Alwyne Estates gathers, stores and processes information about individuals (Data Subjects) who rent properties let and/or managed by us (Tenants), or who engage us to let and/or manage properties they own (Landlords).
For both categories of data subjects Alwyne Estates acts, in respect of the General Data Protection Regulation 2018 (GDPR) as the Data Controller, with several service providers, as specified in the relevant Privacy Notices, acting as Data Processors.
We store and process only the minimum information required by our Legitimate Interest in fulfilling our contracts with tenants and landlords as well as our statutory and/or legal obligations.
We have conducted a Privacy Impact Assessment regarding our tenants’ and landlords’ personal information we store and process and/or which is stored and processed on our behalf by service providers, and concluded that, even though we do not normally store personally identifiable sensitive information, the risk posed to the privacy and security of data subjects through the unauthorized exposure of their personal information (especially scans of IDs) is severe, as it might potentially lead to identity theft. We have, therefore, taken extensive precautions, as outlined in the relevant Privacy Notices, to ensure the Confidentiality, Integrity and Availability of all the personally identifiable information we store and process or which is stored and processed on our behalf.
All individuals about whom we store or process information or where this information is stored or processed on our behalf have the following rights:
All these rights can be exercised by contacting Geraldine O’Grady verbally or in writing.
For Tenants
Who are we?
Alwyne Estates are an estate agency responsible for letting and/or managing properties on behalf of their owners (landlords). Because of that, we act as a Data Controller and have a legitimate interest in storing and processing the personally identifiable information necessary to fulfil our contractual obligations to you as our tenant or prospective tenant; this includes helping you find a suitable property to rent and conducting all the necessary checks. Depending on our contract with the landlord, we might also act as your main point of contact for property maintenance throughout the period of your tenancy.
What information do we have?
As your letting agency and/or property maintenance company, we store the minimum amount of your personal information necessary, such as your name, email address, phone number, current and past addresses, bank details, passport number, copy of your passport/visa, proof of address, date of birth, salary details, employment details, and National Insurance Number. This is provided to us by you, either directly or via Veri-Check, a company we use for reference and credit checks, in order for us to provide you with our service and fulfil our legal obligations as letting agents in light of the Immigration Act 2014.
What risks do you face?
We have conducted a privacy impact assessment and concluded that the unauthorized disclosure of the personally identifiable information we hold about you (especially copies of your ID documents, including but not limited to passports or visas) presents you with a significant risk of identity fraud, or other dangers. Corruption or loss of access to the information we hold about you presents you with a close to zero risk.
In light of the potentially serious risks involved, we will advise you within 24 hours of our becoming aware of any unauthorised disclosure of your information. We will also report any such breach to the Information Commissioners Office.
Can anyone else access your information?
In the process of establishing and managing your tenancy, we might share your personal information with several third parties whenever it is necessary for us to fulfil our contractual and legal obligations, specifically:
We might also share your personal information with other entities if we are required to do so by law.
We also contract several third-party service providers to store and process your information. In all cases we ensure that such service providers do not have direct access to your information and are contractually bound by the provisions of the GDPR in respect of their role as Data Processors of your information.
How long do we retain your information?
We will retain your information for as long as you are one of our tenants, and for seven years afterwards.How do we keep your information safe?
We store and process your information in ISO 27001 certified data centres within the European Economic Area (EEA). Your information is encrypted and backed up at least daily. When your personal information is being processed by third parties as outlined above, we have obtained their assurance (by obtaining their Privacy Polices and/or related documents) that they store your data within the EEA, and have provisions in place to keep it secure. In case of independent contractors/landlords, we have obtained written assurance that they will only process your personal information according to the guidelines established in this policy.
What rights do you have in relation to the information we hold?
Insofar as the exercise of these rights does not conflict with our statutory, legal or contractual obligations you have the right:
We do not use your information for automated decision making or profiling.
To exercise your rights, please contact Geraldine O’Grady on geraldine@alwyne.co.uk.
Who are we?
Alwyne Estates are an estate agency responsible for letting and/or managing a property / properties you own, and contacting tenants on your behalf. Because of that, we act as a Data Controller and have a legitimate interest in storing and processing the personally identifiable information necessary to fulfil our contractual obligations to you as our client.
What information do we have?
As your letting agency and/or property maintenance company, we store the minimum amount of your personal information necessary, such as your name, email address, phone number, home address, and bank details. All this is provided to us by you directly.
What risks do you face?
We have conducted a privacy impact assessment and concluded that the unauthorised disclosure, corruption or loss of the minimal personally identifiable information we hold about you presents you with a low risk of breach of your privacy, identity fraud or other dangers. In the event of any unauthorised disclosure of your personal information we will endeavour to inform you within 24 hours of our becoming aware.
Can anyone else access your information?
We do not share your information with any third parties without your explicit permission unless we are required to do so by law. From time to time a third party, such as a tenant renting one of your properties or an independent contractor, may ask us to provide your contact details for reasons relating to repairs or other property maintenance. In this instance we will only provide these details with your consent. We contract several third-party service providers to store and process your information. In all cases we ensure that such service providers do not have direct access to your information and are contractually bound by the provisions of the GDPR in respect of their role as Data Processors of your information.
How long do we retain your information?
We will retain your information for as long as you are one of our clients, and for seven years afterwards.How do we keep your information safe?
We store and process your information in ISO 27001 certified data centres within the European Economic Area (EEA). Your information is encrypted and backed up at least daily. When your personal information is being processed by third parties as outlined above, we have obtained their assurance (by obtaining their Privacy Polices and/or related documents) that they store your data within the EEA, and have provisions in place to keep it secure. In case of independent contractors, we have obtained written assurance that they will only process your personal information according to the guidelines established in this policy.
What rights do you have in relation to the information we hold?
Insofar as the exercise of these rights does not conflict with our statutory, legal or contractual obligations you have the right:
We do not use your information for automated decision making or profiling.
To exercise your rights, please contact Geraldine O’Grady on geraldine@alwyne.co.uk.