Privacy Policy – Applicants and Tenants

Your Personal Data: The purpose of this document is to outline how we collect and use the personal data we hold. This may be held on paper, electronically, or otherwise.

Who we are and what we need

Maldon Lettings Limited (11 High Street, Maldon, Essex, CM9 5PB), adheres to guidelines published in the General Data Protection Regulation (EU) 2016/679. We will be what is known as the ‘Controller’ of the personal data you provide to us. Initially we will only collect and hold basic information you provide to us directly over the telephone or if you make contact with us through a third party (i.e. Rightmove etc) or our website. This information may be held electronically or in paper format. This data will be destroyed within a period of 6 months and will not be shared with any third party unless you become a Tenant through Maldon Lettings Limited. If you do proceed to rent a property, the following will then apply to your data.

We may collect and hold the following information about you; name, addresses, phone numbers, email addresses, passport and financial information, employment status and details, date of birth, details of any benefits you may receive and Companies House details. This information may come directly from you, or from previous landlords, employers.

Why we need it

We need to know this information in order to undertake and perform our obligations and duties to you in accordance with the terms of our contract with you and fulfill our legal responsibilities on behalf of your landlord. We use three different legal bases to process your information. Basic information required to create, renew or terminate a tenancy agreement is processed on the basis of contractual necessity and without this information we would not be able to process a tenancy. Information required for referencing and due diligence checks is processed on the basis of legitimate interest as are purposes consistent with the proper performance of our business; we do take into consideration the balance between our interests and yours. Details regarding ‘right to rent’ if applicable are processed under the basis of legal obligation. We will not collect any data from you that we do not need in order to provide and oversee your tenancy.

What we do with it & who we share it with

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information is located on servers within the European Union/USA (any transfer of data to servers based in the USA is Privacy Shield compliant). The remote server connection is encrypted and the system protected against direct and anti-virus type attacks.

All companies used to facilitate IT hosting comply with GDPR. No 3rd parties have access to your personal data unless the law allows them to do so. We do not sell your information or use it for marketing purposes. No automated decision making regarding your data takes place.

In order to provide you with the service you require there may be occasions when your information is shared with third parties acting for us or for purposes approved by you. This may include in the creation, renewal or termination of the tenancy, your information will be disclosed to the relevant local authority, tenancy deposit scheme administrator, service/utility provider, freeholder, facilities manager, managing agents or any other relevant person or organisation in connection with this. If we are not acting as managing agent for your property then your information will be passed on directly to your Landlord or someone acting on their behalf as managing agent. Basic information may also be given to block management companies when you live in a serviced area (i.e. flats/apartments), this is mainly for contact information purposes.

Basic contact information may also be shared with those who carry out work on our behalf such as plumbers, electricians and other maintenance contractors. We share this information so you are directly able to make a mutually convenient time for work to be done. We will always confirm the details of the contractor with you and confirm that you are happy for us to share your details; we will do this verbally, electronically or in writing before sharing the information.

How long we keep it

We will keep and process your personal data for as long as necessary to comply with its legal obligations, resolve disputes, act as evidence of claims and relationships, and to enforce its agreements or longer when we have a legitimate reason to do so. After that, we delete or dispose of the information securely.

What are your rights?

If you wish to raise a complaint regarding how we have handled your personal data, you can contact our office on the details above. If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner’s Office (ICO). Their contact number is 0303 123 1113 and their address is Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF.

You have other rights under data protection law that you can exercise against us but these do not apply in all circumstances. You can exercise those rights free of charge except in very limited circumstances, which will be explained to you if relevant. You may be asked to provide proof of identity when making these requests. Here are short descriptions of your rights: Right of access – you have a right to request access to your personal data and supplementary information. Right of rectification – in certain circumstances you have a right to ask for your personal data to be rectified if it is inaccurate or incomplete.

Right to erasure – in certain circumstances, you can ask to have your personal data erased. It is unlikely to be possible to accept your request if, for example, we have a legal duty to retain or process your information. Right to restrict processing – if certain conditions apply, you have a right to restrict the processing of your information. This means we could hold your data but would be unable to use it for any purpose. Right of portability – in certain circumstances, you have the right to move, copy or transfer your personal data to another organisation or to yourself in a commonly used electronic format. This right is only relevant if personal data is being processed based on consent (or performance of a contract) and is done in an automated fashion. Right to object – in certain circumstances, you have the right to object to certain types of processing of your personal data when it is based on legitimate interests, when it is processed for direct marketing or when it is processed for the purposes of statistics. Rights regarding automated decision making – You have the right not to be subject to a decision based solely on automated processing which has legal implications or significantly affects you.

What happens in the event of a Data Breach?

In the case of a data breach, we shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO and if the personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Data Subject.

Any questions relating to this notice and our privacy practices should be sent to our offices at 11 High Street, Maldon, Essex, CM9 5PB