Who we are?

1. We are Maison Cambria Limited (Maison, or “we” “us” etc).
2. You may contact us in relation to this privacy notice and the processing of your personal data:
   1. By email at thomas@maisononline.co.uk
   2. By post at:

Ymholiadau Data/Data Enquiries

Maison

50 Severn Grove

Caerdydd/Cardiff

CF11 9EN

3. Enquiries can be made and responded to in Welsh or in English.

To whom does this privacy notice apply?

4. This privacy notice applies to all personal information processing activities carried out by Maison as controller in relation to individuals (“you” etc) who are or represent potential, existing and former:
   1. Landlords
   2. Tenants
   3. Vendors
   4. Purchasers
   5. Recipients of marketing information
   6. Users of our website or any of our social media pages to the extent that we are controllers
   7. Suppliers of goods and services to us, or our clients, including our tenants
5. This privacy notice applies to information we obtain from you and, where applicable, from third parties.

For what purposes do we use your personal data?

6. We process your personal data where it is necessary:
   1. in the case of clients, for the supply of any services (or goods if applicable) we provide to you or where you wish to explore using our services, any processing which is necessary to enter exploratory discussions at your request;
   2. to comply with a legal obligation;
   3. to protect your vital interests or those of another individual;
   4. for the performance of a task carried out in the public interest; and
   5. for the purposes of our legitimate interests where they are not overridden by your interests or fundamental rights and freedoms – see below.
7. For example, we may use your name, address and other contact details to contact you about any relevant property or properties, and for internal administration.

What “legitimate interests” do we rely upon

8. To the extent that the following does not come under the right to use personal data for the performance of a service as set out in paragraph a above, and as mentioned in 6.e above, we may process your personal data where it is in our legitimate interests to do so. In particular, we may rely on our legitimate interests in the following circumstances:
   1. For obtaining credit reports, employment and remuneration information to ensure that our landlords have this important information to help decide whether to accept a tenancy application;
   2. To share information with utility companies so that there is uninterrupted supply of services and to ensure that the correct person is billed;
   3. For internal administration and training to ensure that we supply a good service to all our service users and operate efficiently;
   4. To deal with enquiries from prospective landlords, tenants, vendors or purchasers and to retain information relating to such enquiries for a certain period;
   5. To retain information about former landlords, tenants, vendors and purchasers in case of disputes or future commercial dealings;
   6. To collect and use analytical data about website usage;
   7. For direct marketing such as to supply you with information about properties of a type you may be interested in;
   8. To share your personal data with a Landlord, Tenant, Vendor, Guarantor or Purchaser or their representatives to facilitate transactions or management of a rental property.
   9. To share your personal data with service partners to ensure the efficient management of a property, such as:
      1. Contractors to carry out works;
      2. To obtain energy performance certificates;

• Utility companies;

1. To ensure network and information security; and
2. To verify your identity and immigration status.

What legal bases do we rely for processing your personal information?

9. In most cases, we do not rely on consent to process your personal information. For example, where we are engaged to supply services to you, the law allows us to use your personal information (subject to your rights described below) where we need to be able to use it to supply services to you.
10. The legal bases we rely on to process your personal data are as set out in paragraph 6
11. In any other cases, we shall ask for your consent to use the data for one or more specific purposes. Where we rely on consent, consent may be withdrawn at any time.

For how long do we keep personal data?

12. We keep records, including personal data, relating to any tenancy for up to 7 years after the ending of the tenancy in case of any contractual disputes.
13. We keep records in relation to prospective clients, tenants for up to 12 months after the enquiries became inactive. We keep this information in our legitimate interests to save duplication of work in case you wished to make further inquiries and so that we can demonstrate to clients the work carried out on their behalf for a reasonable period. We may extend this period to the extent that we have good reason to do so based on our legitimate interests – for example, where a dispute is in progress or we have reasonable grounds to believe that a dispute may arise, or where you give your consent to us storing your personal information for a longer period.

Your rights

14. You may request from us access to and rectification or erasure of personal data or restriction of processing concerning you or to object to processing as well as the right to data portability which, in summary, means a right in certain circumstances to transmit personal data about you in a machine readable form to you or a third party nominated by you.
15. We shall comply with any such request unless the circumstances are such that we feel that there are reasonable grounds not to do so and the law allows us to decline the request.

Complaints

16. If you feel that we have not met the standards required by the General Data Protection Regulation (GDPR), you may complain to us using the contact details set out in 2 above or you may lodge a complaint with the relevant supervisory authority which, in the case of the UK, is the Information Commissioner’s Office – see https://ico.org.uk/make-a-complaint/ or, for the information in Welsh, see https://cy.ico.org.uk/make-a-complaint/. The links are correct as at 22 October 2019. If they are no longer current, please search for ICO.

Information from third parties

17. Where we have not obtained your personal data from you, we may have obtained such data from third parties such as:
    1. Zoopla Limited or its affiliates;
    2. ZPG Limited;
    3. Tenants or prospective tenants – for example, when you are or proposing to be a tenant with someone else or otherwise occupying the relevant property;
    4. A vendor or prospective vendor;
    5. A purchaser or prospective purchaser;
    6. A credit reference agency; or
    7. Government departments or agencies, such as the Home Office.

Information we share with third parties

18. Where we share information with third parties in line with this notice, in most cases, those third parties become what is known as the “controller” of your personal data in relation to any processing by them. In such cases, it is those third parties who will owe you obligations under data protection law and it will be their privacy notices that will apply.
19. In most cases, the identity of the third parties will have been disclosed to you during our dealings. However, whether or not that is the case, we are happy to provide you with details on request made to the contact details in 2

Consequences of us not having relevant personal data

20. If we do not have your name, contact details and identification documents or other relevant information, depending on what you have failed to supply, we may not be able to supply services to you or process any application or purchase or supply you with requested information or any relevant marketing information.
21. Without relevant personal data, we may not be able to arrange a credit reference or other reference which may mean that a Landlord will refuse to grant you a tenancy.
22. If we don’t have relevant personal data, it may mean that we cannot send you updates or marketing information which we’re entitled to send you by consent or otherwise.
23. If you are a supplier of goods or services to us or a client, and we do not have relevant personal data, we or our client may be unable to engage you, or we may not be able to pay you.
24. Where the provision of personal data is a legal requirement, if we don’t have the relevant personal data, we may be unable to discharge our legal obligations.

Automated Decision Making

25. We don’t use any automation decision making methods.
26. Third party credit reference agencies may use automated decision making or profiling and information based on such methods may be used to help decide whether a tenancy application should be accepted. We are happy to supply with details of any agency used so that you may enquire as to the methods used.

Updates

27. We may update this notice from time to time. Where a change is material, we may notify you by email or by any other appropriate means.