Scotmid Property Services is a trading division of Scottish Midland Co-Operative Society Limited, an Industrial and Provident Society with society number SP2059RS and with its principal office at Hillwood House, 2 Harvest Drive, Newbridge, EH28 9QJ (together, “Scotmid”, “we”, “us”, “our”) strive to protect the privacy of all personally identifiable information collected during the course of our activities and you need to know how we process your data.  We will process your personal information under the terms of this notice and in accordance with any agreement with you.

We are a “data controller” in terms under data protection laws (including from 25 May 2018, the EU General Data Protection Regulation 2016 and the Data Protection Act 2018) (“Data Protection Laws”).

We need to process personal data relating to our suppliers and customers in order to function effectively as a business, ensure good governance, for audit purposes, to perform our business and to enable us to meet our legal obligations.

Personal data is processed for commercial, administrative and statutory purposes. All such personal data is collected and held in accordance with all applicable Data Protection Laws.

We take privacy seriously and will endeavour to handle any personal data we may process with due care and attention.

This privacy statement sets out what we do with personal data in our Property business.    (also see Scotmid Privacy statement at Scotmid.coop)

What is the legal basis for holding your data and what do we use it for?

We hold names, addresses and contact numbers and email addresses for residential tenants, commercial tenants who are private individuals or for private individuals (or the personal details of directors) who we lease property from.  We also hold payment details in the situations where we are tenants.

The legal basis we rely on for processing your data is largely contractual.  We also process some information under the legal basis of legitimate interest.

We rely on legitimate interest for holding some outline details following the end of your tenancy and also for any debt collection activities we undertake.

Processing Conditions

We process the personal data referred to above for the purposes of any contract or potential contract with our suppliers and customers; or for our legitimate interests in order to function effectively as a business, to ensure good governance, for audit purposes, to perform our business activities; and to enable us to meet our legal obligations that we may be subject to.

Who do we share your information with?

We outsource our residential tenant search to property agents who make first contact with most of our residential tenants.  They then manage a credit check process and share the outcome of that with us.  They supply your details to us.

In the event of a default on rental payments, we may pass relevant details to debt collection agencies.

Some of our service providers may have access to your data in the course of providing software and IT support.  Their access is strictly controlled and they are subject to appropriate confidentiality obligations.

Your information may also be shared with our auditors, our professional advisors and other carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality.

How long do we keep your data 

We hold your contact details and any credit check information securely until you cease to be a tenant and all debts are paid.  We then hold some residual information of ex tenants but we do not process this further.  This information is limited to your name, telephone number and possibly email address.  We retain this for archiving purposes.

International transfers

We do not transfer your data out of the European Economic Area

Complaints

If you have a complaint regarding the Society’s use of your data or the way we have handled any request from you to exercise any of the rights requested above then we ask that you contact our Data Privacy Manager,  dataprivacymanager@scotmid.co.uk or by telephone on 0131 335 4400 in the first instance so we can take remedial action, however you also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues at www.ico.org.uk or call 0303 123 1113.

Data security

We have put in place appropriate technical and organisational security measure to protect the security and confidentiality of your personal data.  In addition we have procedures to deal with any data security breach and will notify any affected members and/or the Information Commissioner in compliance with the law if a breach occurs.

Your data rights and obligations

Please inform us of any changes to your contact details.  Details of your data rights and obligations are below.  If you have a concern regarding the accuracy of your personal data held by Scotmid, please contact the Property Team to request an amendment to the data. The Property Team contact details are  AndrewWilliamson@scotmid.co.uk, 0131 335 4535.

If you wish to exercise any of your rights or have any other questions regarding our use of your data, please contact our Data Privacy Manager

 Under certain circumstances, you have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If a Tenant wishes to make a request on any of the above grounds you may contact our Data Privacy Manager, on the contact details below.  Please note that depending on the nature of the request, the Society may have good grounds for refusing to comply.  If that is the case, we will provide an explanation to you.  Generally no fee will be payable, however, we may charge a reasonable fee if your request is manifestly unfounded, repetitive or excessive (particularly if it is repetitive).  We may also charge a reasonable fee to comply with further copies of the same information.  Alternatively, we may refuse to comply with your request in these circumstances.