Find your new home

St Andrews Bureau Ltd - Privacy Policy

St Andrews Bureau Ltd (SAB) are committed to respecting and protecting your privacy.

This Privacy Policy explains when and why we collect personal information about our website visitors, customers and people who contact or interact with us, how we use it, the conditions under which we may disclose it to others and how we keep it secure.

If you do not want us to process your personal information as described in this Privacy Policy, please do not provide information to SAB or use our website www.sab.co.uk.

For questions relating to this Privacy Policy, please contact us at Dataprotection@sab.co.uk or SAB, The Barn, Downing Park, Station Road, Swaffham Bulbeck, Cambridge, CB25 0NW.

About SAB

SAB is a trading name of St Andrews Bureau Ltd whose registered number is 628433 and registered office is The Barn, Downing Park, Station Road, Swaffham Bulbeck, Cambridge, CB25 0NW.

How do we collect personal information about you?

We obtain personal information about you that you provide to us through our website, emails, telephone conversations, documents you provide to us or when you visit one of our branches, for example when you:

  • Enquire about specific properties for rent
  • Apply to rent a property
  • Ask us to value, market or manage your property
  • Register for our ‘new properties’ notifications
  • Interact with us on our social media sites

We also obtain personal information relating to you using automated technical means when you visit our website.

What type of personal information is collected?

The information we collect from you is only relevant to the purpose of your contact with us at that point in time. For example, an initial enquiry should require a lesser amount of information than that needed from a tenant, landlord, vendor, buyer, leaseholder etc. This can include (but is not limited to) your name, address, email address, phone number, date of birth, financial details and any other information you choose to provide to us.

How do we use your personal information and how long do we retain it for?

We review our retention periods for personal data on a regular basis. We are legally required to hold some types of information for certain prescribed periods to fulfil our statutory obligations. Outside of specific statutory obligations, we will hold your personal data on our systems for as long as is necessary for the relevant purposes for which we use it, or in accordance with any retention periods set out in any relevant contract you hold with us.

Enquiring about properties to rent

The information we take (but we are not limited to taking) is your name, address, telephone number, email address, property preference criteria and tenant type information (such as income level, employment status, number of family/ party members) for a maximum period of 6 months from the date of you providing this information to us. This information is retained and stored by SAB on Microsoft 365 systems in UK datacentres and is backed up daily to separate cloud storage.

We may use this data to provide you with information regarding similar goods and services (properties) to those you have already enquired about, or to ask you for feedback about our products or services (such as your opinion on a property viewed). Our legal basis for this use is our legitimate interest, namely the ongoing marketing of our goods or services with those who we have an existing relationship (or who have expressed an interest) in connection with our goods or services. Also, namely the need to obtain viewers feedback from properties viewed to provide landlord clients with a service they expect.

Tenants

Applicants who apply to become tenants are required to provide personal information including current and previous address, phone numbers, email addresses, bank account details, next of kin address and contact details, employment details to include position, landlord contact details, personal referees’ contact details and next of kin details, however this is not an exhaustive list. Documents required are (but not limited to) photo ID such as passport or driving license, visa documents, proof of address and bank statements. This is provided by the applicant supplying the information and documents directly onto the GoodLord website (note they provide their own Privacy Policy as they are a third party). SAB have access to this data via a private portal section for clients using a multi-password protected login access. InventoryBase (Radweb Ltd) are a web-based platform that SAB use and control to supply tenants with property reports. SAB have access to this via a private portal section for clients using a password protected login access, where property reports are stored and tenant names and email address are entered onto this to allow the reports to be sent directly from InventoryBase (note they provide their own Privacy Policy as they are a third party). SAB retain ID documents as we are required to sign and verify these to comply with Right to Rent Legislation. These documents are retained and stored on Microsoft 365 systems in UK datacentres, with access restricted to senior staff who require access for their job function. The data is backed up daily to separate cloud storage. This data is retained for at least two years from the end of the tenancy. The legal basis for this is the requirement under the Right to Rent legislation to retain these document copies for two years.

All other data and documents relating to the tenancy are stored within our SAB GoodLord (platform within the Cloud using Amazon Web Services based in Ireland), Jupix (Cloud based with Jupix Servers located in England, Ireland and France). This data is retained for six years from the end of the tenancy (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a tenant to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (and our clients’ interests) and enable us to provide evidence in the event of a potential claim.

We may use tenant’s name, address, email address and telephone number to communicate with you in relation to arranging property access for us, the landlord, maintenance/safety check contractors and in relation to tenancy administration such as notices, contracts and legislation updates, as well as to respond to enquiries or requests from you, or from your landlord to pass onto you. Our legal basis for this use is our legitimate interest namely to carry out activities during the course of SAB business in response to customer enquiries and requests, as well as to comply with the contract that SAB has with the landlord to provide specific letting and property management services on their behalf.

Landlords

If you instruct SAB to market/let or manage your property, a terms and conditions of business and a client/ property questionnaire are required for completion. The personal data may include (but are not limited to) name, postal address, bank details, insurance information and mortgage details. The data is stored within Jupix (Cloud based with Jupix Servers located in England, Ireland and France). The document completed and signed by you will be saved in electronic format to our Company Server only.

This data is stored for six years from the end of the landlord/ agent contract (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a tenant or landlord to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (or our clients’ interests) and enable us to provide evidence in the event of a potential claim.

Estate Management (Leaseholders, Freeholders and Tenants)

Personal information for individual leaseholders and freeholders includes name, address, telephone number and email address which are stored by SAB within our data processing database Veco located on our Company Server which has a daily encrypted backup to secure cloud storage. The data is retained for the duration of an individual’s ownership of the leasehold property or the duration of SAB’s contractual management of the building, whichever ends sooner. This data is then stored for six years from the completion date (and therefore six years from the end of the contractual obligation). Our legal basis for this period is that legislation allows a buyer or vendor to submit a legal claim within six years from the end of the contractual obligation. We therefore retain the documents to protect our interests (or our clients’ interests) and enable us to provide evidence in the event of a potential claim.

We may use your name, address, telephone number and email address for carrying out our obligations arising from any contracts entered into by you and SAB (or by you and a client for which SAB acts as The Agent), such as providing information, products and services relevant to a lease hold property. Our legal basis for this use is that it is necessary for the performance of a contract to which you are a party.

Hard Copy Data

Hard copies of documents containing personal data as described in all sections above are retained in locked cabinets within the office and all offices are locked and secure outside of office hours or if unattended. SAB staff follow strict data protection policies to ensure that data remains private and out of sight of third parties when in use. Such hard copies are shredded as soon as practically possible and within 24 hours of its redundant use.

Website

We may use the information that we automatically collect using technical means through our website to:

  • Administer our site and for troubleshooting, testing, research and statistical purposes. We use Google Analytics and Google Webmaster, third-party website monitoring tools. Our legal basis for this is our legitimate interest namely monitoring the use of our software and IT systems and improving our website.

This automated collection of information may involve the use of cookies. Please see our Cookies Policy for further detail about these https://www.sab.co.uk/en/cookies

We may analyse the personal information we collect directly from you and obtain using automated technical means to create a profile of your interests and preferences so that we can contact you with information relevant to you (if you have chosen to receive marketing communications from us).

Who has access to information?

We will not sell or rent your information to third parties.

We may pass your information to third party service providers, including but not limited to:

  • Business partners, suppliers and sub-contractors working on our behalf for the purposes of completing tasks and providing services to you. The main purpose for example is maintenance contractors contacting tenants directly to arrange access to their home to attend to maintenance or safety checks. The details for these third-party contractors are provided by SAB to you at the time of the maintenance matter or routine safety check being addressed.

When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and otherwise use your information in accordance with applicable data protection law.

We may disclose your personal information to our insurers and /or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice, and managing legal disputes.

We may transfer your personal information to a third party as part of a sale of some or all of our business and assets, or as part of any business restructuring or reorganisation, or if we are under a duty to disclose or share your personal data in order to comply with any legal obligation or to enforce or apply our terms of use or to protect the rights, property or safety of our customers. However, we will take steps with the aim of ensuring that your privacy rights continue to be protected.

In addition to the specific disclosures set out in this section, we may disclose your personal information where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person, or for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative out-of-court procedure.

We will not pass your information on to a third party for reasons not relevant to your specific requirements under the service that you expect SAB to provide to you.

Your rights

In this section we have summarised the rights that you have under data protection law. Some of the rights are complex, applying only in certain circumstances and subject to certain exceptions, and in the interests of keeping this policy concise, not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

You have the right:

  • To object to us processing your personal information for marketing purposes. If you object, we will stop processing your personal information for this purpose. When we collect your data, you can choose whether you wish to receive marketing communications from us. If you wish to stop receiving marketing communications, you can opt out at any time by clicking an ‘unsubscribe’ link at the bottom of one of our emails.
  • To access the information, we hold about you and certain information about our processing of it and your rights in relation to it.
  • In certain circumstances, to obtain erasure of the personal information we hold about you, subject to certain exceptions.
  • To rectification of the information we hold about you.
  • In certain circumstances, to restrict our processing of your personal information or object to us processing it. If you object, we will stop processing your personal information unless certain exceptions apply.
  • Where our legal basis for processing your personal information is your consent or the performance of a contract and we process it by automated means, to be provided with the personal information we hold about you in structured, commonly used and machine-readable format and to transmit the information to another controller.
  • To not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly affecting you, subject to certain exceptions.
  • Where our processing of your personal information is based on your consent, to withdraw that consent at any time. If you withdraw your consent, we will stop the relevant processing, but it will not affect the lawfulness of our processing before the withdrawal.

To exercise any of these rights, email us at Dataprotection@sab.co.uk or write to us at The Barn, Downing Park, Station Road, Swaffham Bulbeck, Cambridge, CB25 0NW. In addition, you can exercise your right to object to direct marketing at any time by clicking an ‘unsubscribe’ link at the bottom of one of our emails.

If you consider that our processing of your personal information infringes data protection laws, you have the right to lodge a complaint to a supervisory authority responsible for data protection. You may do this in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. More information about lodging a complaint with the Information Commissioner’s Office (the relevant UK supervisory authority) can be found at https://ico.org.uk/concerns/.

Security precautions in place to protect your information

We take appropriate technical and organisational precautions to secure your personal information and prevent its loss, misuse or alteration. We use privacy screens on our PC’s (where necessary) and mobile devices to prevent screens from being visible to third parties. We operate a screen lock policy where all office PC’s screen lock after two minutes without use.

Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

The transmission of unencrypted (or inadequately encrypted) data over the internet is inherently insecure, and for this reason we cannot guarantee the security of data sent between us over the internet.

Use of Cookies

Like many other websites, our website uses cookies. 'Cookies' are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns.

Cookies allow us to provide important site functionality, so you don’t have to re-enter lots of information. They also allow us to remember what links and pages you have been or viewed during a session. This helps us deliver a better, more personalised service to you.

It is possible to switch off cookies by setting your browser preferences. For more information on the Cookies we use, visit our Cookies Policy https://www.sab.co.uk/en/cookies

Links to other websites

Our website may contain links to other websites run by other organisations. We are not responsible for the privacy practices of those organisations or the content of their websites. You should read the privacy policies of these organisations before providing them with any personal information.

Transferring your information outside of European Economic Area (“EEA”)

SAB do not transfer data to countries outside the EEA.

If you use our services while you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services.

Data Breach Policy

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

SAB will record any data breach, regardless of the severity or any requirement to report the breach to any relevant supervisory authority or the affected individual. Should a data breach occur which has a high risk of affecting the individual’s rights and freedoms, we will inform the individual without undue delay. We have an internal reporting procedure and investigation procedure in place. This system facilitates the decision making on the necessity to report breaches to individuals and/ or the relevant supervisory authority.

Review of this Policy

We keep this Policy under regular review. This Policy was last updated on 10th September 2024.

If we change our Privacy Policy, we will post the changes on this page and may place notices on other sections of the website and/or notify you by email.

Further information

You can obtain further information about data protection laws by visiting the Information Commissioner's Office website at www.ico.org.uk.