NHS Scotland’s Test & Protect – Collection of Personal Data (Scotland Only) V3.1 - Updated 13/08/2020
Privacy Notice Introduction:
For the health and safety of the customers and staff in all Rettie premises, we must collect the name and contact details of visitors to these premises to support NHS Scotland’s Test & Protect.
This information will be used to enable NHS Scotland to contact you should you have been in the premises around the same time as someone who has tested positive for coronavirus.
Contacting people who might have been exposed to the virus is an important step in stopping the spread.
1. Why do we need to collect this data? As stated above, the purpose for which we are processing your personal data is to assist with NHS Scotland’s Test and Protect strategy in relation to the coronavirus public health epidemic. This will involve the gathering and, when required, the sharing of information with NHS Scotland as the responsible body for Test and Protect. Your data will not be used for any other purpose. In order to assist in the containment of the virus, we will only share your data when it is requested directly by NHS Scotland. This will only be in the unlikely event there is a cluster of coronavirus cases linked to any Rettie premises. Information will be transferred securely to NHS National Services Scotland who will use the data to contact trace those who were in the premises at the same time as the positive case, and will provide guidance and support to those who may be advised to self-isolate. For further information on the NHS Scotland Test and Protect strategy please visit the NHS website.
2. What data will we collect?
Along with the date and time of your arrival and departure, we will collect the following personal data if applicable:
· your name; and
· contact telephone number.
3. If you do not have a telephone number, you have the option to provide:
· a postal address; or
· an email address.
4. Where multi-household groups are present, we will collect contact details from a ‘lead member’ of each household, along with the number in attendance from each household within the group.
5. What is our lawful basis for collecting and sharing this data?
Under data protection law, GDPR Article 6(1), we have a number of lawful bases that allow us to collect, process and share personal information. In this case, the lawful basis for processing your data is ‘legal obligation'. In short, we are obliged to process the personal data to comply with the law which requires us to collect your data and share it with public health officers if they request it under The Health Protection (Coronavirus) (Restrictions) (Scotland) Amendment (No. 11) Regulations 2020.
6. How long will we retain the data?
Your personal data collected for the purposes stated in this privacy notice and will be held by us for at least 3 weeks (21 days). All personal data will be held and disposed of in a safe and secure manner.
Your rights: As defined in the data protection law, GDPR Article(s) 12-23, you have the following rights:
· The right to be informed about the collection and use of your personal data. This is outlined above.
· The right to access the information we hold about you. Also known as Subject Access Request (SAR)
· The right to request rectification of any inaccurate personal data we hold about you. In certain circumstances exemptions to these rights may apply. Further information is available on the Information Commissioner’s Office website.
If you consider that your personal data has been misused or mishandled by us, you can raise this with the data controller. In this instance, the data controller is the Fiona Robb - Compliance Manager at Rettie.
7. More information about the ICO and use of your Personal Data during these unprecedented times can be found at https://ico.org.uk/global/data-protection-and-coronavirus-information-hub/
How we use your information
At Rettie we are committed to ensuring that your privacy is protected. This privacy notice tells you what to expect when the Rettie* collects personal information. Rettie Limited is data controller in respect of the personal data processed when you visit our website. If you have any questions or concerns in relation to this Privacy Notice you can contact our Data Protection Officer.
- Legitimate Interests
- Visitors to our website
- People who use our services, e.g. who subscribe to our newsletters, live chat or request any information from Rettie
- Complainants and other individuals in relation to a complaint
- Job applicants and our current and former employees
- Other websites
- Security & performance
Under the new data protection law starting in May 2018 we have a number of lawful reasons that we can use (or 'process') your personal information. One of the lawful reasons is called 'legitimate interests'. Legitimate Interests means that we can process your personal information if:
- We have a genuine and legitimate reason and we are not harming any of your rights and interests
So, what does this mean? When you provide your personal details to us we use your information for our legitimate business interests to carry out our Estate Agency, Letting and Development Services work. Before doing this, though, we will also carefully consider and balance any potential impact on you and your rights.
Some typical examples of when we might use Legitimate Interest are for direct marketing, preventing fraud, maintaining the security of our system, data analytics, enhancing, modifying or improving our services, identifying usage trends and determining the effectiveness of our campaigns.
Visitors to our websites
Rettie is committed to protecting and respecting your privacy and we pledge to handle your data fairly and legally at all times. Rettie is also dedicated to being transparent about what data we collect about you and how we use it. We have structured our website so that you can visit Rettie on the website without revealing yourself or any personal information.
When someone visits www.rettie.co.uk we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is Aggregated Data and is processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
Once you choose to provide us with any information by which you can be identified, then you can be assured that it will only be used in accordance with this privacy statement.
For your protection, we are registered under the Data Protection Act 2018 and have given all appropriate notifications to the Information Commissioner.
People who use our services
We may collect the following information:
We require this information to understand your needs and provide you with a better service, and in particular for the following reasons:
Our employees will usually follow up, by e-mail, phone or mail, with people who have requested information from the website.
Where an enquiry relates to a New Homes development, our New Homes team may share information with the developer client expressly for the purpose of responding to the enquiry. This We require that users supply personal information, including name, company (if applicable), address, telephone number and e-mail address prior to receiving specific corporate and information materials or where you submit an enquiry to us.
We may also ask you to provide us with information regarding your housing and contact preferences in order to provide you with further correspondence about the properties we have for sale/to let. The information is either needed to fulfil your request or to enable us to provide you with a more personalised service.
What do we do with the information we gather?
Information remains confidential as required by the UK Data Protection Act 2018.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. You can ask us to rectify or update your personal information at any time by email to firstname.lastname@example.org or write to The Data Protection Officer Rettie 4 Jamaica Street Edinburgh EH3 6DH
Disclosures of your Personal Data
We may have to share your personal data with the parties set out below for the purposes set out in the "Purposes for which we will use your personal data" table above. We have agreements in place with our third parties that restrict their use of your personal data. We only allow third parties to use your personal data for specified purposes and in accordance with our instructions.
External Third parties acting as processors in the United Kingdom who provide marketing, IT and system administration services, anti-money laundering service providers, tenancy deposit administrators and services to enable us to perform our contract with you.
Professional advisors acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accountancy services.
HMRC, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
To enable us to periodically send promotional mail or e-mails about new properties or other information which we think you may find interesting or have requested we will use the address or e-mail address which you have provided.
You have a right at any time to stop us from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, please click here or use the link on the bottom of our newsletter to unsubscribe or manage your preferences. If you do withdraw your consent, this will result in us ceasing to market goods and services to you.
Rettie also processes your data when it is in our Legitimate Interests to do this and when these interests do not override your rights. Those Legitimate Interests include providing you with information on our services, properties, property market research & updates and competitions. Please see the section on 'Legitimate Interest' for more information.
Web Banner Advertising
If you visit our website, you may receive personalised banner advertisements whilst browsing other websites. Any banner advertisements you see will relate to products you have viewed whilst browsing our website on your computer or other devices.
We use a variety of digital marketing networks and ad exchanges, and a range of advertising technologies like pixels, ad tags, cookies, and mobile identifiers, as well as specific services offered by some sites and social networks, such as Facebook’s Custom Audience service.
Using your information to help prevent terrorism and crime
The Government also requires us to verify the identities of and complete due diligence on all our customers.to ensure we are complying with the international fight against terrorism and other criminal activities. We are aware that the real estate industry is a target for organised criminals seeking to launder the proceeds of criminal activity. We always seek to prevent this activity by cooperating fully with the authorities and reporting suspicious activity to the National Crime Agency.
As part of this commitment, we adopt a strict compliance of all Anti-Money Laundering rules, with specific emphasis on the Proceeds of Crime Act 2002, the Money Laundering Regulations 2017, the Bribery Act 2010 and the Terrorism Act 2000.
As a result of this we may need to disclose information to government bodies.
We will not sell, distribute or lease your personal information to third parties unrelated to your enquiry unless we are required to do so by law.
Once we have received your personal data we will use reasonable and necessary procedures and security features to try and prevent unauthorised access. For example, we limit who can access your personal data to those individuals and third parties who need to know it and who are subject to a duty of confidentiality. If we become aware of a data breach we will notify the Information Commissioner's Office. If we believe that the data breach is serious, we may notify you in accordance with our legal requirements.
Under the Data Protection Act 2018, you have rights as an individual which you can exercise in relation to the information we hold about you.
Access to personal information
Rettie tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 2018. If we do hold information about you we will:
- give you a description of it and tell you why we are holding it;
- tell you who it could be disclosed to; and let you have a copy of the information in an intelligible form.
- ask that any inaccurate information we hold about you is corrected;
- ask that we delete the personal data we hold about you in certain situations;
- ask that we stop using your personal data for certain purposes;
- ask that we do not make decisions about you using completely automated means; and/or
- ask that personal data we hold about you is given to you, or where technically feasible a third party chosen by you, in a commonly used, machine-readable format.
The rights listed above may apply in certain circumstances, and so we may not always be able to comply with your request to exercise these rights.
We periodically send out e-newsletters. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter.
People who contact us via social media
If you send us a private or direct message via social media the message will come directly to Rettie and is not be shared with any other organisations.
People who email us
We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
People who make a Complaint
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to analyse the level of service we provide to improve our customer experience. We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Job applicants, current and former Rettie employees
What will we do with the information you provide to us?
All of the information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.
We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.
We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.
What information do we ask for, and why?
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.
The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t.
We might ask you to participate in assessment days; complete tests or personality profile questionnaires; and/or to attend an interview – or a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information will be held by Rettie.
If you are unsuccessful following assessment for the position you have applied for, we may ask if you would like your details to be retained for a period of six months. If you say yes, we may contact you should any further suitable vacancies arise.
If we make a conditional offer of employment we will ask you for information so that we can carry out checks. We are required to confirm the identity of our staff, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability.
You will therefore be required to provide:
- Proof of your identity – you will be asked to attend our office with original documents, we will take copies.
- Proof of your qualifications (if applicable) – you will be asked to provide us with original documents, we will take copies.
- We will contact your referees, using the details you provide in your application, directly to obtain references
How long is the information retained for?
If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus 6 years following the end of your employment.
Our website may contain links to enable you to visit other web sites of interest easily. However, once you have used these links to leave our site you should note that we do not have any control over that other web site. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
Security and Performance
Rettie uses a third-party service to help maintain the security and performance of the Rettie website. To deliver this service it processes the IP addresses of visitors to our website.
Changes to this Privacy Notice
We keep our Privacy Notice under regular review. This privacy notice was last updated on 3 April 2018
How to contact us
Chief Operating Officer or Data Protection Officer
Rettie & Co.
4 Jamaica Street
*Rettie consists of: Rettie & Co Ltd , Rettie Bearsden LLP, Rettie Borders LLP, Rettie Berwick LLP, Rettie Newcastle LLP and Rettie West End LLP, Edinburgh Festival Rentals Ltd