Privacy Policy

Purpose/activity	Type of data	Lawful basis for processing
To process and deliver our services/your requests including: (a) Undertaking our contractual block management services with our client (b) Manage payments, fees and charges (c) Collect and recover money owed to us or our clients	(a) Identity (b) Contact (c) Financial (d) Transaction	(a) Performance of a contract with you and our clients (b) Necessary for our legitimate interests (to recover debts due) (c) Legal obligation where we need to process your personal data, for example for health and safety purposes, utility services providers, Council Tax or HMRC.
To manage our relationship with you and provide continuous service, which will include: (a) Notifying you about changes to our terms or privacy notice (b) Product and software updates (c) Asking you to leave a review or take a survey	(a) Identity (b) Contact (c) Profile (d) Marketing and Communications (e) Technical	(a) Performance of a contract with you and our clients (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to ensure our business systems are optimised to deliver our business services) (d) Legitimate interest to gather feedback on our service
To enable you complete a survey	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications	(a) Performance of a contract with you and our clients (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)
To administer and protect our business and website/portal (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services

WHO WE SHARE YOUR DATA WITH

We may share your personal data with our clients with whom we have a contract to manage any property where you are resident, freeholder or leaseholder.

When using our website/portal, we may need to disclose your personal data to selected third parties in the following limited circumstances:

We share your personal data with third party service providers. We share your personal data with these companies in order to help with the proper functioning of our business. For example, we use Dwellant, a cloud-based property management system to streamline our services to you.

We also share your personal data with our associated group of companies, including our subsidiary company H-BM PTY based in South Africa (see below).

We may share your personal data with our insurance providers or other professional advisers if this is necessary for, for example, obtaining or maintaining insurance coverage, managing risks, obtaining professional advice or exercising or defending legal rights and claims.

TRANSFERS OF YOUR PERSONAL DATA

To deliver our services to you, it is sometimes necessary for us to share your personal data outside the UK or EEA, for example, within our group of companies, with our staff located in other offices or our service providers. Under data protection law, we can only transfer your personal data to a country or international organisation outside the UK or EEA where there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for data subjects.

Our staff in our subsidiary company H-BM PTY based in South Africa have access to our UK platform for the purposes of providing customer services. We may also transfer data outside of the UK or EEA to selected third parties that we have instructed to help us provide our services to you, such as MRI Real Estate Software and Dwellant Ltd, and other such third parties may process and store your personal data in any one of their geographically distributed data centres as part of its cloud platform.

In the case of transfers of your personal data outside of the UK or EEA where the transfers are not to countries that provide an adequate level of protection, we will ensure appropriate safeguards are in place to cover transfers of your personal data which may include, for example, a data transfer risk assessment and Standard Contractual Clauses (SCC’s) or an International Data Transfer Agreement (IDTA).

COOKIES

Cookies are small text files containing a string of characters that can be placed on your computer or mobile device that uniquely identifies your browser or device. Some of our third party service providers (see section 8 above) may place third party cookies or similar identifiers on your device that are necessary in order to help with the proper functioning of the Website/portal or Website/portal, such as storing and remembering your log-in details and automatically reporting any bugs or other issues with the Website/portal.

DATA RETENTION

We store your personal data for no longer than is necessary. In line with legal, regulatory, financial and good-practice requirements, we will generally keep your personal data for up to a maximum of six years following the end of our relationship.

ACCESSING YOUR PERSONAL DATA AND YOUR RIGHTS

When a data controller (our clients) processes your personal data, you have the following legal rights. We (as a data processor) will assist the controller where possible in the exercise of these rights:

1. To access personal data held about you;

2. To request that the controller make any changes to your personal data if it is inaccurate or incomplete;

3. To request from the controller that your personal data is erased where they do not have a compelling reason to continue to process such data in certain circumstances;

4. To receive your personal data from a data controller in a structured, commonly used and machine-readable format where their processing of the data is carried out by automated means, and it is based on: (i) your consent; (ii) the necessity for performance of a contract to which you are a party to; or (iii) steps taken at your request prior to entering into a contract with the controller;

5. To object to, or restrict the controller’s processing of your personal data in certain circumstances;

6. If we ever use your personal data for direct marketing, you can ask us to stop and we will comply with your request;

7. If we use your personal data on the basis of having a legitimate interest (as set out in the table above), you can object to our use of it for those purposes, giving an explanation of your particular situation, and we will consider your objection;

8. To object to, and not be subject to a decision which is based solely on, automated processing (including profiling), which produces legal effects or could significantly affect you.

To exercise any of your rights set out above please contact the data controller in the first instance. You can send a request to Haus-BM at dpo@h-bm.co.uk and we shall forward your request to our clients.

COMPLAINTS You can make a data protection complaint if you are concerned about how we or our client has collected, used, shared, stored, secured or disposed of your personal information, or how we or our client have handled a request to exercise your data protection rights.

This could include concerns about:

• Missing information or redactions in a subject access request

• Inaccurate information

• An inappropriate disclosure

• Excessive retention

• A personal data breach

• A lack of clear information about how your data is being used

How to make a complaint

To make a complaint, please email the data controller directly or email dpo@h-bm.co.uk and we will forward your complaint to the controller on your behalf.

Please explain:

• What happened

• Why you are dissatisfied

• Any relevant dates or reference numbers

• What you would like us to do to resolve the matter

The data controller will:

• Acknowledge your complaint within 30 days of receiving it

• Investigate it without undue delay

• Keep you informed where appropriate

• Explain the outcome and any action we have taken

If you remain dissatisfied, you will also be told how you can raise your concerns with the Information Commissioner’s Office.