Personal Data Privacy Notice

Who we are

Rochefort Shugar Ltd. (Residential Letting & Managing Agent) of 1st Floor, Tudor House, 16 Cathedral Road, Cardiff, CF11 9LJ (“I” / “we” or “me” / “us”) are the data controller of any personal data you provide to us.

We are registered with the Information Commissioner’s Office under registration number Z1551459.

Our Data Protection Officer is Mr Mark Shugar.

Any questions about this notice or our privacy practices should be sent to Mr Mark Shugar by email at info@rochefortshugar.com, by telephone on 029 2061 6049, or mobile 07958 712750.

How our model affects your data

We do not hold client money. Rent is paid directly by your contract holder to you. We invoice you separately for our management fees, and forward maintenance invoices from contractors to you for direct payment. This means we hold less of your financial data - we do not need access to your rent account, and we do not handle deposits on your behalf (these are held by the contract holder with a recognised deposit scheme).

How we collect information from you, and what we collect

We collect information about you:

• directly from you when you instruct us (in person, by phone, by email, or by signing our Terms of Business);
• from our records of the property and the contracts we manage on your behalf;
• from third parties where reasonably necessary (for example, your accountant, solicitor, mortgage lender, freeholder or block manager); and
• from public registers (for example, HM Land Registry or Rent Smart Wales) to verify ownership or licensing status.

We collect the following information about you:

• your name, home address, email address, telephone number(s), and date of birth where required for identity verification;
• proof of identity and proof of property ownership (for example, a copy of the title or evidence of your authority to instruct us), where reasonably required;
• bank account details (name, sort code, account number) so you can pay us management fees and we can identify your payments;
• property address(es), ownership status, and any relevant property-related information (mortgage lender consent, leasehold conditions, freeholder details);
• your Rent Smart Wales registration number, where you hold one;
• your Unique Taxpayer Reference (UTR) and National Insurance number, where reasonably required for HMRC reporting (for example, under the Non-Resident Landlord Scheme);
• records of your instructions, preferences, and communications with us;
• financial records relating to the property: management fees invoiced and paid, maintenance invoices forwarded, and statements issued; and
• the names and contact details of any agents or representatives you authorise to act on your behalf.

Why we need this information, and how we use it

We need your information and will use it:

• to provide the letting and management services set out in our Terms of Business with you;
• to verify your identity and your authority to instruct us in respect of the property;
• to invoice you for our management fees, and to record and reconcile payments received;
• to coordinate maintenance, compliance and inspections on the property, including instructing contractors and forwarding their invoices to you;
• to communicate with you about the property, your contract holders, and any matters affecting the let;
• to comply with our legal and regulatory obligations - including, where applicable, the Non-Resident Landlord Scheme administered by HMRC, and Rent Smart Wales licensing rules;
• to keep proper business and tax records, including for VAT and corporation tax purposes; and
• to administer, support, improve and develop our business and the services we offer.

Our lawful basis for processing your information

Under UK GDPR we must have a lawful basis for processing your personal data. Depending on the purpose, our basis is one of the following:

• Contract: processing is necessary to enter into or perform our Terms of Business with you (for example, managing your property, raising fee invoices, coordinating maintenance).
• Legal obligation: processing is necessary to comply with the law (for example, HMRC reporting under the Non-Resident Landlord Scheme, VAT and tax record-keeping).
• Legitimate interests: processing is necessary for our reasonable business interests, where not overridden by your rights (for example, keeping records of past instructions, recovering unpaid fees, improving our services).

We do not rely on consent as our usual lawful basis. Where we ever do, we will tell you and you can withdraw consent at any time.

Sharing of your information

The information you provide to us will be treated as confidential. We may share your information with third parties who act for us, or where required for the purposes set out in this notice. These include:

• service providers who process information on our behalf, including our IT and cloud-storage provider (Microsoft 365), and our e-signing provider (signNow (airSlate SignNow) - see “Transfers outside the UK and Europe” below);
• our professional advisers (for example, our accountant or solicitor), where reasonably needed;
• contractors and tradespeople, limited to the information needed for them to carry out works on your property (typically your name and contact details, and the property address);
• prospective and current contract holders, where reasonably needed to identify the landlord, manage the contract, or comply with the law (for example, serving statutory notices such as the RHW2 Notice of Landlord’s Address);
• the deposit scheme administrator, Deposit Protection Service (DPS), where relevant to the contract;
• local authorities, utility and service providers, freeholders, factors, facilities managers, or any other relevant person or organisation in connection with the property or contract;
• HM Revenue & Customs and other government bodies, where required by law (including under the Non-Resident Landlord Scheme);
• Rent Smart Wales and other regulators, where required by law;
• debt-recovery agents, where fees due to us remain unpaid; and
• any court or other government body, where we are required to do so by law.

Unless required to do so by law, we will not otherwise share, sell or distribute your information without your consent.

Transfers outside the UK and Europe

Some of the services we use are provided by companies based outside the UK. Our e-signing provider, signNow (airSlate SignNow), is a US-headquartered company, so the documents we send for signing - and the personal data they contain - may be processed in the United States.

Where personal data is transferred outside the UK or EEA, we ensure adequate safeguards are in place, including:

• the transfer being made under the Standard Contractual Clauses together with the UK Addendum, as set out in our e-signing provider’s data processing agreement; and
• limiting what we upload to such providers to only the documents that need to be signed or served - we do not upload identity documents or bank statements to them.

Security

When you give us information, we take steps to keep it secure. Paper records are stored in a lockable filing cabinet on our lockable premises. Electronic records are stored on our business computer and our business OneDrive, which is password-protected, with access limited to ourselves.

Where we use external service providers, we use providers that meet recognised security standards (for example, independent audit such as SOC 2 and ISO 27001), and we put a written data processing agreement in place with them.

How long we will keep your information

We review our data retention periods regularly. We will only hold your personal data for as long as is necessary for the relevant activity, as required by law, or as set out in our Terms of Business with you. Our retention schedule is summarised below; the full version is available from us on request.

• Landlord records (Terms of Business, correspondence, instructions): six years after the end of our management relationship with you, to meet limitation and tax record-keeping requirements.
• Financial records (fee invoices, payments, maintenance invoices, statements): six years after the end of the relevant tax year, in line with HMRC and VAT record-keeping requirements.
• Property compliance records (gas, electrical, EPC, inspection records): six years after the certificate expires or is superseded.
• Marketing or service-update consent records: until you withdraw consent.

Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access: to ask for a copy of the information we hold about you.
• Right to rectification: to require us to correct any inaccurate or incomplete information.
• Right to erasure: to ask us to delete personal data we hold about you, where there is no good reason for us to continue processing it.
• Right to restrict processing: to ask us to suspend processing of your personal data in certain circumstances.
• Right to data portability: to ask us to provide your personal data in a structured, commonly used and machine-readable format, or to transfer it to another controller.
• Right to object: to object to processing based on legitimate interests, and to object to direct marketing.
• Right to withdraw consent: where we rely on consent, to withdraw it at any time without affecting prior processing.
• Rights related to automated decision-making: we do not make decisions about you solely by automated means.

To exercise any of these rights, please contact us at info@rochefortshugar.com.

Complaints

If you are unhappy about how we have handled your personal data, you have the right to complain to us and to the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.

To make a data protection complaint to us, please contact Mr Mark Shugar by email at info@rochefortshugar.com or by post to 1st Floor, Tudor House, 16 Cathedral Road, Cardiff, CF11 9LJ. You may also complain by telephone on 029 2061 6049 or mobile on 07958 712750. We will accept complaints however they are submitted.

We will acknowledge your complaint within 30 days of receiving it. We will then investigate without undue delay, keep you informed of our progress, and tell you the outcome as soon as we can.

You also have the right to complain to the ICO at any time. You do not need to complain to us first, but we would welcome the opportunity to resolve the matter directly.

ICO Wales
Information Commissioner’s Office
2nd Floor, Churchill House
Churchill Way, Cardiff, CF10 2HH
Telephone: 0330 414 6421
Email: wales@ico.org.uk

ICO Head Office (UK)
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

The accuracy of your information is important to us — please help us keep our records updated by telling us of any changes to your email address, bank details or other contact details.