St Andrews Bureau Ltd (SAB) are committed to respecting and protecting your privacy.
SAB is a trading name of St Andrews Bureau Ltd whose registered number is 628433 and registered office is 18 Mill Road, Cambridge, CB1 2AD.
How do we collect personal information about you?
We obtain personal information about you that you provide to us through our website, emails, telephone conversations, documents you provide to us or when you visit one of our branches, for example when you:
- Enquire about specific properties for sale or for rent
- Apply to rent or buy a property
- Ask us to value, market or manage your property
- Register for our ‘new properties’ notifications
- Are a Freeholder or Leaseholder within a site managed by SAB
- Interact with us on our social media sites
We also obtain personal information relating to you using automated technical means when you visit our website.
What type of personal information is collected?
The information we collect from you is only relevant to the purpose of your contact with us at that point in time. For example, an initial enquiry should require a lesser amount of information than that needed from a tenant, landlord, vendor, buyer, leaseholder etc. This can include (but is not limited to) your name, address, email address, phone number, date of birth, financial details and any other information you choose to provide to us.
How do we use your personal information and how long do we retain it for?
We review our retention periods for personal data on a regular basis. We are legally required to hold some types of information for certain prescribed periods to fulfil our statutory obligations. Outside of specific statutory obligations, we will hold your personal data on our systems for as long as is necessary for the relevant purposes for which we use it, or in accordance with any retention periods set out in any relevant contract you hold with us.
Enquiring about properties to rent or buy
The information we take (but we are not limited to taking) is your name, address, telephone number, email address, property preference criteria and tenant type information (such as income level, employment status, number of family/ party members) for a maximum period of 6 months from the date of you providing this information to us. This information is retained and stored by SAB in Microsoft Outlook (and at times an Excel Spread Sheet) and is located on the Company Server (located in England) and is backed up daily in an encrypted format by Frog IT Services Ltd. We may use this data to provide you with information regarding similar goods and services to those you have already enquired about, or to ask you for feedback about our products or services (such as your opinion on a property viewed). Our legal basis for this use is our legitimate interest, namely the ongoing marketing of our goods or services with those who we have an existing relationship (or who have expressed an interest) in connection with our goods or services. Also, namely the need to obtain viewers feedback from properties viewed to provide landlord clients with a service they expect.
Applicants who apply to become tenants are required to provide personal information including current and previous address, phone numbers, email addresses, bank account details, next of kin address and contact details, employment details to include position, landlord contact details, personal referees contact details and next of kin details, however this is not an exhaustive list. Documents required are (but not limited to) photo ID such as passport or driving license, visa documents, proof of address and bank statements. This is provided by the applicant supplying the information and documents directly onto the GoodLord website where SAB have a private portal section for our clients and SAB therefore have password protected login access to view the information. There are also times where SAB may carry out the credit and reference process and will therefore collect this information directly. SAB retain ID documents as we are required to sign and verify these to comply with Right to Rent Legislation. These documents are saved to our own Company Server with restricted access to Company Directors and Office Managers only and which has a daily encrypted back up by Frog IT Services Ltd. This data is retained for a maximum of two years from the end of the tenancy. The legal basis for this is the requirement under the Right to Rent legislation to retain these document copies for two years.
All other data and documents relating to the tenancy remain to be stored within our SAB GoodLord (platform within the Cloud using Amazon Web Services based in Ireland) and within Proman (located on our company server), Jupix (located on our Company Server and is Cloud based with Jupix Servers located in England, Ireland and France). Our Company Server is located in England and has a daily encrypted back up by Frog IT Services Ltd. This data is retained for six years from the end of the tenancy (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a tenant to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (and our clients’ interests) and enable us to provide evidence in the event of a potential claim.
We may use tenant’s name, address, email address and telephone number to communicate with you in relation to arranging property access for us, the landlord, maintenance/safety check contractors and in relation to tenancy administration such as notices, contracts and legislation updates, as well as to respond to enquiries or requests from you, or from your landlord to pass onto you. Our legal basis for this use is our legitimate interest namely to carry out activities during the course of SAB business in response to customer enquiries and requests, as well as to comply with the contract that SAB has with the landlord to provide specific letting and property management services on their behalf.
If you instruct SAB to market/let or manage your property, a terms and conditions of business and a client/ property questionnaire are required for completion. The personal data may include (but are not limited to) name, postal address, bank details, insurance information and mortgage details. This document is saved to the Company Server and has a daily encrypted backed up by Frog IT Services Ltd. The data is stored within our data processing databases Proman (located on our company server), Jupix (Cloud based with Jupix Servers located in England, Ireland and France). Our Company Server is located in England and has a daily encrypted back up by Frog IT Services Ltd., also stored within our Company Server. The document completed and signed by you will be saved in electronic format to our Company Server only.
This data is stored for six years from the end of the landlord/ agent contract (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a tenant or landlord to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (or our clients’ interests) and enable us to provide evidence in the event of a potential claim.
Once a Vendor completes the formal request for SAB to market/ sell their property we require their full legal names, postal address of the property (and their personal postal address if this differs), telephone number, email address and date of birth. We also require their photo ID and a proof of address document to verify ID and to comply with Anti-Money Laundering Regulations. This data is stored within our data processing database Vebra Alto (which is located in the Cloud). This is password protected and is only accessible by staff dealing with property sales.
SAB will use the information held to contact you regarding the marketing and sales process until completion of the sale. This data is then stored for six years from the sale completion date (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a buyer or vendor to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (or our clients’ interests) and enable us to provide evidence in the event of a claim.
SAB will store the ID and proof of address documents on the Company Server which has a daily encrypted backed up by Frog IT Services Ltd. SAB will retain these documents for six years and the legal reason for this is to comply with Anti-Money Laundering regulations and to enable us to provide evidence in the event of a legal claim as explained above.
Once a potential buyer has an offer accepted we will obtain clarification on each buyer’s full legal name, postal address, telephone number, email address, mortgage details, proof of funds documents and ID. This data is stored within the data processing data base Vebra Alto which is stored on our Company Server which has a daily encrypted back up carried out by Frog IT Services Ltd.
SAB will use the information held to contact you regarding the purchase process until completion of the purchase. This data is then stored for six years from the completion date (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a buyer or vendor to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (or our clients’ interests) and enable us to provide evidence in the event of a potential claim.
We may use your name, address, telephone number and email address for carrying out our obligations arising from any contracts entered into by you and SAB (or by you and a client for which SAB acts as the agent), such as providing information, products and services relevant to a property purchase or sale. Our legal basis for this use is that it is necessary for the performance of a contract to which you are a party.
Estate Management (Leaseholders, Freeholders and Tenants)
Personal information for individual leaseholders and freeholders includes name, address, telephone number and email address which are stored by SAB within our data processing database Veco located on our Company Server which has daily encrypted backups by Frog IT Services Ltd. The data is retained for the duration of an individual’s ownership of the leasehold property or the duration of SAB’s contractual management of the building, whichever ends sooner. This data is then stored for six years from the completion date (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a buyer or vendor to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (or our clients’ interests) and enable us to provide evidence in the event of a potential claim.
We may use your name, address, telephone number and email address for carrying out our obligations arising from any contracts entered into by you and SAB (or by you and a client for which SAB acts as The Agent), such as providing information, products and services relevant to a lease hold property. Our legal basis for this use is that it is necessary for the performance of a contract to which you are a party.
Hard Copy Data
Hard copies of documents containing personal data as described in all sections above are retained in locked cabinets within the office and all offices are locked and secure outside of office hours or if unattended. SAB staff follow strict data protection policies to ensure that data remains private and out of site of third parties when in use. Such hard copies are shredded as soon as practically possible and within 24 hours of its redundant use.
We may use the information that we automatically collect using technical means through our website to:
- Administer our site and for troubleshooting, testing, research and statistical purposes. We use Google Analytics and Google Webmaster, third-party website monitoring tools. Our legal basis for this is our legitimate interest namely monitoring the use of our software and IT systems and improving our website.
We may analyse the personal information we collect directly from you and obtain using automated technical means to create a profile of your interests and preferences so that we can contact you with information relevant to you (if you have chosen to receive marketing communications from us).
Who has access to information?
We will not sell or rent your information to third parties.
We may pass your information to third party service providers, including but not limited to:
- Business partners, suppliers and sub-contractors working on our behalf for the purposes of completing tasks and providing services to you. The main purpose for example is maintenance contractors contacting tenants directly to arrange access to their home to attend to maintenance or safety checks. The details for these third-party contractors are provided by SAB to you at the time of the maintenance matter or routine safety check being addressed.
When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and otherwise use your information in accordance with applicable data protection law.
We may disclose your personal information to our insurers and /or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes.
In addition to the specific disclosures set out in this section, we may disclose your personal information where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person, or for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative out-of-court procedure.
We will not pass your information on to a third party for reasons not relevant to your specific requirements under the service that you expect SAB to provide to you.
In this section we have summarised the rights that you have under data protection law. Some of the rights are complex, applying only in certain circumstances and subject to certain exceptions, and in the interests of keeping this policy concise, not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.
You have the right:
- To object to us processing your personal information for marketing purposes. If you object, we will stop processing your personal information for this purpose. When we collect your data, you can choose whether you wish to receive marketing communications from us. If you wish to stop receiving marketing communications, you can opt out at any time by clicking an ‘unsubscribe’ link at the bottom of one of our emails.
- To access the information, we hold about you and certain information about our processing of it and your rights in relation to it.
- In certain circumstances, to obtain erasure of the personal information we hold about you, subject to certain exceptions.
- To rectification of the information we hold about you.
- In certain circumstances, to restrict our processing of your personal information or object to us processing it. If you object, we will stop processing your personal information unless certain exceptions apply.
- Where our legal basis for processing your personal information is your consent or the performance of a contract and we process it by automated means, to be provided with the personal information we hold about you in structured, commonly used and machine-readable format and to transmit the information to another controller.
- To not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly affecting you, subject to certain exceptions.
- Where our processing of your personal information is based on your consent, to withdraw that consent at any time. If you withdraw your consent, we will stop the relevant processing, but it will not affect the lawfulness of our processing before the withdrawal.
To exercise any of these rights, email us at Dataprotection@sab.co.uk or write to us at 18 Mill Road, Cambridge, CB1 2AD. In addition, you can exercise your right to object to direct marketing at any time by clicking an ‘unsubscribe’ link at the bottom of one of our emails.
If you consider that our processing of your personal information infringes data protection laws, you have the right to lodge a complaint to a supervisory authority responsible for data protection. You may do this in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. More information about lodging a complaint with the Information Commissioner’s Office (the relevant UK supervisory authority) can be found at https://ico.org.uk/concerns/.
Security precautions in place to protect your information
We take appropriate technical and organisational precautions to secure your personal information and prevent its loss, misuse or alteration. All information you provide to us is stored on our secure servers. We use privacy screens on our PC’s (where necessary) and all mobile devices to prevent screens from being visible to third parties. We operate a screen lock policy where all office PC’s screen lock after two minutes without use.
Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
The transmission of unencrypted (or inadequately encrypted) data over the internet is inherently insecure, and for this reason we cannot guarantee the security of data sent between us over the internet.
Cookies allow us to provide important site functionality, so you don’t have to re-enter lots of information. They also allow us to remember what links and pages you have been or viewed during a session. This helps us deliver a better, more personalised service to you.
It is possible to switch off cookies by setting your browser preferences. For more information on the Cookies we use, visit our Cookies Policy https://www.sab.co.uk/en/cookies
Links to other websites
Our website may contain links to other websites run by other organisations. We are not responsible for the privacy practices of those organisations or the content of their websites. You should read the privacy policies of these organisations before providing them with any personal information.
Transferring your information outside of European Economic Area (“EEA”)
SAB do not transfer data to countries outside the EEA.
If you use our services while you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services.
Data Breach Policy
A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
SAB will record any data breach, regardless of the severity or any requirement to report the breach to any relevant supervisory authority or the affected individual. Should a data breach occur which has a high risk of affecting the individual’s rights and freedoms, we will inform the individual without undue delay. We have an internal reporting procedure and investigation procedure in place. This system facilitates the decision making on the necessity to report breaches to individuals and/ or the relevant supervisory authority.
Review of this Policy
We keep this Policy under regular review. This Policy was last updated on 25th May 2018.
You can obtain further information about data protection laws by visiting the Information Commissioner's Office website at www.ico.org.uk.