Tenant Privacy Notice

This is a generic template of our Tenant Privacy Notice and will be superseded by a notice directly applicable to you, including details of your landlord.

This privacy notice is made by Waypoint Asset Management Limited for itself, its subsidiary companies and, to the extent applicable, for its clients, including the landlord named on your lease or other property occupancy agreement.

It applies to persons who occupy properties under tenancy agreements, leases, licences and other contracts agreed with the landlord (collectively referred to in this privacy notice as tenancy agreements).

Under the above EU legislation you have the right to be notified of:

• entities that control your personal data;
• the data those entities hold on you, where this is not already known to you;
• the purpose for which your personal data is processed
• the legal basis for the processing;
• the length of time for which your personal data will be retained;
• any other parties with whom your personal data is shared and the reasons for this;
• details of any transfer of your personal data overseas and, if so, the arrangements put in place to ensure its security;
• where personal data was obtained other than from you, where it was obtained;
• your rights as a data subject under the Regulation.

These details are set out below.

1. The entities that control your personal data (referred to in the legislation as “data controllers”) are:
   • your landlord; and
   • Waypoint Asset Management Limited (“Waypoint”), the asset manager employed by your landlord.

   The content of this privacy notice applies to both the above entities.

   Waypoint is also a “data processor” of your personal data.

2. The information held on you may include:
   • Full name
   • Proof of identity (including photographic), including identity card, passport, Government correspondence, utility bill
   • Contact details, including addresses, email, telephone numbers
   • Details of legal representatives
   • Banking details
   • Credit/debit card details
   • Guarantor details
   • Personal references
   • Financial information, including credit history
   • Bank statements
   • Digital images, if the property is protected by closed circuit television security facility

   Most of the data we hold on you has been supplied either directly by you or by your solicitor or other professional adviser. Data may also have been obtained from the other sources listed in paragraph 6, below.

3. We use your personal data solely for the purpose of administering your tenancy agreement, together with the statutory and other legal obligations that arise from it. The data processing activities we conduct (some of which we delegate to sub-processors, such as our property managers) may be summarised as:
   • management of your rent account;
   • procurement of property maintenance and repairs;
   • management of the service charge (if applicable) or individual repair and maintenance contributions applicable to your tenancy agreement;
   • management of the property, including ensuring tenancy conditions are fulfilled;
   • complying with relevant legislation and applicable regulations;
   • managing relevant insurance policies and claims;
   • internal statistical analysis on the overall performance of your landlord’s property portfolio.

   As your data is used solely for the purpose of administering your tenancy agreement (including supplying it to the third-party processors described under 4, below), this does not require any further specific consent from you.

   As is standard practice for property asset managers, we operate a number of information and communication systems to enable our business to operate efficiently, on which your data may be stored and processed. These systems are subject to a high level of security and integrity. Data is stored on secure facilities and we also hold secure copies of our databases for back-up and business continuity purposes. All files containing personal data are stored in a password protected database, accessible only by our staff specifically authorised for this purpose.

   We will retain your data for as long as we have an ongoing legal relationship with you, including any period for which there are outstanding balances on your account, and for a period of six years after this, to allow for any statutory or contract-related situations that may arise. Following the sixth anniversary of the end of our legal relationship with you, we will review the need for retaining your personal data and all items that no longer need to be retained will be destroyed. This assessment will be repeated on an annual basis whilst we retain any of your personal data.

4. We share your personal data with the following third-party data processors:
   • Property managers, surveyors, valuers and agents;
   • Insurance brokers and underwriters;
   • Solicitors;
   • Banks and lending institutions;
   • Repair and maintenance contractors;
   • Auditors;
   • Credit control and debt recovery agencies;
   • Local authorities;
   • Utility suppliers;
   • Emergency services, in response to emergency events;
   • Government departments and agencies as necessary.

   The data processors described above process your data solely for the purposes set out in paragraph 3, above. In the event that we sell the property that is subject to your tenancy agreement, we will supply your data to the new owner, who will thereafter be obliged to hold and process your data in accordance with the Regulation. In the event that you assign your tenancy agreement to a third party, the personal data contained on the tenancy agreement and related documents will thereby become available to the assignee.

   Your data will also be available to other legal entities within our group, as we use common technology systems.

   The amount of your personal data that we share with sub-processors will be no more than the minimum necessary to perform the relevant activity, and the sub-processors are obliged not to use your information other than for the purpose for which we have supplied it to them. They will not share your data with anyone else except other authorised sub-processors on the above list.

5. We do not transfer or store your data outside of the European Economic Area or outside the control of UK or EU regulations.
6. Besides the personal data that you have supplied to us, we may hold information on you obtained from the following sources:
   • prior landlords and their professional advisers (for example, where we have purchased the property subject to your tenancy agreement);
   • credit rating agencies;
   • your bank, where you have made payments by credit transfer;
   • your credit card company, where you have made payments using your credit card;
   • publicly available sources, such as the Land Registry.
7. Your rights as a data subject are as follows:
   1. The right to be informed
   2. The right of access
   3. The right to rectification
   4. The right to erasure
   5. The right to restrict processing
   6. The right to data portability
   7. The right to object
   8. Rights in relation to automated decision making and profiling.

   Our response to each of these rights is set out below.

   1. The right to be informed – Details of the ways in which we collect and use your personal data are set out under items 1-6, above.
   2. The right of access – You have the right to have copies of the personal data we hold on you. If you wish to do so, please contact us using the details set out at the end of this privacy notice. We will provide a copy of the personal data we hold as soon as is practicable and, in any case, within one month of your request. If you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.
   3. The right to rectification – You may require us to rectify inaccurate personal data, to complete it where it is incomplete or to correct it where it is misleading as to any matter of fact. Again, if you wish to do so, please contact us using the details set out at the end of this privacy notice. We will make the necessary adjustments as soon as is practicable and, in any case, within one month of your request. If, on review, we are satisfied that the personal data is accurate, we will notify you of this and of your rights to refer the matter to the Information Commissioner. Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.
   4. The right to erasure – You may request that your personal data is erased, provided the personal data is no longer necessary for the purpose for which it was collected and processed. As we hold your personal data solely for the administration of your tenancy agreement, this right will arise only following the end of the agreement (including any “holding over” period) and will be subject to the retention requirements set out in paragraph 3, above.
   5. The right to restrict processing – You can request that we restrict the processing of your personal data where:
      • you have contested the accuracy of your personal data;
      • we have unlawfully processed your data;
      • we no longer need your personal data, but you need us to keep (but not process) it in order to establish, exercise or defend a legal claim;
      • you have objected to our processing of your data and we are considering whether we have overriding legitimate grounds for doing so.
   6. The right to data portability – You have the right to require us to provide a copy of the personal data that (a) you have supplied to us and (b) which we process by automatic means, to enable you to reuse it for your own purposes. We will respond to such requested by supplying the data in a commonly usable, structured form as soon as practicable and, in any case within one month of your request. If you request it, we will do our best to supply the data directly to another organisation that you authorise to receive it.
   7. The right to object – You may object to the processing of your data where:
      • the basis for processing is the processor’s legitimate or performance of a task in the public interest, including profiling;
      • the processing is for direct marketing, including profiling;
      • the processing is for scientific/historical research and statistics.

      We do not believe that any of these apply to our processing of your data. However, if you believe that to be the case, please contact us using the details set out at the end of this privacy notice.

   8. Rights in relation to automated decision making and profiling – You have the right to object if you believe that your data is being processed in a manner which involves:
      • • automated decision making (i.e. without human involvement); including
        • profiling (automated processing to analyse or predict things about you – such as behaviour, health, personal preferences).

      We do not undertake such profiling activities.

If you wish to contact us in connection with the data subject rights set out above, please email: info@waypointam.co.uk.

For further information on the rights of data subject, visit the website of the Information Commissioner’s Office: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/