Privacy Notice - Croft Rentals

This Privacy Notice aims to give you information on how we collect and process personal data, including any data you may provide when you apply for a tenancy, accept the offer of a tenancy, or otherwise interact with us.

For the purposes of data protection legislation, we are the data controller of your personal data. We are registered with the Information Commissioners Office in the UK with reference number ZA139296.

It is important that you read this Privacy Notice together with any other Privacy Notice, Cookie Policy, or Fair Processing Notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are aware of how and why we are using your data. This Privacy Notice supplements any other such notices and is not intended to override them. We place a copy of this Privacy Notice into our tenancy agreements and if the Privacy Notice changes during the tenancy, we supply our tenants with an updated copy via email or other means. Please note that this document frequently refers to data as information for readability.

The personal information we collect and use

If you apply to view a property that we are letting, we will usually have your name, email address, and telephone number. We may also have your postal address, and information about the people with whom you intend to live.

If you apply for a tenancy with us, we will additionally collect information about:

Your housing history
Your employment (or study if you are a student), income, and other relevant financial information
References, including personal referees
Next of kin or other emergency contacts
Any additional information you supply in order to evidence your ability to afford the rental payments for the property, or to support your application in any other way

Our application form includes information about how we use the data.

We sometimes use external agencies to help us with our referencing process before we agree to grant a tenancy to an applicant. If we do this, we may ask you to provide the above, or other, information to the external agency in order that they can complete the referencing. Such agencies will have their own Privacy Notices and data protection registrations. They will need to agree with you to pass the information you give them on to us.

Once we receive such information, it will become subject to this Privacy Notice and our own data protection policies and procedures.

If we grant a tenancy to you, we will collect additional information from you during the course of the tenancy. It is not possible to list here every item of data that will be collected, but it may include (and not be limited to):

Changes to the nature of your household
Information related to repairs and maintenance issues

Any additional data collected will become subject to this or any subsequently published Privacy Notice.

If you interact with us in other ways (that is, you are not an applicant or tenant), we will usually hold your contact information and may – if you give them to us - hold your bank account details.

How we use your personal information

We use information to enable us to allow viewings of available properties, to assess applications for tenancies, to create new tenancies, and to manage tenancies on a day-to-day basis. The legal basis under the General Data Protection Regulation for processing your information is that of contract. That is, if you are an applicant or tenant, we use your information to be able to assess whether to enter into a tenancy agreement (contract), to create any agreed tenancy (contract), and to perform our obligations as landlords as set out in our tenancy agreements (contracts) and the law that relates to those agreements. If you interact with us in other ways, we use information to enable any contract that we have with you to be fulfilled.

We do not use your information for marketing purposes.

Sharing your personal information

We need to share your data with third parties as an essential part of creating and fulfilling the contractual obligations that we have to each other. We only share data that is necessary to achieve the purpose. If we hold your data to view a property where an application is not made, your data will not be shared.

If you are an applicant or tenant, the parties with whom we may share your data include:

Your referees
Referencing agencies
Our agents
Our deposit protection scheme
Our repair/maintenance providers
Our insurers
Local authority
Utilities providers
Your next of kin or other emergency contacts
Any guarantors
Your joint tenants, or members of your household
Tracing agencies
Courts
Our legal and financial representatives

If you supply goods or services to us, we may share your contact information with our tenants or agents.

We will not share your personal information for any other purpose.

How long your personal information will be kept

a. Information obtained to view a property where a tenancy application was not made

We will delete your personal information immediately.

b. Information obtained during an application for a tenancy where a tenancy was not created

We will delete your personal information within twelve months of the decision not to proceed.

c. Information obtained to create and manage a tenancy agreement with you

We will hold onto your information for as long as you have your tenancy, or as long as is needed to be able to manage that tenancy and any consequent contractual obligations. Basic information about the tenancy, and our income and expenditure related to the tenancy, will always be retained for 6 years after the end of the tenancy agreement or the fulfilment of all contractual obligations (whichever is longer).

If reasonably necessary or required to meet legal or regulatory requirements, to resolve disputes, to prevent fraud or abuse, or to enforce our contractual obligations, we may also keep hold of other types of information as required, even after you have ended your tenancy, or it is no longer needed to provide the services to you.

d. Information obtained for other purposes

Basic information will be retained for 6 years after the end of fulfilment of all contractual obligations. If reasonably necessary or required to meet legal or regulatory requirements, to resolve disputes, or to prevent fraud or abuse, we may also keep hold of some of your information as required to meet those purposes.

Where your data are processed and stored

We design, build, and run our systems to make sure that your data are as safe as possible at all stages of processing and storage. Our offices and our day-to-day work are based solely in the United Kingdom. All data are stored in the United Kingdom although we do use products from major tech and software providers that may result in some data being stored or processed in accordance with their own Privacy Notices. We may provide further information on request. Furthermore, using any electronic means to collect and process personal data necessarily involves the transmission of data on an international basis, and this means for instance that data that passes between us electronically may be in transit outside of the United Kingdom. By communicating electronically with us, you acknowledge and agree to our processing of personal data in this way.

Control over your information

Under the General Data Protection Regulation, you have several important rights available to you for free. In summary, those include rights to:

be informed about how your personal information is being used
access the personal information we hold about you
request that we transfer elements of your data to another service provider
request us to correct any mistakes in your information which we hold
request the erasure of personal information concerning you in certain situations
receive the personal information concerning you which you have provided to us, in a structured format
stop any direct marketing
object to processing of your personal data

For further information on each of these rights, including the circumstances in which they apply, see the published guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.

If you would like to exercise any of these rights, please:

contact us in writing;
let us have enough information to identify you;
let us have proof of your identity and address (e.g. a copy of your driving licence or passport and a recent utility or credit card bill); and
let us know the information to which your request relates.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made many requests. In this case, we will notify you and keep you updated.

Keeping your personal information secure

We have appropriate security measures in place to prevent your information from being accidentally lost or used or accessed in an unauthorised way. The only people being given access to your personal information are those who have a genuine business need to know it.

We have policies and procedures in place to ensure that those processing your information will do so only in an authorised manner, and all are subject to a duty of confidentiality.

If there is a suspected data security breach, we will notify you and any applicable regulator where we are legally required to do so.

How to complain

If you have any concerns about how we use or manage your personal data, please get in touch in writing or by phone. Writing is usually helpful for everyone, as it creates a data trail of what was said.

We will acknowledge your complaint and will outline our complaints process to you. If you are not satisfied with how we subsequently deal with your complaint, you have the right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted via their website.

Changes to this Privacy Notice

This Privacy Notice was first published on 24 May 2018 and last updated with changes on 23 January 2024. It was last reviewed on 23 January 2024 and is due for next review no later than January 2025.

Any changes we make to this notice will be posted on our website (www.croftrentals.co.uk) and information emailed to current tenants within one working day.