1.2 For the purpose of the Data Protection Act 2018 (the Act) and the provisions of UK GDPR (as defined in the Act) (GDPR), the Company is the “Data Controller”. We are registered with the Information Commissioner’s Office.
1.4 Select (Baker St.) Residential Limited, a company registered in England under company number 13438445 whose registered office address is at Bridge House, 12 Market Street, Glossop Derbyshire, United Kingdom, SK13 8AR is the controller and is responsible for your personal data.
2 How we collect your Personal Data and the Personal Data we collect about you
2.1 We collect Personal Data directly from you via the Sites or when we meet with you at our sales sites and via other communications between us when you make enquiries with us, reserve, or purchase a property from us, including:
2.1.1 your name, date of birth, home address(es), home and mobile telephone number(s), email address(es) and employment information;
2.1.2 information about your transactions with us which may include bank account and payment card details and details about payments made to you from us or from us to you and details of purchases made by you from us;
2.1.3 information and documentation you provide when you respond to requests to submit personal information about yourself, such as identity documents;
2.1.4 records of written and verbal communications between us in either electronic or written form;
2.1.6 CCTV images if you attend on our premises where we use CCTV recording (see under ‘CCTV’ below); and
2.1.7 your preferences in receiving marketing and other communications from us and our third parties and any other communication preferences.
2.2 We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences. We do not knowingly collect personal information from or about children. If you believe your child has provided personal information to us, please contact us so that we can identify and delete your child’s personal information.
2.3 We may also collect your Personal Data from third parties, for example:
2.3.1 from searches of Credit Reference Agencies (CRAs) and Fraud Prevention Agencies (FPAs) of their records relating to you;
2.3.2 from public records (e.g. the electoral roll); and
2.3.3 from other third parties instructed by you in relation to the purchase of a UK property from us (for example your solicitor or mortgage broker).
3 How we use your Personal Data
3.1 We may use the information we collect about you in order to:
3.1.1 provide you with our services and information about our properties;
3.1.2 communicate with you by telephone, email, SMS, or post;
3.1.3 meet our legal, regulatory and contractual obligations, including verifying your identity for the purposes of preventing fraud and money laundering in the event that you wish to reserve one of our properties and passing your personal data to the relevant warranty provider in order that they can discharge their legal obligation to administer the warranty provided to you as a new homeowner;
3.1.4 provide you with updates you have requested including keeping track of specific developments and properties;
3.1.5 deliver marketing information to you about other products and services we offer that are similar to those that you have already purchased, requested or enquired about, unless you have opted out of receiving such communications (see under ‘Marketing’ below);
3.1.6 ensure that any content on the Sites is presented to you in the most effective manner for you, your requirements and your computer;
3.1.7 contact you for your views on our services and events and notify you occasionally about important changes or developments to the Sites or our services;
3.1.8 provide and improve customer service and support;
3.1.9 administer, monitor, support, improve and develop our Sites to enhance operational capabilities and for internal operations;
3.1.11 data, generally is kept for 6 years unless specified differently within this document.
4 Sharing your Personal Data
4.1 We may share your Personal Data with:
4.1.1 third parties which provide services for us where necessary for the delivery of our services or in connection with the purchase of one of our properties, for example:
a) contractors who undertake snagging work on our behalf;
b) collection agents who act on our behalf (for example to collect ground rent);
c) third parties who administer agreements on our behalf;
d) suppliers who provide or make provisions to provide services to, or in relation to your property;
e) managing agents appointed in accordance with the terms of your home purchase agreement;
f) one or more specified estate agents where we arrange the marketing of your existing home in a part exchange deal;
g) companies that perform services on our behalf, such as companies providing application management and technical infrastructure support.;
h) home warranty suppliers such as Checkmate and ICW Insurance Services Ltd in order to support the administration of the relevant warranty; and
i) in order to support the administration of your warranty policy where applicable;
4.1.2 other third parties with your consent and where you request we introduce you to them, for example mortgage brokers and other bodies;
4.1.3 law enforcement agencies or regulatory bodies where we are required to do so in order to comply with a regulatory or legal provision;
4.1.4 Credit Reference Agencies and Fraud Prevention Agencies;
4.1.5 our professional advisers;
4.1.6 companies within the Select group of companies (including those outside of the UK) either: a) for fulfilling those purposes set out in paragraph 3 above, including where it is necessary for us or another company within the Select group to meet our legal, regulatory and contractual obligations; or
b) where a company in the Select group is providing services for us where necessary for the delivery of our services or in connection with the purchase of one of our properties.
5 Our legal basis for using your Personal Data
5.1 Our use of your Personal Data as outlined above is subject to different legal bases for processing, including where necessary for:
5.1.1 The purposes of the performance of our contractual agreement with you or to take steps at your request prior to entering into an agreement with you. If you do not provide such information we will be unable to sell a property to you or provide other services, for example under the Home Change scheme;
5.1.2 Our legitimate interests, for example in managing and monitoring the operation of our Sites and for preventing fraud and for our services and offers to you (subject in this case to offering you an ability to opt out);
5.1.3 Compliance with a legal obligation, for example under consumer, anti-money laundering and data protection laws and making reports to regulatory authorities and to law enforcement agencies;
5.1.4 Where you have consented to do so, for example in relation to data we provide to home warranty providers for them to undertake customer satisfaction surveys.
5.2 Where our use of your data is not necessary for one of the purposes outlined above we may seek your consent to use it in a particular way (as outlined at 4.1.2 above). Where we ask for your consent you are free to refuse our use of the data for those purposes and you may withdraw your consent at any time by contacting us using the details set out below.
6 Credit Reference Agencies (CRAs) & Fraud Prevention Agencies (FPAs)
6.1 We may undertake searches of CRAs to verify your identity when you apply to reserve a property on one of our sites. We do this by submitting your Personal Data to them. We need to undertake such searches in accordance with anti-money laundering laws. If we undertake such a search for these purposes it will leave a ‘soft’ footprint on your credit file.
6.2 If you apply for a shared equity loan with us, we will undertake fuller searches with CRAs and FPAs which go beyond verification of your identity and enable us to review your credit history. We do this to assess creditworthiness and product suitability, manage your account, trace and recover debts and prevent criminal activity and this may leave a ‘hard’ footprint on your credit file.
6.3 Where you borrow from us under a shared equity loan, we may give details of your accounts and how you manage it to CRAs. If you borrow and do not repay in full and on time, in accordance with the terms of your loan, CRAs may record the outstanding debt. This information may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe. Records remain on file for 7 years after they are closed.
6.4 If you provide false or inaccurate information to us and fraud is identified, details will be passed to FPAs.
6.5 You can find more information about the various CRAs and the ways in which they use and share your personal information at http://www.experian.co.uk/crain/index.html
7.1 We may use CCTV recording on some of our premises, including site offices, for the purposes of security, crime prevention, health and safety and performance monitoring.
7.2 Wherever CCTV is in operation there will be appropriate signage.
7.3 We retain the images recorded only for so long as is necessary and will normally keep them for no longer than 12 months, unless there is a specific requirement to retain them longer. The images are recorded for our internal use and will only be shared with any third parties to protect the legitimate business interests of the Company or where required, for example for the purposes of the prevention, investigation or detection of crime.
8.1 A cookie is a small file which is sent to your browser by the Sites and which is then stored on your computer’s hard disk. When you browse the Sites cookies record your activity to enables us to keep a record of any personal data submitted. We use this to understand more about you and your preferences, to optimise your browsing experience and deliver content to you in the most appropriate way.
8.2 We may work with third parties to track and research, on our behalf, your usage and activity on the Sites. No personal information about you is shared, however in the course of conducting this research these third parties may place a unique “cookie” on your computer’s hard disk.
9 Links to other sites
9.2 If you follow a link to any other websites, they should have available their own privacy and/or cookie policies We do not accept any responsibility or liability for their operation or misuse of your personal data. You should review these policies before submitting any Personal Data to those websites.
10 How long we will keep your Personal Data
10.1 We will retain your Personal Data for up to six years from the end of our relationship with you (unless required by law to retain it longer)).
11 Transfer of your Personal Data
11.1 We share your personal data within the Select group of companies. This will involve transferring your data outside the UK.
11.2 Many of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK.
11.3 Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
11.3.1 A transfer of your personal data to a country that has been deemed to provide an adequate level of protection for personal data.
11.3.2 Where we are transferring your personal data to a company within the Select group that is outside of the UK, and/or where we use certain service providers outside of the UK, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.
11.4 Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
12.1 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
12.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
12.3 The information you supply to us will be held on our servers located in datacentres hosted by one or more approved providers. The internet is not a secure medium, however we take all reasonable care to prevent any unauthorised access to your Personal Data.
12.4 We take reasonable technical and organisational measures to protect Personal Data in our possession from loss, misuse and unauthorised access, disclosure, alteration and destruction.
12.5 Personal Data stored electronically is secured by us in the following ways:
12.5.1 Stored in a restricted access format;
12.5.2 Secured within networks that have certified firewalls in a multi-layered manner and which are penetration-tested at least annually;
12.5.3 Personal Data can only be accessed by staff on an as-needed basis, and;
12.5.4 All network and computer equipment is secured with passwords and servers are only physically and logically accessible by authorised personnel, systems and software.
13 Marketing & opting out
13.1 Unless you have opted out, we may contact you via email, SMS/text message or other electronic mail to inform you about other products or services provided by us that are similar to those that you have already agreed to, requested or enquired about.
13.2 You have the right at any time to ask us not to use your Personal Data for marketing purposes by notifying us using the contact details set out in the ‘Contact and Complaints’ section below.
14 Your rights
14.1 Your personal information is protected under data protection laws and you have a number of rights (see below) which you can seek to exercise. Please contact us in writing, by email or telephone using the details shown under ‘Contact and Complaints’ below if you wish to do so, or if you have any queries in relation to your rights. Please note these rights do not apply in all circumstances. We may need to verify your identity before we can respond to any request to exercise your rights.
14.2 Right of access – subject to certain exceptions, you have the right of access to your Personal Data that we hold.
14.3 Right to rectify your personal information – If you discover that the information we hold about you is inaccurate or incomplete, you have the right to have this information rectified (i.e. corrected).
14.4 Right to be forgotten – You may ask us to delete information we hold about you in certain circumstances. This right is not absolute and it may not be possible for us to delete the information we hold about you, for example, if we have an on-going contractual relationship or are required to retain information to comply with our legal obligations.
14.5 Right to restriction of processing – In some cases you may have the right to have the processing of your personal information restricted. For example, where you contest the accuracy of your personal information, its use may be restricted until the accuracy is verified.
14.6 Right to object to processing – You may object to the processing of your personal information when it is based upon our legitimate interests. You may also object to the processing of your personal information for the purposes of direct marketing and for the purposes of statistical analysis.
14.7 Right to data portability – You have the right to receive, move, copy or transfer your personal information to another controller when we are processing your personal information based on consent or on a contract and the processing is carried out by automated means.
15.2 As a result of improvements we make to our services, amendments to laws or regulation or developments in the technology or processes we use, we may change the way in which or the purposes for which we process such information. If we make any substantial changes in the way in which we use your Personal Data we will notify you by email or by post.
16 Contacts & complaints
16.1 If you have any questions about how we treat and protect your Personal Data and your privacy, if you have any comments, wish to seek to exercise any of your rights as outlined above or to complain, please contact firstname.lastname@example.org
16.2 You may also lodge a complaint with the Information Commissioner’s Office, Water Lane, Wilmslow, SK9 5AF telephone 0303 123 1113. www.ico.org.uk/