Privacy Policy and GDPR

Our commitment

Northpoint Property Ltd takes your data protection seriously. We want you to know how we look after and protect the data you provide us, send to us and that we hold on you.

The data that we hold on you is data you have provided to us in the course of delivering services to you and what we collect during our referencing and credit check process.

One tenant example: your application form that you provided us with when you applied for a room. One landlord example: the management agreement that you signed to give us authority to manage your property.

We will never sell your data.

In order to provide our services to you, we use a number of third-party sub-processors who may have access to your data. We want to be clear and transparent with you about the sub-processors we use and what we have done to ensure they take your data protection as seriously as we do.

How we use personal information

We will not use your personal information unless we have first told you how we will use it or it is obvious how we will use it. As a property company we need to collect and use your personal information for:

• Processing applications and referencing prospective tenants
• Managing tenancies, maintenance jobs, certificates, move-ins and move-outs
• Keeping a record of our relationship with you
• Keeping a record of if you have opted out of receiving marketing emails
• Keeping a record of individuals and organisations whose applications have been declined or where we have terminated a contract
• Carrying out surveys and improving our service
• Understanding the use of our website including traffic data, location data and weblogs
• Employee and contractor administration

Legal basis for processing personal information

The law allows us to collect and use personal data if it is necessary for our legitimate business interest and so long as its use is fair, balanced and does not unduly impact your rights. In many situations, the best approach is to process personal data because of our contract with you and our legitimate interests as a lettings and property management company, rather than consent. We will ask for your consent to send you marketing emails. You can withdraw consent at any time.

We do not expect to receive or process sensitive personal data. In extreme situations, we may share your personal details with the emergency services if we believe it is in your "vital interests" to do so - for example, if one of our tenants becomes ill. We may also share your personal information where we are compelled by law to do so.

How we collect personal information

We collect personal information from you directly through our website, over the phone, through application forms and via email communication with you. We may collect information about the software on your device and your IP address to improve your interaction with our website. We may use cookies - see our cookies policy for more details.

Personal information that we collect

The type of information we collect and how we use it depends on why you are providing it.

For tenants

• The completed application form that you filled out and signed
• Accompanying documentation required as part of the application and referencing process (for example ID such as passport or driving licence, bank statements, proof of income)
• Credit check, reference checks and right-to-rent checks
• All email, text and in-app communications between us, including messages held in our tenant management platform, COHO

For guarantors

• Accompanying documentation required as part of the application and referencing process (ID, bank statements, proof of income)
• Credit check and reference checks
• Your contact details including email, postal address and phone numbers
• All email, text and in-app communications between us

For landlords

• Accompanying documentation required as part of setting up and running the management agreement (for example ID such as passport or driving licence)
• Land Registry checks
• Mortgage lender and insurance details where relevant
• All email and messaging communications between us
• Your contact details including email, postal address and phone numbers

Where we store your data

Google Drive (Google Workspace)

We use Google Drive, part of Google Workspace, to store documents and files relating to your tenancy or property. All of this data is encrypted in transit and at rest and stored on Google's secure servers. See Google's privacy information at policies.google.com/privacy.

Google Workspace email (Gmail)

We use Google Workspace to manage our email. Any correspondence between us is held within Gmail on Google's secure infrastructure. Google may transfer data outside of the UK/EEA but only in a manner which protects your data and meets the requirements of the UK GDPR.

COHO

We use COHO, a property and tenant management platform, to run our HMOs. On this system we store data relating to tenants and tenancies including contact details, tenancy documents and in-app messages. All data is held on COHO's secure servers. See COHO's privacy information at coho.life/privacy-policy.

Third parties and sub-processors

In the course of running our business we may also share limited personal data with the following categories of provider, each of which is subject to written agreements protecting your data:

• Bookkeeping and accountancy - for maintaining our financial records and meeting statutory obligations.
• Referencing, credit checks and right-to-rent providers - used to assess prospective tenants and guarantors. Providers may change over time; any new provider is subject to the same vetting.
• Contractors and maintenance suppliers - where required to carry out works at a property, we may share the property address and, where necessary, the tenant's contact details to arrange access.
• Website analytics - such as Google Analytics, to understand how visitors use our website.

Under these agreements, data may be transferred outside the UK/EEA but only where your rights and the rights of the data subject are protected and where that transfer is compliant with the requirements of the UK GDPR.

How we protect personal information

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff and approved sub-processors. We store all personal information on Google Drive and COHO as described above. Any paper files are stored securely.

Unfortunately, the transmission of information over the internet can never be completely secure. Although we will do our best to ensure that your personal information is protected, we cannot guarantee the security of your data transmitted to the website. Any transmission of your personal information by you is therefore at your own risk. Once we have received your information, we will use strict procedures and security features to try and prevent unauthorised access.

How long we keep personal information

We will only keep personal information for as long as we have a valid reason for keeping it. After that, we delete or dispose of the information securely.

• Tenants' data for the duration of the tenancy and seven years after the contract ceases in accordance with the law
• Landlords' data for the duration of the contractual term with us and seven years after the contract ceases in accordance with the law
• Advice we have provided for seven years
• Complaints and feedback for up to two years
• Applications, registrations and administration paperwork for seven years after the event has taken place
• Analytics information from Google for up to two years
• Employees' data for the duration of their employment and seven years after employment ceases

Your rights

You have a right to know what personal data we hold on you, who we acquired it from, how we acquired it, how we hold it and process it, and who we disclose it to. You have the right to request access to any of your personal data we hold on you, information about how and why it is processed and to whom it may be disclosed. You have the right to ask us to erase your personal information, to object to processing of your data, and to request export of your data. These statutory rights are qualified by exceptions and exemptions.

To exercise any of these rights, please contact the data controller detailed below. You can find out more about your rights from the Information Commissioner, who regulates data protection and privacy.

Changes to this policy

We may change this policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.

Contact

You can request a copy of your information or contact the data controller and processor for Northpoint Property Ltd by emailing info@northpoint-property.co.uk.