Alwyne Estates Privacy Policy & Notices for Tenants and Landlords

Alwyne Estates gathers, stores and processes information about individuals (Data Subjects) who rent properties let and/or managed by us (Tenants), or who engage us to let and/or manage properties they own (Landlords).

For both categories of data subjects Alwyne Estates acts, in respect of the General Data Protection Regulation 2018 (GDPR) as the Data Controller, with several service providers, as specified in the relevant Privacy Notices, acting as Data Processors.

We store and process only the minimum information required by our Legitimate Interest in fulfilling our contracts with tenants and landlords as well as our statutory and/or legal obligations.

We have conducted a Privacy Impact Assessment regarding our tenants’ and landlords’ personal information we store and process and/or which is stored and processed on our behalf by service providers, and concluded that, even though we do not normally store personally identifiable sensitive information, the risk posed to the privacy and security of data subjects through the unauthorized exposure of their personal information (especially scans of IDs) is severe, as it might potentially lead to identity theft. We have, therefore, taken extensive precautions, as outlined in the relevant Privacy Notices, to ensure the Confidentiality, Integrity and Availability of all the personally identifiable information we store and process or which is stored and processed on our behalf.

All individuals about whom we store or process information or where this information is stored or processed on our behalf have the following rights:

1. The right to be informed: individuals have the right to be informed about the collection and use of their personal data. We fulfil our obligations in this respect via a Privacy Notice made available at the time the information is collected.
2. The right of access: individuals have the right to access the data we hold about them and to confirmation as to what data we hold. This information is available on request.
3. The right to rectification: individuals have the right to require that we rectify any inaccuracies in the data we store about them within one month of a request to do so.
4. The right to erasure: individuals have the right to require us to delete their data unless we are required to retain it for regulatory, legal, contractual or other specific reason.
5. The right to restrict processing: individuals have the right to require us to restrict processing their personal data, allowing us to store but not process the data.
6. The right to data portability: individuals have a right to their data in a format that can be transferred between systems and we will supply data in standard portable formats such as MS Word, Excel, PST and CSV files.
7. The right to object: individuals have the right to object to our processing their data and we must comply unless we have compelling legitimate grounds for not doing so, such as our responsibilities to HMRC
8. Rights in relation to automated decision making and profiling: we do not engage in automated decision making or profiling.

All these rights can be exercised by contacting Geraldine O’Grady verbally or in writing.

Privacy Notices

For Tenants

Who are we?

Alwyne Estates are an estate agency responsible for letting and/or managing properties on behalf of their owners (landlords). Because of that, we act as a Data Controller and have a legitimate interest in storing and processing the personally identifiable information necessary to fulfil our contractual obligations to you as our tenant or prospective tenant; this includes helping you find a suitable property to rent and conducting all the necessary checks. Depending on our contract with the landlord, we might also act as your main point of contact for property maintenance throughout the period of your tenancy.

What information do we have?

As your letting agency and/or property maintenance company, we store the minimum amount of your personal information necessary, such as your name, email address, phone number, current and past addresses, bank details, passport number, copy of your passport/visa, proof of address, date of birth, salary details, employment details, and National Insurance Number. This is provided to us by you, either directly or via Veri-Check, a company we use for reference and credit checks, in order for us to provide you with our service and fulfil our legal obligations as letting agents in light of the Immigration Act 2014.

What risks do you face?

We have conducted a privacy impact assessment and concluded that the unauthorized disclosure of the personally identifiable information we hold about you (especially copies of your ID documents, including but not limited to passports or visas) presents you with a significant risk of identity fraud, or other dangers. Corruption or loss of access to the information we hold about you presents you with a close to zero risk.

In light of the potentially serious risks involved, we will advise you within 24 hours of our becoming aware of any unauthorised disclosure of your information. We will also report any such breach to the Information Commissioners Office.

Can anyone else access your information?

In the process of establishing and managing your tenancy, we might share your personal information with several third parties whenever it is necessary for us to fulfil our contractual and legal obligations, specifically:

• Referencing. We conduct reference and credit checks via Veri-Check. When you express an interest in renting a property managed and/or let by us, an initial set of information (name, email address, phone number) is collected and passed on to Veri-Check. During the referencing process, Veri-Check collect additional information from you, such as passport number, National Insurance Number, date of birth, employment details and salary details. All this information is then shared with us.
• Deposit. We use TDS, a deposit-holding scheme authorized by the Ministry of Housing, Communities & Local Government. Your bank details, as well as contact details, may be shared with them for the purpose of returning your deposit and resolving any conflicts relating to deposit.
• Property maintenance. If the property you are renting is managed directly by the landlord, we share your information with them as necessary for property maintenance and their own legal compliance with the Immigration Act 2014. If the property is managed directly by us, we might share your contact details with independent contractors for carrying out repairs you requested.

We might also share your personal information with other entities if we are required to do so by law.

We also contract several third-party service providers to store and process your information. In all cases we ensure that such service providers do not have direct access to your information and are contractually bound by the provisions of the GDPR in respect of their role as Data Processors of your information.

How long do we retain your information?

We will retain your information for as long as you are one of our tenants, and for seven years afterwards.

How do we keep your information safe?

We store and process your information in ISO 27001 certified data centres within the European Economic Area (EEA). Your information is encrypted and backed up at least daily. When your personal information is being processed by third parties as outlined above, we have obtained their assurance (by obtaining their Privacy Polices and/or related documents) that they store your data within the EEA, and have provisions in place to keep it secure. In case of independent contractors/landlords, we have obtained written assurance that they will only process your personal information according to the guidelines established in this policy.

What rights do you have in relation to the information we hold?

Insofar as the exercise of these rights does not conflict with our statutory, legal or contractual obligations you have the right:

• To know that we hold information about you and what information we hold
• To receive a copy of the information we hold in a standard format (Word, Excel, PDF, CSV, PST)
• To require us to rectify any inaccuracies in the information we hold about you
• To require us to delete your information
• To restrict our ability to use your information
• To object to our processing your data

We do not use your information for automated decision making or profiling.

To exercise your rights, please contact Geraldine O’Grady on geraldine@alwyne.co.uk.

For Landlords

Who are we?

Alwyne Estates are an estate agency responsible for letting and/or managing a property / properties you own, and contacting tenants on your behalf. Because of that, we act as a Data Controller and have a legitimate interest in storing and processing the personally identifiable information necessary to fulfil our contractual obligations to you as our client.

What information do we have?

As your letting agency and/or property maintenance company, we store the minimum amount of your personal information necessary, such as your name, email address, phone number, home address, and bank details. All this is provided to us by you directly.

What risks do you face?

We have conducted a privacy impact assessment and concluded that the unauthorised disclosure, corruption or loss of the minimal personally identifiable information we hold about you presents you with a low risk of breach of your privacy, identity fraud or other dangers. In the event of any unauthorised disclosure of your personal information we will endeavour to inform you within 24 hours of our becoming aware.

Can anyone else access your information?

We do not share your information with any third parties without your explicit permission unless we are required to do so by law. From time to time a third party, such as a tenant renting one of your properties or an independent contractor, may ask us to provide your contact details for reasons relating to repairs or other property maintenance. In this instance we will only provide these details with your consent. We contract several third-party service providers to store and process your information. In all cases we ensure that such service providers do not have direct access to your information and are contractually bound by the provisions of the GDPR in respect of their role as Data Processors of your information.

How long do we retain your information?

We will retain your information for as long as you are one of our clients, and for seven years afterwards.

How do we keep your information safe?

We store and process your information in ISO 27001 certified data centres within the European Economic Area (EEA). Your information is encrypted and backed up at least daily. When your personal information is being processed by third parties as outlined above, we have obtained their assurance (by obtaining their Privacy Polices and/or related documents) that they store your data within the EEA, and have provisions in place to keep it secure. In case of independent contractors, we have obtained written assurance that they will only process your personal information according to the guidelines established in this policy.

What rights do you have in relation to the information we hold?

Insofar as the exercise of these rights does not conflict with our statutory, legal or contractual obligations you have the right:

To know that we hold information about you and what information we hold

To receive a copy of the information we hold in a standard format (Word, Excel, PDF, CSV, PST)

To require us to rectify any inaccuracies in the information we hold about you

To require us to delete your information

To restrict our ability to use your information

To object to our processing your data

We do not use your information for automated decision making or profiling.

To exercise your rights, please contact Geraldine O’Grady on geraldine@alwyne.co.uk.