Home Run Landlord Privacy Policy
This policy sets out how Home Run collects, stores and uses information about you and complies with the law on data protection, specifically:
- The lawful basis for data processing
- What personal data we collect about you
- How we collect your data
- What we use personal data for
- How we store personal data and keep it safe
- How long we keep your personal data
- Your rights in relation to the data we hold
Definitions
Data protection legislation means the Data Protection Act 1998 as long as it is in force and thereafter the General Data Protection Regulation (Regulation (EC) 2016/679 which comes into force in the UK on 25 May 2018) (GDPR) and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK and then any successor legislation to the GDPR or the Data Protection Act 2018
Data subject (you) means the individual that is subject of any personal data, e.g. the client accessing Home Run
Data processor (Home Run/”we”/“us”) means the person or entity responsible for processing personal data on behalf of a controller
Data controller (Information and compliance manager): means the person who determines the purposes and means of processing personal data. The Information and Compliance Officer is Toby Cunningham. You can contact him at [email protected]
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Property registration form means the paper or electronic form we ask you to use to provide your contact and property details.
Complaints form means the paper or electronic form which is used to raise a complaint against a Home Run landlord.
Further definitions can be found here. https://gdpr-info.eu/art-4-gdpr/
Lawful basis for data processing
Our lawful basis for processing of personal information (Article 6 GDPR) is for:
- the performance of our contract with you to allow your property to be accredited and advertised to students who are searching for accommodation in the private sector. Your contact details will be displayed on an online housing list at uea.su/homerun. The housing list can be accessed by any individual who is affiliated with University of East Anglia (UEA).
- Our legitimate interest to ensure compliance with legal obligations in respect of:
- Gas Safety
- Energy Efficiency (via an Energy Performance Certificate)
- Licensing of Houses in Multiple Occupation
- And Home Run minimum standards in respect of:
This is for the protection of our student members
- Our legitimate interest to action complaints against Home Run landlords received from our student members
- Our legitimate interest to inform you of the Landlord Events hosted by Home Run and news relating to the private rented sector
- Via consent to provide you with information about our services and marketing from us, such as an invitation to complete our annual survey
- Via consent to keep a record of your intention to attend a Landlord Event
- Via consent to keep a record of your attendance at a Landlord Event
- Via consent to allow us to provide information to you on our registration process and minimum standards
You can withdraw consent to marketing emails at any time by updating your preferences online via the Studentpad control site. The control site can be accessed at https://control.studentpad.com/login using your email address and password. If you have forgotten your password then please email [email protected] to request a password reset link. Alternatively, contact us and we will make the necessary adjustments to confirm that consent has been withdrawn. We may require confirmation of your identity before making any changes.
We will never share your data with a third party unless you have provided explicit written consent or we have a legal obligation to do so.
What data do we collect about you?
Service Information:
- Your first name, surname, email address and telephone number. If your preferred method of contact is by post then we will also request your home address.
Property Registration:
- Your title, first name, surname, home address, telephone number, email address, website address (if applicable), company name (if applicable), your mailing preferences, your debit or credit card details (processed by Studentpad and not stored by Home Run) as well as the details of the property you wish to be accredited and advertised
Complaints:
- Your first name, surname, home address, telephone number, email address, addresses relating to any student properties, date accreditation was suspended or terminated and length of suspension.
Event Registration:
- Your first name, surname and email address
Event Attendance:
How we collect data about you
We collect data about you via:
- a telephone call or face to face meeting at our office
- our Property Registration form
- our Complaints form
- directly via the Studentpad control site
- email
What we use your data for
To provide you with information on our services:
- Email or post a copy of our Landlord Information Pack and property registration form
To register your property with Home Run:
- accredit and advertise your property online via the Home Run housing list
- ensure you remain compliant with housing legislation and the Home Run Minimum Standards
To action a complaint received against you:
- keep a written record regarding an alleged breach of minimum standards by you, received from a third party
- keep a written record of any relevant actions, decisions or correspondence we may have taken
Landlord Events
- invite you to attend our Landlord Events
- keep a record of event registration and attendance
- In extreme situations, we may share your personal details with the emergency services if we believe it is in your vital interests to do so.
Statistics:
We may also use your data anonymously (where your individual details cannot be identified)
- for monitoring and statistical purposes
- help us can identify trends and patterns to enable us to plan enhancements to our service
We will not:
- use your data for marketing purposes, unless you have given consent
- request or use any genetic or biometric data about you
- carry out any automated data processing
- share your personal data without your express consent unless we are required to do so by law
How we store personal data and keep it safe
There are five places we store your personal data:
1. in a secure property management system (Studentpad)
2. in Microsoft Outlook when you email us
3. in a Microsoft Excel re-registration tracker for statistics, complaints and event sign up and attendance log.
4. in a folder in a locked cupboard (registration receipts)
5. in an online file storage system, Microsoft OneDrive
Studentpad
Personal and property details are stored within Studentpad, our secure property management system. This system can only be accessed by trained Home Run staff and is password protected.
Studentpad is a highly trusted property management system used by many Universities and Students’ Unions and is fully compliant with the GDPR.
Studentpad have their own privacy policy which can be viewed here - https://www.homerunstudentpad.co.uk/Privacy.
OneDrive
Hard copy data, such as your Property Registration Form, and any paper copies of documents you give us (safety certificates), are scanned and stored on OneDrive, and the hard copies are shredded. OneDrive can only be accessed by trained Home Run staff and is password protected.
Registration Receipts
Copies of registration receipts are stored within a folder and locked away in a cupboard within the Home Run office. The cupboard can only be accessed by trained Home Run staff.
Registration receipts are kept for seven years. Receipts are shredded at the end of this time period.
Re-registration Tracker
We record your name and property address on our Microsoft Excel re-registration tracker in order that we can track the progress of your application and advise if we still require information from you. The tracker is kept for a period of 12 months and then deleted. The re-registration tracker is stored on OneDrive.
Event Attendance
We record your name and email address within a Microsoft Excel spreadsheet to track the number of landlords who are interested in attending a Landlord Event. Landlords who attend events are required to sign in and the attendance log will be stored on OneDrive and any paper copies shredded.
Training
All staff are required to undertake Data Protection training.
Data security in the office
All staff are individually responsible for locking their PC when left unattended and locking any written notes or client documents in their desk drawers when they are away from the office.
Deletion of data
We retain electronic data on Studentpad for two years after your last contact with us. This allows us to ensure that you remain compliant with the Home Run minimum standards while tenants who used Home Run to find your property are still in occupation.
Breach notification
Studentpad have a procedure in place in the event of a data breach. The Head of Advice is responsible for ensuring the primary contact details held by Studentpad are up-to-date to ensure there is no delay in reporting a data breach. If a member of Home Run staff is informed of a data breach involving Studentpad then they are to alert Studentpad immediately. As well as informing Studentpad we are also required to inform the Information Commissioners Office (ICO) within 72 hours of becoming aware of the breach (where feasible) and the client/s affected.
Your rights in relation to the data we hold
The right of access
You have the right to an electronic copy of your data and to know whether or not your personal data is being processed, where and what for. Clients wishing to have a copy of their data can email [email protected] with their request. Once we have confirmed that you are a Home Run landlord we will provide, free of charge, an electronic copy of your data within one month of the request. We may ask you to confirm your identity before sending you the copy.
The right to rectification
If you think the data we hold for you is incorrect then you can make the necessary amendments online via the Studentpad control site. The control site can be accessed at https://control.studentpad.com/login using your email address and password. If you have forgotten your password then please email [email protected] to request a password reset link.
Alternatively, contact us and discuss the updates required. We may require confirmation of your identity before making any changes.
The right to erasure
You have the right to erasure if the personal data is no longer necessary for the purpose which it was originally collected or processed, for example if you do not wish to remain registered with Home Run. An erasure request can be made verbally or in writing to [email protected].
Your request will be actioned free of charge, within one month. We may require confirmation of your identity before making any changes.
The right to restrict processing
If you have requested for your personal data to be updated then you can also request that processing is restricted whilst we apply the requested updates.
The right to object to processing
You have right to object to the processing of your personal data in some circumstances. This right applies where an organisation is using your data for a task carried out in the public interest, for its legitimate interests, for scientific or historical research, or statistical purposes, or for direct marketing.
The right to data portability
You have the right to be provided with a copy of the personal data you have provided for the performance of a contract or via consent. The information must be provided in a way that is accessible and machine-readable. You also have the right to ask for your data to be transferred to another organisation, if technically feasible.
Updated: May 2019