record of our relationship with you
- Keeping a record of if you have opted-out of receiving marketing emails
- Keeping a record of individuals and or organisations whose applications may have been declined by us or where we’ve terminated a contract, including but not limited to: name, address, email address, phone number, date that said application or contract was terminated and relevant notes
- Event applications, registrations, administration and informing people about our events
- Carrying out surveys
- Forwarding surveys and consultations run by other organisations with whom we collaborate or are funding
- Understanding the use of our website including details of your visits to our website including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own purposes or otherwise and the resources that you access
- Employee and contractor administration
Legal basis for processing personal information
The law allows us to collect and use personal data if it is necessary for our legitimate business interest and so long as its use is fair, balanced and does not unduly impact your rights. In many situations, the best approach is to process personal data because of our contract with you and our legitimate interests as a lettings and property management company, rather than consent. We will ask for your consent to send you marketing emails. You can withdraw consent for this at any time.
We do not expect to receive or process sensitive personal data. In extreme situations, we may share your personal details with the emergency services if we believe it is in your ‘vital interests’ to do so. For example, if one of our tenants becomes ill.
We may also share your personal information where we are compelled by law to do so.
We process employee personal information to meet our legal obligations as an employer.
How we collect personal information
We collect personal information from you directly through our website, over the phone, through application forms, via email communication with you.
We may collect information about the software on your computer or device (your browser version etc.) and your IP address (your connection with the internet) to improve your interaction with our website and for our records. This may happen automatically without your being aware of it.
We may use cookies (small text files which we and other website operators store on your computer or device when you visit our website) to deliver a better and more personalised interaction. They enable us to recognise you when you return to our website, store information about your preferences, and improve the way your searches are processed. They also enable us to generate statistics about the number of visitors we have and how they use our website and the internet. You can set your browser to reject our cookies if you wish (you should consult your browser help section for details), but this might restrict your use of our website and other websites. For more information about cookies, please see our cookies policy.
Personal information that we collect
The type of information we collect and how we use it depends on why you are providing it.
The following details what type of personal information we collect and hold for you:
For Tenants:
· The completed application form that you filled out, signed and provided us with
· All accompanying documentation that we required as part of the application form/referencing process; for example ID (passport, drivers licence, birth certificate), bank statements, HMRC filings,
· Credit check and reference checks, and right-to-rent checks
· All email, text and Arthur communications between us
For Guarantors:
· All accompanying documentation that we required as part of the application form/referencing process; for example ID (passport, drivers licence, birth certificate), bank statements, HMRC filings,
· Credit check and reference checks, and right-to-rent checks
· All email, text and Arthur communications between us
· Your contact details including email, postal address and phone numbers
For Landlords:
· All accompanying documentation that we required as part of setting up the management agreement and managing your property; for example ID (passport, drivers licence, birth certificate)
· Land registry check
· Mortgage lender details
· Insurance details
· All email, text and Arthur communications between us
· Your contact details including email, postal address and phone numbers
Where we store your data
Dropbox
We use Dropbox to store data that we hold on you. All of this data is encrypted and stored on secure servers.
See the below link for Dropbox privacy information:
https://aem.dropbox.com/cms/content/dam/dropbox/www/en-us/security/privacy_data_protection_whitepaper.pdf
Arthur Online
We use a property management software system called Arthur. On this system we store data on you. All of this data is stored on their secure servers.
See below link for Arthur privacy information:
https://www.arthuronline.co.uk/gdpr/
Asana
We use Asana to track things like maintenance jobs, certificates, move-in’s and move-outs and other things that may need tracking during your time with us, including any queries you send us that need an action. On this system we store data on you. All of this data is stored on their secure servers.
See below link for Asana privacy information:
https://asana.com/terms#privacy-policy
Third-Parties / Sub-Processors
Microsoft
We use Microsoft Office 365 to manage our emails and file storage. Microsoft have confirmed that they are GDPR compliant.
Microsoft may transfer data outside of the EEA, but will only do so in a manner which protects your data and meets the requirements of the GDPR.
See the below link for Microsoft privacy information:
https://privacy.microsoft.com/en-GB/privacystatement
Godaddy
To manage our website we use Godaddy. Godaddy is GDPR compliant.
See below link for Godaddy privacy information:
https://uk.godaddy.com/agreements/showdoc.aspx
BookKeeping
We engage the services of an outsourced book keeping provider. We have a specific agreement in place with them which ensures that your data is protected and that our provider is GDPR compliant.
Administration Support
We outsource our administration tasks to self-employed virtual assistants; both in the United Kingdom and abroad. We have a specific agreement in place with them which ensures that your data is protected and that they are GDPR compliant.
Reference, credit checks and right-to-rent checks
In the course of providing services to you, we may engage the services of an outsourced reference and credit check provider. We have a specific agreement in place with them which ensures that your data is protected and that our provider is GDPR compliant.
Currently we use NLA for our credit checks, however, this is subject to change, and should it change this policy will be updated and available via our website or will be sent to you.
See below link for NLA privacy information:
https://landlords.org.uk/membership/aims-terms/website-privacy-policy
Each of these providers may change at any time, but our commitment to the security of your data remains. Any new providers will be subject to the same vetting and selection process and will be governed by the same or similar terms and conditions.
Under these agreements, data may be transferred outside of the EEA but only where your rights and the rights of the data subject are protected and where that transfer is compliant with the requirements of the GDPR.
For more information on any of the above please contact the data processor of Harcourt White Limited.
How we protect personal information
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff and approved third-parties/sub-processors.
We store all personal information on Dropbox and Arthur Online (see details above). Any paper files are stored securely.
Unfortunately, the transmission of information over the internet can never be completely secure. Although we will do our best to ensure that your personal information is protected, we cannot guarantee the security of your data transmitted to the website. Any transmission of your personal information by you is therefore at your own risk. Once we have received your information, we will use strict procedures and security features to try and prevent unauthorised access.
How long we keep personal information
We will only keep personal information for as long as we have a valid reason for keeping it. After that, we delete or dispose of the information securely.
We keep personal information about:
- Tenants data for the duration of their AST and seven years after the contract ceases in accordance with the law
- Landlords data for the duration of their contractual term with us and seven years after the contract ceases in accordance with the law
- Advice we have provided for seven years irrespective of whether our contractual term has lapsed
- Complaints and feedback for up to two years
- Applications, registrations, administration paperwork and contracts for seven years after the event has taken place
- Analytics information from Google for up to two years.
- Employees data for the duration of their employment and seven years after employment ceases in accordance with the law.
Your rights
You have a right to know what personal data we hold on you, who we acquired it from, how we acquired it, how we hold it and how we process it and who we disclose it to.
You have the right to request access to any of your personal data we hold on you, information about how and why it is processed, and to whom it may be disclosed.
You have a right to ask us to erase your personal information.
You have the right to object to processing of your data. You have the right to request export of your data.
These statutory rights are qualified by exceptions and exemptions.
To exercise any of these rights, please contact the data controller detailed below.
You can find out more about your rights from the Information Commissioner, who regulates data protection and privacy.
Changes to this policy
We may change this Policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.
You can request a copy of your information or contact the data controller and processor for Harcourt White Limited by emailing latoya@harcourtwhite.co.uk