Privacy notice

Overview

The Lambert Smith Hampton (LSH) privacy notice provides information on how LSH and any of its subsidiaries, branches or representative offices and any 3rd party providers collect, use, secure, transfer and share your information. LSH, and its affiliates, is a leading provider of commercial property agency, property management, auctions and consultancy services. It operates in over 30 locations with over 1400 employees within the UK and Ireland.

Lambert Smith Hampton takes data protection very seriously. The use of the internet pages of LSH and its subsidiaries/branches is not possible without the provision of some personal data; however, if a Data Subject wishes to use certain services via our website, processing of further personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we will obtain consent from the Data Subject.

Personal Data processing shall always be in line with the General Data Protection Regulation (GDPR) and in accordance with the country-specific legislation applicable to LSH. By means of this Privacy Notice, we inform you why we collect and process personal data and Data Subjects rights relating to the collection and processing of Personal Data.

Definitions (Article 4 of the GDPR)

This Privacy Notice is based on the terms used by the European legislator for the adoption of the GDPR, but for ease of understanding, the following definitions apply:

Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, where the purposes and means of such processing are determined by Union Member State Law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Personal Data: any information relating to an identified or identifiable natural person (Data Subject).

Data Subject: any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing. An identifiable natural person is one who can be identified directly, or indirectly, in particular by reference to an identifier such as name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Third Party: a natural or legal person, public authority, agency or other body, other than the data subject, controller, processer and person who, under the direct authority of the controller or processor, are authorised to process personal data.

Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction.

Consent: consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subjects wishes by which he or she, by a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Name and address of the Data Controller (Head Office):
Lambert Smith Hampton
5th Floor, UK House
180 Oxford Street, London W1D 1NN
www.lsh.co.uk

Name and address of the Data Protection Officer (DPO):
Data Protection Officer
Lambert Smith Hampton
5th Floor, UK House
180 Oxford Street, London W1D 1NN
GroupDPO@lsh.co.uk

Name and address of the Lead Supervisory Authority (UK):
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
www.ico.org.uk

Name and address of the Lead Supervisory Authority (Ireland):
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, DO2 RD28, Ireland
www.dataprotection.ie

Cookies

The internet pages of LSH and its subsidiaries/branches use cookies. Cookies are text files that are stored in a computer system via an internet browser. Many cookies contain a ‘Cookie ID’, which is a unique identifier of the cookie consisting of a character string through which internet pages and servers can be assigned to the specific internet browser in which the cookie was stored. This allows visited internet sites and servers to differentiate the individual browser of the data subject from the internet browsers that contain other cookies. A specific internet browser can be recognised and identified using the unique cookie ID. Cookies allow us to recognise our website users, the purpose of this recognition is to make it easier for users to utilise our website. Set cookies may be deleted at any time via an internet browser or other software programs. If a data subject deactivates the cookie setting in the internet browser used, this may result in some functions of our website being unusable. Please see our Cookie Policy on our website for further details www.lsh.co.uk

Reason/Purposes for Processing Information

LSH serves most major lenders, investors, developers, commercial businesses, corporations, local authorities, housing associations and the general public. LSH processes personal information to enable us to provide our full range of services, promote our services, maintain our accounts and to support and manage our employees. Full details of our services provided can be found on our website: www.lsh.co.uk

Typical types of information LSH collects will include.

Typical types of Identification LSH will also collect (for Anti-Money Laundering Purposes) will Include:

Typical data categories LSH will also collect (for A3 Relocation Services) will include:

Methods of collection

In the general conduct of business, LSH collects information relevant to the services being sought across the range of services it offers (listed on our website) from:

• Yourself (the data subject)
• Next of kin, spouse, partner, family member
• The LSH and its affiliates’ Websites
• “trusted” sources including:
  • Property portals
  • Government/Land Registers
  • Insurance companies
• Through consent to third parties disclosing information about you to us that they have collected.

Such information will generally be collected directly via the use of any of our standard forms, over the internet, via email, in our offices or through a telephone conversation with you. We may also collect personal information through our affiliates or suppliers. In addition, you may choose to submit information directly to us via several methods, including:

• through LSH and its affiliates’ websites
• in response to marketing or other communications
• through social media
• by signing up for a LSH or its affiliates’ product or service
• through participation in an offer, program or promotion
• in connection with an actual or potential business, or an employment relationship with us
• at events, conferences, and seminars

You may also agree to third parties disclosing information about you to us that those third parties have collected.

We, our service providers and partners collect certain information by using automated means, such as cookies and web beacons, when you interact with our advertisements, mobile applications, or visit our websites, pages or other digital assets. The information we collect in this manner may include: IP address, browser type, operating system, referring URLs and information on actions taken or interaction with our digital assets.

We may use third-party web analytics services on our websites and mobile apps. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyse how visitors use our websites and apps.

“Your Rights and Choices” section of this Privacy Notice specifies your ability, to opt out or limit the usage of the information collected.

Purposes of collection

Generally, we will collect, use and hold your information for the purposes of:

• • Assessing applications for and providing LSH and its affiliates’ products/services
  • Conducting business, developing relationships with LSH and its affiliates
  • Process payment transactions including: accounting, authorisation, clearing, chargebacks, auditing, billing, reconciliation, collection, complaints, enquiries, credit checks and related dispute resolution activities
  • Protect against and prevent fraud, unauthorised transactions, money laundering, tax evasion, claims, other liabilities and manage risk exposure and agent/franchise quality, integrity, compliance and security of business processes
  • Create and manage any accounts, associated authentication criteria (ID’s and passwords) you may have with LSH
  • Provide, administer and communicate with you about LSH products, services, offers, programs and promotions, their issuers, acquirers, retailers and partners.
  • Compile business directories, including business contact information
  • Operate, monitor, evaluate and improve our products, services, websites, mobile applications, other digital assets and business
  • Developing new products and services
  • Managing communications, assess effectiveness and optimisation of advertising
  • Functionality of our websites, mobile applications other digital assets
  • Evaluate your interest in employment and contact you regarding possible employment opportunities
  • Enforce LSH Terms of Use, other legal rights as may be required by applicable laws and regulations or requested by any judicial process or governmental agency having or claiming jurisdiction over LSH or its affiliates.
  • Comply with industry standards and LSH policies

• • In order to provide focused marketing and information, especially with regard to the collection of photography and videography for building/site inspections or marketing purposes.

Purposes of Collection – Photography/Videography

Lambert Smith Hampton will take photographs of properties/site inspections for the purposes of valuation reports, building/site inspections, property management inspections etc. We have a legitimate interest for taking such photographs as an accurate record of the condition of the property at that time.

Photography and/or videography may also be taken at events, under a legitimate interest, in order to keep a record of the event and/or to use for marketing purposes on social media, our website and other promotional material following the event and for publicity of future events. Any event attendee not wishing to be part of our photography or filming should advise a member of the events team, whose details will also be on your invite at the time. One to one filming/interviews may also take place at such events, where specific informed consent will be sought prior to commencement of the event.

Rights of the Data Subject (Articles 12-23 of the GDPR)

GDPR affords EU Data Subjects with rights, which are summarised below. In order to assert any of these rights, the Data Subject may contact the Data Protection Officer listed above, or any LSH employee at any time.

Your rights regarding the sensitive/personal information we maintain about you enable you to exercise choices about what personal information we collect from you, how we use that information, and how we communicate with you.

Right of Access and Confirmation
You shall have the right to:

• Obtain confirmation that we hold personal information about you and request access to/copies of the personal information we maintain about you.
• Obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

Please note: The right to access personal information may be limited in some circumstances by local law requirements.

Right to Rectification
If you feel that the information we hold about you is incorrect or inaccurate you can contact us outlining the information you feel is incorrect of inaccurate. If we refuse to correct your personal information, we will provide you with a written notice that sets out the reasons for our refusal (unless it would be unreasonable to provide those reasons) and provide you with a statement regarding the mechanisms available to you to make a complaint. We will provide you with access to information we hold about you.

Right to Object
If you would like to object to any processing of your information by LSH you can contact us outlining what processing of information you would like to object to.

Right to Restrict and Erase (Right to be Forgotten)
If you would like LSH to delete, block or anonymise information we hold about you, you can contact us outlining what information you would like deleted, blocked or anonymised.

To update your preferences, ask us to remove your information from our mailing lists or submit a request to access, update, correct or delete your personal information, please contact us as specified in the ‘Complaints and Feedback’ section below.

Opting Out of Automated Individual Decision-Making (including profiling)
You can opt out of personal information collection by automated means e.g. when visiting our website or visiting third-party websites, and interact with our adverts, by using the cookie consent tool displayed in the website (the browser you use may provide options on how to opt out of receiving certain types of cookies). However without cookies you may not be able to use all of the website features and/or online services.

LSH operates a cookie policy, which can be located on our website: www.lsh.co.uk

Some of our service providers and partners may collect information about your online activities over time and across third-party websites to customise and target our adverts.

You can ask us not to send you marketing communications by:

• e-mailing GroupDPO@lsh.co.uk
• unsubscribing via the ‘unsubscribe link’ within the marketing e-mails you receive from us.

Right to Withdraw Consent
Where we obtain your personal data by consent, you have the right to withdraw consent to the processing of your personal data at any time.

LSH will apply your preferences going forward. Doing so will mean that you cannot take advantage of certain LSH and affiliate products, services and promotions.

The right to withdraw consent of processing personal data may be limited in some circumstances by local law requirements and you will be informed appropriately where this is the case.

You can exercise your right to prevent data processing by following the instructions on our website pages where we collect your data or alternatively invoke the right to be forgotten by clicking the unsubscribe/stop all email communications link listed on all our email communications, or by writing to us. On receipt of this request we will remove your personal data, where we are required by law to do so, from our central CRM system and all email marketing will cease with immediate effect.

Anti-Money Laundering

In addition, to help you with a property related service, LSH must to comply with certain regulations, for example, the ‘Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (referred to as ‘the Regulations’).’ LSH is required to obtain certain information from you to comply with the Regulations. The information provided will only be used by LSH in relation to complying with the Regulations and will not be shared with any other party outside of our group businesses, unless we are required to do so by law.

If you decide to enter into a business relationship with LSH, to comply with certain regulations, we will require two separate identification documents – one primary and one secondary document even if it appears on both lists. The information may be required at various stages of the process depending whether you are Purchasing or selling.

We reserve the right to employ third party electronic verification for the purpose of verifying identity. This search will not affect your credit rating.

Lawful bases of processing (Article 6 of the GDPR)

LSH processes personal information under the following lawful bases:

• Performance of a contract: where you enter into a contract with LSH or its affiliates and we need to process your information as part of this contract
• Legitimate interests: some information is processed by LSH as part of its legitimate interests which include: fraud, risk assessment, due diligence, network and information security, suppressions and managing opting out of communications, profiling, direct marketing, monitoring, web analytics, cloud storage, acquisitions, updating customer details, lettings, sales, financial services and other core products and service provided by the data controller to carry out our business in favour of the well-being of all of our employees and shareholders
• Public interest: where processing is necessary for the performance of a task carried out in the interest of the public, or in the exercise of official authority.
• Consent: where we process information under consent we will seek clear and unambiguous consent prior to processing your data
• Legal obligation: where processing is necessary in order to fulfil a legal obligation, such as for anti-money laundering due diligence checks
• Vital interests: where personal data may need to be processed/shared in order to uphold the data subject, or other natural persons vital interests

Information we share

We do not sell or otherwise disclose personal information we collect about you, except as described in this Privacy Notice or as indicated via the consent process at the time the data is collected. We share the information we collect with, but not limited to:

• Vetted affiliates and partners, such as online bidding platforms for our auctions services
• Landlords and landlord associates and sub processors
• Formally contracted service providers to perform services on our behalf:
  • Hosting datacentres, infrastructure, applications (development/support), cloud services (software as a service – SaaS, platform as a service – PaaS, infrastructure as a service – IaaS)
  • Helpdesk, call centres etc.
  • Contractors and Sub contractors appointed to undertake necessary works
  • Employees and other Agents of the Client appointed to undertake necessary works at a development
  • Solicitors, accountants and other professional bodies instructed on behalf of the Client
  • Leasehold Payment Service and Co-Sec Management Services
  • Suppliers appointed to undertake compliance and regulatory activities, such as internal audit.

We contractually require these service providers to safeguard the privacy and security of personal data they process on our behalf and authorise them to use or disclose the information only as necessary to perform services on our behalf or comply with legal requirements:

• Councils, health and care providers
• Other law firms
• Credit agencies, Land Registry Office, Her Majesty’s Revenue and Customs (HMRC), Financial Conduct Authority (FCA) and other relevant regulatory bodies
• Additionally, we may share information about you, if required legally, to prevent harm or financial/reputational loss, for investigation of suspected or actual fraudulent or illegal activities
• Prospective employers requesting references via your written consent

Features can be accessed, on websites, where we partner with other entities who are not affiliated with LSH. These include, but are not limited to, social networking, geo-location tools etc. which are operated by third parties (indicated appropriately), who may use or share personal information in accordance with their own privacy policies. It is recommended that you review the third parties’ privacy policies if you use such relevant features.

Data Transfers, Including Internationally and to Third Countries (Articles 44-50 of the GDPR)

LSH reserve the right to transfer your information in the event of a sale or transfer (wholly or partially) of our business or assets, with reasonable efforts for the acquirer to protect/use your information consistent with this Privacy Notice. You can exercise your rights to contact the acquiring entity with questions concerning the protection and processing of your information.

LSH may transfer the personal information collected about you to recipients in countries other than the country in which the information was originally collected. Those countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your information to other countries, we will protect that information as described in this Privacy Notice and in full compliance with all aspects of the GDPR and in accordance with the country-specific legislation applicable, or as otherwise disclosed to you at the time the data is collected (e.g. via a program specific privacy notice).

Profiling

For the purposes of business conduct, enhancement, identification of fraud, money laundering and other potential un-authorised activities, LSH engages profiling activities via direct use or anonymisation of sensitive personal information.

Direct profiling

Direct profiling is engaged for the fair and lawful purposes, to provide LSH the ability to enforce LSH Terms of Use, legal reporting as may be required by applicable laws, regulations, policies/standards or requested by any judicial process or governmental agency having or claiming jurisdiction over LSH or its affiliates; including, but not limited to:

• Benchmarking employees: appraisals, performance, bonus payments, disciplinary actions, improvement plans, promotions and awards
• Background checks for existing and new employees, clients, business partners, affiliates
• Financial Viability analysis/reports
• Business partner/client portfolio position, performance, risk positions
• Anti-money laundering
• Tax reporting
• Credit defaulting exposure

Indirect profiling

Indirect profiling via anonymisation of personal information is also used for preparing and furnishing aggregated data reports showing anonymised information, including, but not limited to, the following:

• Compilations, analyses, analytical and predictive models and rules, and other aggregated reports for the purpose of advising our partners/affiliates and servicing institutions, retailers and other customers regarding past and potential future patterns of service usage, spending, fraud, and other insights that may be extracted from this data
• Compiling and communicating promotional and marketing information about products and services that LSH Group, affiliates and other organisations that we have affiliations with have and that may be of interest to you.
• Conducting market research
• Facilitating our internal business operations, including the fulfilment of any legal requirements.

Security of Processing Personal Information (Article 32 of the GDPR)

The security of your personal information is very important and LSH is committed to protecting the information we collect. We maintain administrative, technical and physical safeguards designed to protect the personal information you provide, or we collect, against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use. We use SSL encryption on our websites from which we transfer certain personal information.

Access to personal data is restricted only to those who have a legitimate business need and data processed by third parties is only done so under strict instruction from LSH, as per the terms of their contract.

Procedures are in place to ensure breaches, or suspected breaches, are dealt with in a timely and secure manner with applicable notification applied within the required timeframes set out in accordance with the DPA 2018 and the GDPR.

Retention Period

LSH’s criteria for storing personal data is in accordance with the statutory retention period within the UK and in line with LSH’s Data Retention and Destruction Policy, unless otherwise required or authorised by applicable law. We take measures to securely destroy or permanently de-identify personal information if required by law, or if the personal information is no longer required for the purpose for which we collected it. LSH will generally keep personal information for 7 years after the last contact with you; however, LSH reserves the right to keep information for longer if it is required to do so in relation to legal proceedings or the fulfilment of a contract.

Contractual Obligation of the Data Subject/Possible Consequences of Failure to Provide Such Data

The Data Subject has a contractual obligation to provide personal data to LSH where the provision of personal data is required by law (e.g. tax regulations, Anti-Money Laundering etc.), or can also result from contractual provisions i.e. information on the contractual partner. Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The Data Subject is, for example, obliged to provide us with personal data when LSH signs a contract with the Data Subject. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.

Data Protection for Employment & Recruitment

LSH shall collect and process the personal data of applicants for the purpose of the processing of the application procedure. The processing may also be carried out electronically. This is the case, in particular, if an applicant submits corresponding application documents by email or via web application to LSH. If LSH concludes an employment contract with an applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded with the applicant by we may securely destroy/erase the applicants’ data.

General

You may not transfer any of your rights under this Privacy Notice to any other person. We may transfer our rights under this Privacy Notice where we reasonably believe your rights will not be affected.

If any court or competent authority finds that any provision of this Privacy Notice (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted and the validity and enforceability of the other provisions of this Privacy Notice will not be affected.

Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other right or remedy.

This Privacy Notice will be governed by and interpreted according to the law of England and Wales. All disputes arising under the notice will be subject to the exclusive jurisdiction of the England and Welsh courts.

Complaints and Feedback

If we fall short of your expectations in processing your personal information or you wish to make a complaint about our privacy practices or a breach of your personal information, applicable privacy laws/principles, or have a concern about LSH privacy practices, would like access and/or update information or preferences you provided to us, please click here Alternatively, you may also e-mail: GroupDPO@lsh.co.uk

To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time. If we cannot for lawful reasons complete your request we will explain this to you to the extent that we lawfully can.

Under Article 77 of the GDPR, you also have the right to lodge a complaint with a Supervisory Authority, if you feel we have, or are, processing your personal data in a way in which infringes the Regulation (GDPR).

Updating this Privacy Notice

We will update this Privacy Notice from time to time, so we suggest that you review it at regular intervals. Where we undergo substantial changes to our privacy statement we will endeavour to inform you directly about these changes.

Version: V2 03/03/2020  Last Review Date: 03/03/2020