Shaftesbury Capital is committed to protecting the privacy and security of your personal data.
This privacy notice (“Notice”) describes how we collect and use personal data in accordance with the General Data Protection Regulation (“GDPR”).
- WHAT THIS PRIVACY NOTICE COVERS
- WHAT PERSONAL DATA WE COLLECT ABOUT YOU
- HOW WE COLLECT YOUR PERSONAL DATA
- WHY WE PROCESS PERSONAL DATA
- TRANSFERS OUTSIDE OF THE UK OR THE EEA
- WHEN WE MAY DISCLOSE YOUR PERSONAL DATA
- PROTECTING YOUR PERSONAL DATA
- YOUR RIGHTS IN CONNECTION WITH THE PERSONAL DATA WE COLLECT
- HOW LONG WE HOLD YOUR PERSONAL DATA FOR
- HOW WE UPDATE OR CHANGE THIS NOTICE
- HOW YOU CAN CONTACT US
1.1 This Notice is given by Shaftesbury Capital PLC on behalf of itself, its subsidiaries and its joint venture companies (“Shaftesbury Capital”). We act as a data controller for the personal data we collect during the course of our engagement with you.
1.2 This means that we determine the purposes for and manner in which we (or our processors) process your personal data.
1.3 Our registered office is at Regal House, 14 James Street, London, WC2E 8BU. We can be contacted by post at this address or by email at [email protected]. Please mark any correspondence for the attention of the Company Secretary.
2.1 This Notice relates to range of data processing activities undertaken by Shaftesbury Capital. To help you navigate this Notice we have extracted the key information applicable to you depending on the nature of your relationship with us. Please click on the below tabs to access the relevant summary. Full details of our processing are set out in the rest of the Notice.
2.2 If you are residential tenant on the basis of an AST, or a guarantor of any such residential tenancy, please refer to the standalone privacy notice specific to your situation. You will have been provided with a copy of the privacy notice relevant to you via your letting agent or Shaftesbury Capital contact, but if you'd like another copy of the Residential Tenant Privacy Notice then please contact the relevant letting agent, or Shaftesbury Capital contact.
3.1. This Notice covers:
a) what personal data we collect about you;
b) how we collect personal data;
c) why we process personal data;
d) the transfer of any personal data outside the UK and/or the EEA;
e) when we may disclose your personal data;
f) protecting your personal data;
g) your rights in connection with the personal data we collect;
h) how long we hold your personal data for;
i) how we update or change this notice; and
j) how you can contact us.
3.2. We issue other privacy notices (alongside this Notice) which relate to specific situations relationships – please refer to the following notices where applicable:
a) Residential Tenant Privacy Notice – please see reference above
b) Employee Privacy Notice – please request a copy from the Head of HR.
4.1. The types of personal data which we collect about you will vary according to the nature of your relationship with us. Please see the relevant section at part 2 of this notice. We may also process other categories of personal data from time to time, as specifically notified or as may reasonably be anticipated as part of the operation of our business and the management of our property portfolio.
4.2. Under the GDPR certain types of information are considered to be more sensitive and so in need of more protection. These “special categories of personal data” are information about your race, ethnic origin, political opinions, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, or sexual orientation, and may also include information relating to criminal convictions and allegations. Where you provide us with this information, we are required to establish an additional lawful basis for holding this information, which will usually be your explicit consent or our compliance with a legal or regulatory obligation. We may process such information in the following circumstances:
a) As a visitor to our premises, we may process health related inormation such dietary requirements and accident details.
b) In very rare instances we will process special categories of personal data in order to prevent or detect unlawful acts in connection with a tenancy or on publicly accessible areas of our portfolio (e.g. fraud or antisocial behaviour), which in some circumstances will involve disclosures to the police or other regulatory/legal authorities.
4.3. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during the course of your relationship with us.
5.1. The way in which we collect your personal data will vary according to the nature of your relationship with us. Please see the relevant section at part 2 of this Notice. We may also collect personal data from other sources from time to time, as specifically notified or as may reasonably be anticipated as part of the operation of our business and the management of our property portfolio.
6.1. The personal data we collect and process will vary according to the nature of your relationship with us. Please see the relevant section at part 2 of this Notice.
6.2. We may also process personal data for the following purposes:
a) internal business and regulatory requirements, including valuation of the property portfolio in line with accounting standards, undertaking audits, archiving etc;
b) exercising and/or defending our legal rights; and
c) we may also process personal data for other purposes from time to time, as specifically notified or as may reasonably be anticipated as part of the operation of our business and the management of our property portfolio.
6.3. Whenever we process your personal data we do so on the basis of a lawful condition of processing. The applicable legal basis will vary according to the nature of your relationship with us. Please see the relevant section at part 2 of this Notice. In addition, we may also undertake processing: where necessary for compliance with a legal obligation to which Shaftesbury Capital is subject (for example, undertaking mandatory background checks or to comply with court orders); where you provide your consent to the processing of your personal data for certain specific purposes, including where based on additional information made available at the time consent is provided; where we need to protect the vital interests for you or someone else, or where it is necessary to do so in the public interest; and in other circumstances where necessary for our legitimate interests (or those of a third party).
6.4. Where we process your personal data as necessary for our legitimate interests (or those of a third party), we do so only provided it is carried out in a way that is proportionate and respects your privacy rights.
6.5. The special categories of personal data that may be processed by Shaftesbury Capital are set out in paragraph 4.2 of this Notice. Where we process special categories of data it will be justified by a condition set out at paragraph 6.2 above and also by one of the following additional conditions:
a) based on your explicit consent;
b) in accordance with paragraph 10 of Schedule 1 of the UK’s Data Protection Act 2018 – for example where we seek to prevent or detect unlawful acts (e.g. fraud or antisocial behaviour);
c) where necessary to protect the vital interests for you or someone else where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency), or where it is necessary to do in the public interest; or
d) the processing is otherwise permitted by law, such as in relation to legal claims.
6.6. We will only use your personal data for the purpose for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
7.1. Several of our external third parties are based outside the UK and/or the European Economic Area (“EEA”), in particular South Africa, so their processing of your personal data will involve a transfer of data outside the UK and/or EEA.
7.2. Whenever we transfer your personal data out of the UK and/or EEA, we ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards have been implemented. If you would like further information on the specific safeguards used by us when transferring your personal data out of the UK and/or EEA, please contact the Company Secretary.
8.1. The ways in which we disclose your personal data will vary according to the nature of your relationship with us. Please see the relevant section at part 2 of this Notice. In addition, we may also disclose your personal data to the following recipients:
a) to service providers to whom we outsource certain functions of our business. For example, we have service providers such marketing agencies who provide marketing support or IT service providers who provide / support IT applications or systems, which means that your personal data will be hosted on their servers, but under our control and direction. We require all our service providers to respect the confidentiality and security of personal data;
b) to a prospective buyer in the event of a sale, merger or restructuring of any part of our business;
c) to a prospective buyer and their advisors in the event of a sale, merger or restructuring of any part of our business;
d) to any company within the Shaftesbury Capital group of companies and our joint venture companies); or
e) to any regulatory agency or enforcement body (e.g. the police or intelligence services) or court where we reasonably believe that we are required to do so by applicable law or regulation or by any court order or at their request where it is legal to do so.
9.1. We have put in place technical and organisational measures to protect the security of your information. Third parties will only process your personal data on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
9.2. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
10.1. Under certain circumstances, you have rights under data protection laws in relation to your personal data. The rights available to you depend on our reason for processing your information.
10.2. You have the right to request from us access to and rectification or erasure of personal data or to restriction of processing concerning you or to object to our processing of the data as well as the right to data portability.
10.3. If we are relying on your consent to process data (for example you have requested further information from us or marketing materials), you may withdraw your consent at any time by notice to us.
10.4. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with the request in these circumstances.
10.5. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response
10.6. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
11.1. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements including applicable statutory limitation periods.
11.2. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a tenant, we will retain and securely destroy your personal data in accordance with our data retention policy, although we will retain the signed original agreement and supporting documentation indefinitely.
12.1. We reserve the right to update this Notice at any time and we will make the revised Notice publicly available. We may also notify you in other ways from time to time about the processing of your personal data.
12.2. This notice was last updated on 6 March 2023.
13.1. If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact the Company Secretary.
13.2. If you have any questions about this Notice or any queries in relation to how we process your personal data, please contact the Company Secretary, either by post at Shaftesbury Capital PLC, Regal House, 14 James Street, London, WC2R 8BU or by email at [email protected]
13.3. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.