Privacy Policy for RSPB Tenants

The RSPB (“we”, “our” or “us”) is committed to protecting the privacy and security of its data subjects. This policy explains how and why we use your personal data when we are required to collect information about you, such as when you are a tenant (or a guarantor or prospective tenant) (referred to as “you” or “your” in this policy) and we act as a landlord in respect of your farm tenancy or residential tenancy (or prospective tenancy). For the purposes of data protection law, the RSPB is a controller of the personal data it holds about you as referred to in this policy.

We will never sell your personal data and will only ever share it with organisations we work with where necessary and if its privacy and security are guaranteed.

For details of how we process personal data in relation to our website at www.rspb.org.uk/, including in relation to how we use cookies, please access our cookie and privacy notice at www.rspb.org.uk/help/privacy-policy/.

Your personal data (i.e. any information which identifies you, or which can be identified as relating to you personally) will be collected and used by the Royal Society for the Protection of Birds (charity no. 207076 in England and SC037654 in Scotland with data controller number Z5794583) and RSPB Sales Limited a private limited company with registration number 2693778 and data controller number Z5539068 (together referred to as “RSPB” “we” “our” or “us”).

We only process the minimum amount of personal data necessary to enter into a tenancy agreement with you, to carry out our obligations in relation to that tenancy and to carry out other administrative tasks in relation to that tenancy. The personal data we process may include, for example:

• personal details such as your name and contact details, such as an email address, postal address or telephone number;
• in the case of a residential tenancy, supporting information such as details of your current employment and information to confirm your identity;
• financial information;
• records of your communications with us, including enquiries about a tenancy by telephone or by email; and
• CCTV-recorded footage if cameras are in use on the property.

Information from third parties
We sometimes receive personal data about individuals from third parties who provide services to us, including but not restricted to, in the case of a residential tenancy, organisations providing credit and reference information for the purposes of our background checks. For further details of the third parties who provide us with your personal data please write to our Data Protection Officer at RSPB, The Lodge, Sandy, Bedfordshire SG19 2DL or email dpofficer@rspb.org.uk.

Sensitive personal data
We do not normally collect or store sensitive personal data about you (such as information relating to health, beliefs or political affiliation). If this does occur, we will take extra care to ensure your privacy rights are protected.

We will only use your personal data to the extent that the law allows us to do so. Under applicable data protection law we will usually rely on the following legal bases (or justifications) for processing your personal data:

• to enter into, or perform, a contract (a tenancy) with you;
• to comply with a legal duty; or
• for our own (or a third party’s) lawful interests (‘legitimate interests’), such as our own commercial interests in managing our property and tenancies, provided your rights do not override these interests.

In any event, we will only use your information for the purpose or purposes it was collected for (or else for closely related purposes), such as to enter into the tenancy agreement with you, to perform our obligations under that tenancy agreement and to carry out administrative tasks in relation to that tenancy.

We may share personal data with third parties who provide us with services. For example, in the case of a residential tenancy, we will share personal data with organisations carrying out credit and reference information for the purposes of our background checks, financial organisations (including banks and insurance companies) and contractors who need to carry out works on the relevant property and solicitors. The Tenant’s personal data may be transferred outside the European Economic Area provided that reasonable steps have been taken to ensure an adequate level of protection. The Tenant can obtain further details by contacting the Data Protection Officer using the details given below.

We employ a variety of physical and technical measures to keep your personal data safe and to prevent unauthorised access to, use or disclosure of your personal data. 

Electronic data and databases are stored on secure computer systems and we control who has access to information (by both physical and electronic means). Our staff receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data.

Of course, we cannot guarantee the security of your home computer or the internet, and any online communications you send to us (e.g. information provided by email or our website) are at your own risk.

Where we store information
The RSPB’s operations are based in the UK and we store our data within the European Union. Some organisations which provide services to us may transfer personal data outside of the European Economic Area (which includes the European Union), but we will only allow them to do so if your personal data is adequately protected.

For example, some of our systems use Microsoft products. As a US company, it may be that using Microsoft products results in personal data being transferred to or being accessible from the US. However, we will allow this as we are certain personal data will still be adequately protected (as Microsoft is certified under the US Privacy Shield scheme).

How long we store information
We will only use and store information for so long as it is required for the purposes it was collected for. How long information will be stored for depends on the information in question and what it is being used for.

We continually review what information we hold and delete what is no longer required.

For further details of how long we store your personal data, please write to please write to our Data Protection Officer at RSPB, The Lodge, Sandy, Bedfordshire SG19 2DL or email dpofficer@rspb.org.uk.

We do not envisage that we will need to process the personal data of children beyond recording limited details, such as name and date of birth, in the case of a residential tenancy. The personal data of children will be processed in accordance with this policy.

We want to ensure you remain in control of your personal data. Part of this involves making sure you understand your legal rights, which are as follows:

• the right to confirmation as to whether or not we have your personal data and, if we do, to obtain a copy of the personal data we hold (this is generally known as a subject access request);
• the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the personal data for a lawful reason);
• in certain circumstances, the right to restrict our processing of your personal data;
• the right to object to our processing of your personal data if we are relying on our lawful interests as the basis on which we process your personal data;
• the right to have inaccurate personal data rectified; and
• where technically feasible, you have the right to receive personal data (including having the personal data sent to another organisation) you have provided to us which we process automatically on the basis of your consent or the performance of a contract. This information will be provided in a common electronic format.

Please keep in mind that there are exceptions to the rights above and, although we will always try to respond to your satisfaction, there may be situations where we are unable to do so.

If you would like further information on your rights or wish to exercise them, please write to our Data Protection Officer at RSPB, The Lodge, Sandy, Bedfordshire SG19 2DL or email dpofficer@rspb.org.uk.

We can provide you with a template subject access form which includes guidance on how to make your request (which will help us respond more quickly). Please contact us for a copy of this form.

Complaints
You can complain to the RSPB directly by contacting our Data Protection Officer using the details set out above.

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk.

If wish to make a complaint (including a complaint about fundraising activity) which does not directly relate to your data protection and privacy rights, you can do so in accordance with our charity’s complaint policy.

We will amend this Privacy Policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data. We will provide you with an updated version of this Privacy Policy by the most appropriate method.

This Privacy Policy was last updated on 20th May 2020.