GDPR Privacy Notice

Who are we?

We are HM Block Management Limited of Parkway House, Hambrook Lane, Stoke Gifford, Bristol, BS34 8QB

What do we do?

We have been appointed by your Management Company or Landlord to manage the common areas of your block of flats/ development.

What is our role under the General Data Protection Regulation (GDPR)?

We act as data processor on behalf of your Management Company or Landlord. For certain activities such as maintaining our own business records, we act as data controller. Both the Data Controller and the Data Processor are subject to the Office of the Information Commissioner, the Supervisory Authority.

Information Commissioner’s Office Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

tel : 0303 123 1113 casework@ico.org.uk

https://ico.org.uk

Where did we get your data?

Originally your data was received from either the previous managing agent, the directors of your Management Company or your solicitor on purchase (unless you provided it to us yourself). Subsequently any data received by us was through the Data Controller or directly from you or another Data Processor for the purposes described below.

What is the purpose of processing your data?

Your property is subject to a lease to which you, the Data Subject, and your Management Company or Landlord are party to. We have been appointed by your Management Company or Landlord to administer the covenants of that lease. This involves maintaining accounts, administration and common area matters.

What is the lawful basis for this processing?

1. Processing is necessary for the performance of a contract to which the Data Subject is party [Article 6 GDPR (1)b].
2. Processing is necessary for compliance with a legal obligation to which the Data Controller is subject [Article 6 GDPR (1)c]. In this instance the Management Company is required by the Companies Act 2006 to maintain adequate accounting records and a list of members past and present.
3. Processing is necessary under a legitimate interest.

 

It is necessary to us to process the information we have described so we can perform the role as managing agent for your block. Our processing activities are a reasonable and proportionate method of achieving this. Lessees and tenants etc would reasonably expect us to process their personal information in this way.

What type of data do we keep?

• Names
• Addresses
• Email addresses
• Phone number
• Details of interested parties
• Emergency contacts names
• Emergency contacts addresses
• Emergency contacts numbers
• Tenant names
• Tenant email addresses
• Tenant phone numbers
• Other general contact information
• Payment comments/details
• Transaction details
• Where you become a director, we will also collect your date of birth, occupation and nationality to enable us to register you as a director at Companies House. This information is not retained after registration
• IP address where a document is signed electronically

 

Where is this data stored?

This data is stored in a database called Resident. Resident’s online database is built with encrypted software from Microsoft’s Azure. Data is hosted on Microsoft Azure servers within the United Kingdom. Access is only granted to administrators associated with our office.

Resident acts as a data sub-processor on our behalf. Their processing of your data is governed by a data processing agreement and they are registered with the ICO (registration number ZA330595).

Who is this data shared with?

From time to time we may share your data with the following categories of persons for a specific purpose:

• Accountants
• Solicitors
• Insurers, Insurance Brokers and Loss Adjusters
• Contractors (including maintenance contractors)
• Regulatory Authorities
• Mortgage lenders
• Software providers who process data on our behalf (e.g. Resident block management software)

 

How long will the data be stored?

Your data will be maintained by us for as long as our appointment exists, and for a period of 10 years thereafter to meet statutory accounting and limitation requirements. After this period, your data will be securely deleted unless a longer retention period is required by law.

What if you sell the property?

Where the Lessor is a Company, there is still an obligation on the Data Controller to main adequate accounting records, and a list of past and present members. However if you sell the property only your name, address and transaction details are necessary to satisfy this requirement. All other contact details are erased.

What are your rights?

• You have a right to be informed.
• You may request a copy of your data stored.
• You may request correction to any erroneous data
• You may request deletion of data, if not in violation of statutory or contractual requirements.
• You may request a restriction on processing
• You may lodge a complaint to the controller or object to processing
• You may lodge a complaint to the Supervisory Authority.
• You may withdraw consent if processing originally required consent.

To exercise any of these rights, contact us at info@hmblockmanagement.co.uk. We will respond within one month.

Automated decision-making

We do not use automated decision-making or profiling in relation to your personal data.

What happens in the event of a Data Breach?

In the case of a data breach, we shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Supervisory Authority and Data Subject, if the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.

Changes to this Notice

This notice may be subject to change and we will notify you of any changes.

Where can you find more information?

UK GDPR: https://gdpr-info.eu

Information Commissioner’s Office: https://ico.org.uk