Zest Residential Ltd, Privacy Notice
Version 3.5, Zest Residential Ltd (zest) is the Data Controller.
About this Privacy Notice
Protecting your privacy
Zest Residential is committed to the protection of your privacy when you contact us or use any of our services. We have not engaged a Data Protection Officer (DPO) but that in no way diminishes our legal obligations to protect your personal data. It is important to us that you feel informed over the data we collect about you and in control with how we use it.
The information contained within this Privacy Notice explains the rights you have, how we use information about you and the measures we have put in place to protect your privacy.
How to contact us
We are a residential lettings agency based at:
Zest Residential Ltd
3 Turpyn Court
Woughton on the Green
Milton Keynes MK6 3BW
Telephone: 01908 760 077
Data protection lead
You can contact Trisha Arathoon our Director on the details provided below or call our office on the number above and ask to speak to us either of directly.
Trisha Arathoon email@example.com
Making Complaints or queries
Zest endeavour to maintain the highest standards of customer service, which includes the collection of any personal data and therefore we take any complaints we receive very seriously. We would ask anyone who thinks that our collection or use of information is unfair, misleading or inappropriate to contact us immediately, we also welcome any suggestions for improving our procedures.
Links to other websites
This privacy notice does not cover the links we have given you that connect to other websites. We encourage you to read the privacy statements of those other websites.
Changes to this privacy notice
This notice was last updated in May 2018, we review this notice on a regular basis and will place any updates on this website.
Understanding your rights to privacy
What is Personal Information?
Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify an individual. For example, this could be your name and contact details.
Sensitive Personal Data
Sensitive personal data, (known as Special Category Data) needs greater protection. It refers to information you would not want widely known as it is very personal to you. This includes anything that can reveal your:
- sexuality and sexual health
- religious or philosophical beliefs
- physical or mental health
- trade union membership
- political opinion
- genetic/biometric data
- criminal history
Why are we allowed to process your personal information?
Our Privacy and Cookie Policies take into account several laws, including:
- the Data Protection Act 1998
- the Privacy and Electronic Communications (EC Directive) Regulations 2003
- General Data Protection Regulation (EU) 2016/679, which will come into force in the UK in May 2018 and replace the Data Protection Act 1998.
Our processing of your personal information is allowed by the laws and regulations detailed above because we have a legitimate need to carry out the processing in order to perform a contract with you or because the law requires it. We only use your information for marketing or communications purposes with your consent, which you may remove at any time.
Why we need your personal information
We may need to use some information about you to:
- deliver services and support to you
- manage those services we provide to you
- train and manage the employment of our workers who deliver those services
- help investigate any worries or complaints you have about your services
- keep track of spending on services
- check the quality of services; and
- help with research and planning of new services
How the law allows us to use your personal information
There are several legal reasons why we need to collect and use your personal information. Each section of this privacy notice explains which legal reason is being used. Generally, we collect and use personal information where:
- you, or your legal representative, have given consent
- you have entered into a contract with us
- it is necessary to protect someone in an emergency
- it is required by law
- it is necessary for employment purposes
- you have made your information publicly available
- it is necessary for legal purposes
- it is necessary for archiving, research, or statistical purposes
The law gives you several rights to control what personal information we collect about you and how we use it.
Under the GDPR you have the following legal rights, these are your:
- Right to be informed
- Right to access information we hold on you
- Right to request a correction
- Right to request data is deleted
- Right to restrict processing
- Right to data portability
- Right to object
- Rights relating to automated decision making and profiling
How we process your personal data
Information that we collect and process
How we collect your personal data
The following outlines what Freevacy may do with any personal data that you give to us and how you remain in control of this information. Information may be collected through the following methods:
- Visiting one of our websites (including this one)
- Calling us by phone, sending an enquiry, completing an online form on our website - or one of our partner’s websites, including via one of the online property portal websites.
- Communicating with us via email.
- Engaging with posts or making submissions on user forums and across social media.
- Making a customer service enquiry, a complaint, or a subject access request.
- We may also collect personal data about you through agents acting on our behalf.
- Submitting a job application
Third Party Data
Should Zest ever collect personal from a third party source, we will give you details of that source, including if from publicly accessible sources.
What personal data we collect
- Your name, title, gender and date of birth.
- Your contact information including address, phone numbers and email address.
- Financial information including bank account, credit/debit card details or other payment system information such billing and delivery postal addresses.
- Your browsing activities when using one of our websites or online services.
- Your responses to customer surveys or offers that we may make available to you.
- Any comments or opinions that you have made about us on customer review sites, forums and on social media.
- Anonymous information sent by your browser when you visit our websites, including IP address, operating system, and browser version. If you identify yourself by filling out a form, some data (such as what pages you view on our website) may also be connected to your personal information.
Where you give us consent to use your personal information
Where we process your information on your consent only, you have the right to remove that consent it at any time.
If you want to remove your consent, please contact firstname.lastname@example.org to enable us to process your request.
We only use the data we need
We will only collect and use personal information if we need it to deliver a service or meet a requirement. If we no longer need your personal information for the purpose it was collected for we will dispose of it.
We don’t sell your personal information to anyone else.
Who we may share your personal data with
We use the information we collect for the delivery of property management and lettings services to both landlord and tenants. On the occasions where we pass your information and contact details to our partners, we will only do so when we have received your explicit consent. This includes:
- To communicate with third party reference agencies who perform Credit Referencing (see below), Fraud Prevention, Right to Rent and other background checks against you or on your behalf.
- Any party you are linked to (e.g. Joint Tenant)
- Companies you ask us to share data with ( e.g. Rentshield)
- Where we are required to lodge your deposit with an approved DPS scheme.
- To update utility providers and the council of your tenancy commencement for the chosen property.
- For the provision of cleaning and property maintenance services by our business partners.
We may be required to share or collect further data:
- HMRC, Regulators and other authorities
- Where we are required to pass on personal data without consent, for example for the prevention or detection of crime, or to produce anonymised statistical data.
- To check that the information we hold is accurate and up to date.
Credit Reference Agencies
We will share information with CRA’s and they will give us information about you. The data we exchange can include:
- Name , address date of birth
- Application form details
- Financial situation and history
- Public Information
We will use this information to:
- Assess if you can afford the property
- Make sure what you have told us is the truth
- Help detect and prevent fraud
- Track and recover debts
On a joint tenancy, CRA’s may link your data to other joint tenants. You can ask CRA’s to break the link but you normally have to prove you no longer have a financial link with them.
How long we will retain your personal data
We will maintain a record of your contact details for as long as you remain a client of Zest but will remove your details if requested under your ‘right to be erasure’ where consent is the only legal condition enabling us to process it.
At the end of the contracted term, we typically archive and store details of that contract for an extended period, typically ten years for one or more of the following reasons:
- To respond to questions or complaints or
- To show why we have treated you fairly or
- For historical research and statistical purposes.
- In the case of legal action of any kind
Should Zest transfer your personal data to a third country or international organisation we will supply you with the appropriate or suitable safeguards and how to obtain a copy.
Zest has certain legal obligations regarding personal data of employees regarding PAYE and NI.
Other legal requirements may occasionally be required by the police or any other Law Enforcement Agent, HMRC, DWP, for the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of any tax or duty.
Zest will share personal data when specifically required by law.
Information we process about employees
From time to time we may post vacant positions on our site. When applying to work at Zest, we will only use the information supplied to process the application, if we need to disclose information to a third party, for example, to take up a reference we will not do so without the informed consent of the applicant, unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held for 12 months following the recruitment drive. After which time, it will then be destroyed or deleted. We may retain anonymised statistical information to help future recruitment.
Employees (past & present)
Any person taking up employment with Zest will have an employment file created. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once the employment has ended, we will retain the file in accordance with Employment Law and then delete it.
Zest uses Xero accounting software. For more information about how Xero processes data view their Privacy Notice. Go to the IT & Data Security section to see the location of data held by Xero and their Data Security measures.
Salaries are processed by Haines Watts (SEM) Ltd. For more information about how Haines Watts processes data view their Privacy Notice.
Who we bank with
Zest Bank account is currently Lloyds Banking Group.
For more information about how Lloyds Banking Group processes data, please view their Privacy Notice.
Marketing & Communications
About our websites
Zest takes a proactive approach to user privacy and ensures the necessary steps are taken to protect the privacy of its users throughout their visiting experience.
All our websites (including this one) comply with all UK national laws and requirements for user privacy.
General Enquiries, Tenant Viewings & Valuations
Direct email enquiries
We maintain a copy of emails received relating to enquiries, quotations, tenant viewings, landlord valuations and customer service to ensure that we have fully complied with the request.
Online form enquiries
When you submit one of the forms on our website, we collect the information entered. This includes:
|Website||Page||Form purpose||Personal data collected|
|www.zestresidential.co.uk||Lettings Packages||Landlord Enquiry||Your name, email address, contact telephone number, plus details of your enquiry are sent via secure email to our landlord services manager|
|Landlord Agreements||Landlord Instruction to Proceed||Information on the type and size of your rental property, the service you are interested in, along with your name and email address are transferred into to a cloud based software application called Signable (see IT , which we use to generate landlord agreements. A copy of which is emailed to you to view and agree.|
|Contact Us||General enquiry||Your name, email address, contact telephone number, plus details of your enquiry are sent via secure email to our customer service team.|
|www.mklettingagents.co.uk||Price Comparison||Landlord enquiry||Your name, email address, contact telephone number are sent via secure email to our landlord services manager.|
|Landlord Information pack||Landlord enquiry||Your name, email address, contact telephone number are sent via secure email to our landlord services manager.|
|www.landlords4lightning.co.uk||MK Lightning and Zest landlord offer||Register Interest||Your name, email address, contact telephone number are sent via secure email to our landlord services manager.|
If you have filled out any of the above forms, you confirm that you have you have read and accepted the terms in this privacy notice, and that you understand what data will be collected and processed as outlined in this policy.
We maintain a copy of online form submissions relating to course enquiries, quotations, course bookings and customer service to ensure that we have fully complied with the request.
By submitting a form, you understand we may collect the URLs of any pages viewed or links clicked on our website and connect them to your profile. In response to you filling out a form, if you open or click a link in an email we have sent you, that information may also be connected to your profile. This helps us monitor the performance of our website, which in turn enables us to enhance your user experience.
Requesting an online valuation
We use a third-party provider, Val Pal Network, to facilitate online valuations. By clicking the value my property link on our main website, you will be transferred across to a dedicated Zest page: https://valuation.zestresidential.co.uk/home/864--zest-residential.
If you choose to access this service, you will be asked by the Val Pal Network to provide the postcode of your property and select the property address, the number of bedrooms it has and whether you want a lettings or lettings and sales valuation. On a second page you will be asked to provide your name, email address and telephone number. There is also the facility to write a message.
For more information about how Val Pal processes data view their Privacy Notice.
Web Tracking and Analytics
Zest websites use a number of third-party services to gather data on our website statistics, which are used to measure the effectiveness of our online services.
None of the services we use tell us who you are. We only ever know who you are if you willingly choose to identify yourself.
All our websites use Google Analytics to collect standard internet log information and details relating to visitor behaviour patterns. We use this anonymous data to identify trends that indicate sections of content to add, improve or remove in order to enhance your user experience.
Examples of data we collect and measure within Google Analytics include:
- A count of which pages are viewed the most along with the average time users spend on a page. We also measure statistics like bounce rates, where visitors leave a page before interacting with it, along with data on new versus returning visitors
- We record the date, time of day and what country/city visitors are from along with what type of device (mobile/tablet/desktop) is used to access the website
- We measure page interactions such as when a user clicks on a button to reveal more information, an external link, or how far down the page visitor’s scroll on average before exiting to another page or leaving the site altogether
- We’re interested in how users arrive on our website, for example: whether they reach us from a direct search, through a search engine such as Google or Bing, an email campaign, a property portal like Rightmove or Zoopla
- We record how often we receive emails, telephone calls, newsletter signups and contact form submissions
- A count of which pages are viewed the most along with the average time users spend on a page
- We measure new versus returning visitor statistics including bounce rates (where a visitor leaves a page before interacting with it)
- We record the date, time of day and what country/city visitors are from
- We identify the different types of devices (mobile/tablet/desktop) visitors use to access the website
- We measure page interactions such as when a user clicks on a button to reveal more information or an external link
- We record how far down the page visitors scroll on average before exiting to another page or leaving the site altogether
- We record how often we receive emails, telephone calls and contact form submissions
- We are also interested in how users arrive on our website, for example: whether they reach us from a direct search, through a search engine such as Google or Bing, an email campaign, or a property portal like the Rightmove or Zoopla.
Zest does not use Google Analytics to track or collect any data that personally identifies an individual such as a person’s name, email address or billing information. Nor do we use Google Analytics data with any other service to uncover the identity of visitors to our website.
To further protect your privacy we have activated IP anonymisation on this website. Even though your IP address is not visible to us in any Google Analytics reports, Google does use them to provide geo-location data. The impact of this change means we have less accurate insight into your location. Also, your IP address would otherwise be stored on Google’s servers. Taking this action means part of your IP address is masked and therefore prevents Google from seeing your IP data.
All data collected by Google Analytics is deleted after 14 months.
For more information about how Google Analytics processes data view their Privacy Notice or go to IT and Data Security section.
Google Tag Manager
We use Google Tag Manager to send additional statistical information to Google Analytics such as when visitors complete specific tasks or events on our website.
No personal data is collected by Google Tag Manager. The technology works by listening for interactions in web browsers, which are transferred into Google Analytics.
For more information about how Google Tag Manager processes data view their Privacy Notice or go to IT and Data Security section.
Any communication, engagement and actions taken through external social media platforms (such as Facebook, Twitter or LinkedIn) are subject to the terms of service and privacy policies held by each social media platform respectively.
Users are advised to use social media wisely and only communicate or engage on posts and comments published by Freevacy, or via direct communication, with due care and caution regarding their own privacy and personal information.
Zest may use social sharing buttons which help share web content directly from pages on this website to social media platforms. Users are advised before using social sharing buttons that the social media platform may track and save your action through your social media platform account.
IT and Data Security
IT systems which process personal data
Zest uses several IT cloud service providers to process your personal data:
- Microsoft Office 365
- Xero Accounting Software
3rd-party suppliers who have access to personal data
Zest Residential work with the following IT and marketing third-party suppliers / contractors who through the course of facilitating their services to us may have access to your personal data:
- IT Services: EBS-IT | privacy notice
Data location & level of protection
|Vendor (Link to privacy notice)||Product||Stored within UK or EU||Data can be Stored outside UK or EU under||Information Security measures|
Skype For Business
|Yes||EU Model Clauses||ISO/IEC 27001, ISO/IEC 27018|
Google Tag Manager
|Yes||EU – US Privacy Shield||ISO/IEC 27001|
|ZPG Software||CFP Lettings Agency & Property Management||Yes||No||Secure Server|
|Xero Limited||Xero Accounting Software||Yes||EU – US Privacy Shield||Encryption in transit and rest. Data is stored on Amazon AWS & Microsoft Azure servers which are ISO 27001 certified.|
|Tactile Limited||Fixflo Property Repair Reporting Softare||Yes||EU – US Privacy Shield||Encryption in transit. Data is stored on Microsoft Azure servers which are ISO 27001 certified.|
|Signable||Signable eSignatures||Yes||EU – US Privacy Shield||Encryption at rest. Data is stored on Amazon AWS S3 servers.|