GDPR (General Data Protection Regulation)
The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). GDPR will come into effect across the EU on 25th May 2018.
WHY DO WE HAVE A PRIVACY NOTICE
WHO ARE J BRADBURNE PRICE & CO?
J Bradburne Price & Co is a family run business which operates two Livestock Markets – one in Mold and one in Llanrwst. We also run an Estate Agency and Rural Surveying business from an office based in Mold and additionally carry out some Rural Surveying and Land Sales from our Llanrwst Market
We operate as a Sole Trader
We may acquire personal information about you if we are supplying you with goods and services.
J. Bradburne Price and Co. deals with a wide ranging clientele including auction suppliers, auction purchasers, vendors of property, purchasers of property, those who have expressed an interest in property and surveying clients
Data held on these people can include the following:
a) Auction Suppliers & Purchasers
Trading name, address, telephone numbers (mobile & home), bank details, VAT number, email address, holding numbers, flock number, Farm Assurance numbers etc.
b) Vendors and Purchasers of Property as well as those who expressed an interest in purchasing
For vendors and purchasers, we will hold proof of address, proof of identity as well as other information such as email addresses and telephone numbers. This may include Passports, Utility Bills, Tax Reference and Driving Licence. This information is held for money laundering and counter terrorism purposes and is a legal requirement
For those who expressed an interest, we will hold information such as telephone numbers, addresses, e mail addresses etc
c) Surveying clients
In addition to the terms of engagement, we will hold information such as telephone numbers, address, e mail address etc
In some instances, we will hold bank details.
J Bradburne Price is a Data Controller. Our data controller is James B Griffiths MRICS.
HOW WILL THE DATA BE COLLECTED
In nearly all cases, any data will be collected during the normal course of business.
For auction customers, this will either be provided by yourselves, collected from an entry form or BCMS barcode or provided by a trusted 3rd party.
For the remainder of the above groups, this will usually be provided by yourself or with your permission other sources such as family members, a solicitor or accountant etc
The data will be collected numerous ways such as face to face, over the telephone, via e mail, via letter etc
WHAT WILL J BRADBURNE PRICE & CO DO WITH PERSONAL DATA?
We hold customer data to allow us to process necessary business transactions. These include:
• To enable us to produce cheques and invoices.
• To enable us to complete sales and purchases of land and property. This can include arranging appointments with prospective buyers or arranging for 3rd parties to carry out work on your property. It can come in the form of e mails, letters, telephone calls, face to face.
• To represent clients in the course of surveying work such as providing valuations, agreeing claims against Utility Companies, settling disputes etc
If we have obtained your contact details during the normal course of business, using a “soft opt in approach,” we may contact you relating to products and services which are of a similar nature to those of our previous dealings. This may be done by way of a letter, an e mail, a text or telephone call.
You can always choose to Opt out of receiving these by contacting us on firstname.lastname@example.org
LAWFUL BASIS FOR HOLDING DATA
Under Data Protection Legislation, there must be a ‘lawful basis’ for the use of personal data. The lawful bases are outlined in Article 6, Section 1 of the GDPR. They are sub-sections:
a) 'your consent';
b) 'performance of a contract';
c) 'compliance with a legal obligation';
d) 'protection of your, or another's vital interests';
e) 'public interest/official authority'; and
f) 'our legitimate interests'.
Generally we will rely on 4 of the above:
This applies when it is necessary to hold your data in the normal course of business unless there is a good reason to protect your personal data which override those legitimate interests. There are 3 tests which should be satisfied when using this approach:
1. Purpose test: are we pursuing a legitimate interest?
2. Necessity test: is the processing necessary for that purpose?
3. Balancing test: do your interests override the legitimate interest?
Examples: Auction Customers, prospective purchasers of property
This applies where the processing is necessary for a contract we enter into with you, or because you have asked us to take specific steps before entering into a contract.
Examples: Clients of surveying business
This applies when the processing is necessary for us to comply with the law (not including contractual obligations).
Examples: Vendors and Purchasers of land and property due to Money Laundering etc
In specific situations, we can collect and process your data with your consent
Example: to be including in our mailing list of properties when you have not previously carried out any business with us
When reading this notice, it might be helpful to understand that your rights arising under Data Protection Legislation include:
• To be informed – We must make available this privacy notice with the emphasis on transparency over how we process your data.
• Access – You are entitled to find out what details we may hold about you and why.
• Rectification – We are obliged to correct or update your details.
• Erasure – This is also known as the request to be forgotten.
• Restrict processing – You have the right to ‘block’ or suppress the processing by us of your personal data.
• Data portability – You have the right to obtain and reuse your personal data that you have provided to us.
• Object – You have the right to object to us processing your data in relation to direct marketing and or profiling.
• Rights in relation to automated decision making and profiling – We do not use automatic decision making or processing.
STORAGE OF DATA
We will store your data in the following ways
• As a hard copy
We will hold the data for as long as we feel is necessary having regard to various criteria, including but not limited to
legal requirements, contractual interests or as a legitimate interest.
One of your rights is the right to erasure and as long as we would not be in breach one of the basis for holding data, we
will delete the data as soon as reasonably possible upon receiving a request
We will treat your data with care and take appropriate steps to protect it
From an electronic perspective, we take cyber security very seriously and have firewalls and anti virus in place and any
backs ups are encrypted.
The processing system used in house is supplied by Newline ASP who are a software and I.T support business. This information is
backed up onto a hard drive.. All information on this system is encrypted by Newline ASP
THIRD PARTY DATA PROCESSING
We will keep your information within the “organisation” except where disclosure is required or permitted by Law or
when we use third party services to supply and support our services to you.
In this case they will hold it securely under these GDPR Regulations
Examples of the need to legally disclose date include HMRC, to keep customer details for accounting and VAT records
or for order by the Court’s then this will be carried out. Also, in the case of emergency or accident on the premises,
any details we know that may save someone’s life will be passed on to emergency services.
We may also be required to disclose your personal data to the police, NCA, other regulatory or Government bodies, upon a request to do so. Examples of this would be Trading Standards, BCMS, NRW.
Your privacy will be take in to consideration if such a request is received
STAFF – ACCESS TO DATA
Office staff have their own passwords and log in details. These details allow them to access information that is only relevant for them to use to fulfil their job requirements.
Auction sale day staff only need minimal access to peoples accounts to enable them to pre enter and sell items belonging to the vendors and selling them to the purchasers.
Staff working in the office have greater access to peoples/businesses data. These staff are fully aware of customer confidentiality and are fully briefed on how to deal with the knowledge of this information.
If anyone finds that any personal data has been used without authority or gained in an unlawful manner these need reporting to the Manager within J. Bradburne Price and Co. and the ICO.
If any breach of Personal Data is found the ICO (Information Commissioner’s Office) should be notified in 24 hours.
72 hours is the absolute maximum time allowed to report these breaches.
We use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.