O&C Lettings Privacy Policy

Context and overview

O&C Lettings hereinafter referred to as OCL needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact. This policy describes how this personal data will be collected, handled and stored to meet the company’s data protection standards and to comply with the law.

Why this policy exists

This privacy policy ensures OCL:

• Complies with data protection law and follow good practice
• Protects the rights of staff, customers and partners
• Is open about how it stores and processes individuals’ data
• Protects itself from the risks of a data breach

Data protection law

The General Data Protection Regulation (GDPR), is an EU Regulation intended to strengthen and unify data protection for all individuals within the European Union. It applies to ‘personal data’ and is step on from The Data Protection Act 1998 (DPA) and describes how organisations – including OCL – must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The Data Protection Act is underpinned by eight important principles. These say that personal data must:

1. Be processed fairly and lawfully
2. Be obtained only for specific, lawful purposes
3. Be adequate, relevant and not excessive
4. Be accurate and kept up to date
5. Not be held for any longer than necessary
6. Processed in accordance with the rights of data subjects
7. Be protected in appropriate ways
8. Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection

Further information about GDPR

For further information about General Data Protection Regulations (GDPR) please visit https://ico.org.uk.

Policy scope

This policy applies to:

• The head office and all branches of OCL
• All staff, volunteers, contractors, suppliers and other people working on behalf of OCL
• The OCL website, emarketing and social media

What personal information do we collect?

Information will generally be collected directly via the use of any of our standard forms, over the internet, via email or through a telephone conversation with you. We may also collect personal information through our affiliates or suppliers. If you wish to rent a residential or commercial property through us, we will typically collect the following information:

• Full names of individuals
• Gender
• Nationality
• Maiden names
• Next of kin
• Marital status
• Dependents’ names and DOBs
• National Insurance number
• Passport number
• Postal/contact addresses
• Email addresses
• Telephone numbers
• Residential status
• Current and previous landlord details
• Solicitors details
• Accountant details
• Salary
• Bank details and statements
• Details of savings and pensions
• Proof of deposit
• Proof of funding
• plus any other information relating to individuals

If you are a tenant renting under the ‘Right to Rent’ scheme, we will collect details of your Biometric residence card, your immigration status document and/or your birth certificate to carry out our required checks under this scheme. In order to process an application to rent a property, we will provide details to third parties to undertake necessary credit and personal referencing.

What is the legal basis of our data processing?

Under data protection legislation we are only permitted to use your personal information if we have a legal basis for doing so. We rely on the following legal bases to use your information:

• Visitors to our websites;
• For employment-related purposes;
• Where we need information to perform the contract we have entered into with you;
• Where we need to comply with a legal obligation;
• Where the processing is necessary for us to carry out activities for which it is in OCL’s legitimate interests (or those of a third party) to do so and provided that your interests and fundamental rights do not override those interests, including:
  • Processing that is necessary for us to promote our business, brands and products and measure the reach and effectiveness of our campaigns – this will include sending you marketing information from time to time after you have engaged us to provide services or received services from us either which may be similar and of interest to you, or where you have expressly indicated that you would like to receive such information. You have the right to opt out of receiving this information at any time.
  • Processing that is necessary to improve our knowledge of the business sectors in which OCL operate – this will include undertaking market analysis and research so that we better understand trends in the property sector and provide better knowledge along with more tailored and relevant services for our customers in the future.
  • Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively – this will include: verifying the accuracy of information that we hold about you and create a better understanding of you as a customer; processing for administrative efficiency purposes such as where we outsource certain administrative functions to third parties who specialise in such services; processing for network and information security purposes (i.e. in order for us to take steps to protect your information against loss, damage, theft or unauthorised access), or to comply with a request from you in connection with the exercise of any of your rights outlined below.
• Complainants and other individuals in relation to a data protection or freedom of information complaint or enquiry;
• People who use our services (i.e. who subscribe to our mailing lists or request a publication from us);
• People who notify under the Data Protection Act; and
• Job applicants and our current and former employees.

What happens if you do not provide information that we request?

We need some of your personal information to perform the services you have requested from us.

We also need some information so that we can comply with our legal obligations. For example, we may need identity documents from you to meet our obligations to prevent fraud and money laundering.

If you do not provide the information required for these purposes, we will not be able to perform our contract with you and may not be able to provide services to you or continue to provide certain services to you. We will explain when this is the case at the point where we collect information from you.

Visitors to our website

If we need to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Use of cookies

The OCL website uses cookies, which is standard practice on most websites. Without them we cannot deliver a high quality online experience.

Some cookies collect anonymous information about your visit eg Google Analytics, which we use for monitoring purposes and to help us with future developments by understanding how our visitors use our website.

By using the OCL website you consent to cookies being used. If you do not consent you must disable cookies via your browser but accept that your visit will be restricted to only browsing the public pages, and certain features will not work correctly.

For more information about cookies together with a full list of cookies used on our website, please visit www.oandclettings.co.uk/cookies.

Security and performance

OCL uses a third-party service to help maintain the security and performance of our websites. Appropriate technologies are used to safeguard your data, and rigorous security standards are maintained to prevent any unauthorised access to it.

External links

Our website contains external links to other websites. This privacy policy only applies to this website. We therefore advise visitors to read the privacy statement of any site they move to, especially those which collect personal information. OCL does not accept responsibility, or liability, for the consequential actions of a user choosing to access any third party website listed.

E-marketing

We use a third-party provider, Mailchimp, to deliver our e-marketing. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-marketing. For more information, please see Mailchimps’ privacy notice.

We keep the personal details of anyone receiving our email newsletter for as long as they are subscribed. Once a customer chooses to unsubscribe, their details are deleted with six months. You can unsubscribe by clicking on the link at the bottom of every email newsletter. Alternatively email dpo@oandclettings.co.uk.

People who make a complaint to us

When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for six years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

How long do we keep your personal information

The period for which we will keep your personal information will depend on the type of service you have requested from us. The retention period may be longer than the period for which we are providing services to you where we have statutory or regulatory obligations to retain personal information for a longer period, or where we may need to retain the information in case of a legal claim.

Data accuracy

OCL takes all reasonable steps to ensure data is kept accurate and up to date. If you believe that the information we hold about you is out of date or incorrect, please email dpo@oandclettings.co.uk.

Anti-Money Laundering

To help you with a property related service, we must comply with certain regulations for example the “Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (referred to as “the Regulations).” OCL is required to obtain certain information from you to comply with these regulations. The information provided will only be used by OCL in relation to comply with the Regulations and will not be shared with any other party outside of the companies wholly owned by OCL unless we are required to do so under law.

If you decide to enter in to a business relationship with OCL or any wholly owned subsidiary, to comply with certain regulations. We will require two separate identification documents, one primary and one secondary document, even if it appears on both lists. The information may be required at various stages of the process depending whether you are purchasing or selling:

Proof of identity – primary documents:

• Valid Passport with MRZ
• Valid full UK photo driving licence
• Valid full UK Driving licence (non-photo, paper) issued before 1998
• Valid EU/EEA/Switzerland photo driving licence
• Valid EU/EEA/Switzerland national Identity Card
• Valid UK Armed Forces ID Card
• Valid UK Biometric Residence Permit (copy of both sides)
• Valid Blue disabled drivers pass (with photo)
• Valid Freedom Pass
• Valid Local Authority Bus pass
• Department for Works & Pensions letter confirming pension details including National Insurance Number dated within the last 12 months

Proof of residence (home) – secondary documents:

• Valid full UK photo driving licence
• Valid full UK Driving licence (Non-photo, paper) issued before 1998
• Local authority council tax bill (dated within the last 12 months)
• UK Bank / Building societies statements/bills showing activity, dated within the last 6 months including account number and sort code (internet printed acceptable)
• UK mortgage statement dated within the last 12 months (internet printed acceptable)
• Utility bill dated within the last 6 months including – electricity bill (with MPAN number), landline, gas, satellite TV, water (internet printed acceptable) (not mobile phone bills)
• Her Majesty’s Revenue and Customs (HMRC) Inland Revenue (IR) Coding / assessment / statement (dated within the last 12 months) with National Insurance number
• Department for Works & Pensions letter confirming pension details and National Insurance Number (dated within the last 12 months)

Your rights in relation to your personal information

You have a number of rights in relation to your personal information, these include the right to:

• Be informed about how we use your personal information;
• Obtain access to your personal information that we hold;
• Request that your personal information is corrected if you believe it is incorrect, incomplete or inaccurate;
• Request that we erase your personal information in the following circumstances:
  • If OCL is continuing to process personal information beyond the period when it is necessary to do so for the purpose for which it was originally collected;
  • If OCL is relying on consent as the legal basis for processing and you withdraw consent:
  • If OCL is relying on legitimate interests as the legal basis for processing and you object to this processing and there is no overriding compelling ground which enables us to continue with the processing;
  • If the personal information has been processed unlawfully (i.e. in breach of the requirements of the data protection legislation);
  • If it is necessary to delete the personal information to comply with a legal obligation.
• Ask us to restrict our data processing activities where you consider that:
  • Personal information is inaccurate;
  • Our processing of your personal information is unlawful;
  • Where we no longer need the personal information, but you require us to keep it to enable you to establish, exercise or defend a legal claim;
  • Where you have raised an objection to our use of your personal information.
• Request a copy of certain personal information that you have provided to us in a commonly used electronic format. This right relates to personal information that you have provided to us that we need in order to perform our agreement with you and personal information where we are relying on consent to process your personal information.
• Object to our processing of your personal information where we are relying on legitimate interests or exercise of a public interest task to make the processing lawful. If you raise an objection we will carry out an assessment to determine whether we have an overriding legitimate ground which entitles us to continue to process your personal information.
• Not be subject to wholly automated decisions which produce legal effects, or which could have a similarly significant effect on you.

For any of the above request you can contact us at any time by writing to us or by emailing dpo@oandclettings.co.uk.

Disclosing data for other reasons

In certain circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement agencies without the consent of the data subject. Under these circumstances, OCL will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

Data Protection Officer

You can contact our data protection officer by emailing dpo@oandclettings.co.uk.