Privacy Notice for Contract Holders & Guarantors

Who we are

Rochefort Shugar Ltd. (Residential Letting & Managing Agent) of 1st Floor, Tudor House, 16 Cathedral Road, Cardiff, CF11 9LJ (“I” / “we” or “me” / “us”) are the data controller of any personal data you provide to us.

We are registered with the Information Commissioner’s Office under registration number Z1551459.

Our Data Protection Officer is Mr Mark Shugar.

Any questions about this notice or our privacy practices should be sent to Mr Mark Shugar by email at info@rochefortshugar.com, by telephone on 029 2061 6049, or mobile 07958 712750.

How we collect information from you, and what we collect

We collect information about you:

from your application for accommodation; and
from referencing and credit-check providers, from your guarantor, from previous landlords or letting agents, and from your employer or others you ask us to contact for references.

We collect the following information about you:

prospective contract holder and/or guarantor names, email address, date of birth, address (including any previous addresses), relationship to other prospective contract holders, employment status, and name of university or college where you are studying (if applicable);
contract holder name, email address, telephone number, date of birth, address (including any previous addresses), marital status, National Insurance number, nationality, next of kin, name of university or college where you are studying (if applicable), and the name of friends you are staying with (if applicable);
guarantor name, email address, telephone number, date of birth, address (including any previous addresses), marital status, National Insurance number, nationality, and next of kin (if applicable);
property address; term, rent, deposit, utility and service responsibilities;
the employment status of contract holders and/or guarantors, address, contact details (including email and phone numbers) of the employer/accountant, payroll numbers, length of employment, salary information (including any regular overtime or commission), and any other income received;
bank account details of the contract holder and prospective contract holders, including account number and sort code, and any hire purchase, loan agreements, credit cards or store cards that you have; and
any welfare benefits you may be eligible for or are currently receiving.

Why we need this information, and how we use it

We need your information and will use it:

to undertake and perform our obligations and duties to you under our contract with you;
to supply you with the services and information you have requested;
to help you manage your occupation contract;
to carry out due diligence on any prospective contract holder and/or guarantor, including affordability checks and any history of money judgments, bankruptcy or insolvency;
to administer, support, improve and develop our business and the services we offer;
to contact you about changes to suppliers or services that may affect you; and
for all other purposes consistent with the proper performance of our operations and business.

Our lawful basis for processing your information

Under UK GDPR we must have a lawful basis for processing your personal data. Depending on the purpose, our basis is one of the following:

Contract: processing is necessary to enter into or perform your occupation contract (for example, taking up references, preparing the contract pack, managing the property).
Legal obligation: processing is necessary to comply with the law (for example, deposit protection requirements, health and safety duties, anti-money-laundering rules).
Legitimate interests: processing is necessary for our reasonable business interests, where not overridden by your rights (for example, keeping records of past contracts, recovering unpaid sums, improving our services).

We do not rely on consent as our usual lawful basis. Where we ever do (for example, to send you optional updates), we will tell you and you can withdraw consent at any time.

Sharing of your information

The information you provide to us will be treated as confidential. We may share your information with third parties who act for us, or where required for the purposes set out in this notice. These include:

service providers who process information on our behalf, including our IT and cloud-storage provider (Microsoft 365), our e-signing provider (signNow (airSlate SignNow) - see “Transfers outside the UK and Europe” below), and our credit-reference and affordability-checking provider (Credit Safe);
the landlord of the property you are contract holder of, or applying to;
the tenancy deposit scheme administrator, Deposit Protection Service (DPS), where a deposit is held under the custodial scheme;
local authorities, utility and service providers, freeholders, factors, facilities managers, or any other relevant person or organisation in connection with the creation, renewal or termination of your occupation contract;
our professional advisers (for example, our accountant or solicitor), where reasonably needed;
debt-recovery and tracing agents, where you fail to make payments due under your contract; and
any regulator, court, or government body, where we are required to do so by law.

Unless required to do so by law, we will not otherwise share, sell or distribute your information without your consent.

Transfers outside the UK and Europe

Some of the services we use are provided by companies based outside the UK. Our e-signing provider, signNow (airSlate SignNow), is a US-headquartered company, so the documents we send for signing - and the personal data they contain - may be processed in the United States.

Where personal data is transferred outside the UK or EEA, we ensure adequate safeguards are in place, including:

the transfer being made under the Standard Contractual Clauses together with the UK Addendum, as set out in our e-signing provider’s data processing agreement; and
limiting what we upload to such providers to only the documents that need to be signed or served - we do not upload identity documents, bank statements or references to them.

Security

When you give us information, we take steps to keep it secure. Paper records are stored in a lockable filing cabinet on our lockable premises. Electronic records are stored on our business computer and our business OneDrive, which is password-protected, with access limited to ourselves.

Where we use external service providers, we use providers that meet recognised security standards (for example, independent audit such as SOC 2 and ISO 27001), and we put a written data processing agreement in place with them.

How long we will keep your information

We review our data retention periods regularly. We will only hold your personal data for as long as is necessary for the relevant activity, as required by law, or as set out in any relevant contract we have with you. Our retention schedule is summarised below; the full version is available from us on request.

Contract holder records (including signed contract, deposit, inspections, maintenance): six years after the end of your occupation contract, to meet limitation and tax record-keeping requirements.
Guarantor records: six years after the end of the contract they guaranteed, for the same reasons.
Failed applicant records: up to 12 months after the application is declined or withdrawn, then deleted.
Right to Rent and immigration records: not applicable in Wales - we do not retain immigration documents.
Marketing or service-update consent records: until you withdraw consent.

Your rights

Under UK GDPR you have the following rights in relation to your personal data:

Right of access: to ask for a copy of the information we hold about you.
Right to rectification: to require us to correct any inaccurate or incomplete information.
Right to erasure: to ask us to delete personal data we hold about you, where there is no good reason for us to continue processing it.
Right to restrict processing: to ask us to suspend processing of your personal data in certain circumstances.
Right to data portability: to ask us to provide your personal data in a structured, commonly used and machine-readable format, or to transfer it to another controller.
Right to object: to object to processing based on legitimate interests, and to object to direct marketing.
Right to withdraw consent: where we rely on consent, to withdraw it at any time without affecting prior processing.
Rights related to automated decision-making: we do not make decisions about you solely by automated means.

To exercise any of these rights, please contact us at info@rochefortshugar.com.

Complaints

If you are unhappy about how we have handled your personal data, you have the right to complain to us and to the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.

To make a data protection complaint to us, please contact Mr Mark Shugar by email at info@rochefortshugar.com or by post to 1st Floor, Tudor House, 16 Cathedral Road, Cardiff, CF11 9LJ. You may also complain by telephone on 029 2061 6049. We will accept complaints however they are submitted.

We will acknowledge your complaint within 30 days of receiving it. We will then investigate without undue delay, keep you informed of our progress, and tell you the outcome as soon as we can.

You also have the right to complain to the ICO at any time. You do not need to complain to us first, but we would welcome the opportunity to resolve the matter directly.

ICO Wales
Information Commissioner’s Office
2nd Floor, Churchill House
Churchill Way, Cardiff, CF10 2HH
Telephone: 0330 414 6421
Email: wales@ico.org.uk

ICO Head Office (UK)
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

The accuracy of your information is important to us - please help us keep our records updated by telling us of any changes to your email address or other contact details.

Personal Data Privacy Notice