Privacy Notice

Privacy Notice - Member

1. Who we are

In these Terms, ‘Group’, ‘We’, ‘Us’ and ‘Our’ mean the National Residential Landlords Association group (the NRLA), a membership organisation which represents and supports private residential landlords in the UK. It comprises:

• National Residential Landlords Association - a not-for-profit company limited by guarantee (registered in England under number 12187275);
• LPTE Limited - a wholly-owned share company of the NRLA (12249799);
• Homes2Rent Limited (04255833);
• Safe2 Limited (12222247) and,
• Any of the companies wholly owned or controlled by the companies listed above.

The registered office for the group is: Suite 323 Tootal Buildings, 56 Oxford Street, Manchester M1 6EU.

The NRLA is acting as the data controller and determines the purposes for which, and the way in which, your personal data is processed. In this Privacy Notice, ‘our website’ means http://www.nrla.org.uk/, http://www.safe2.co.uk and the associated sub-domains.

We are committed to protecting your privacy and aim to be clear when we collect your information and use it only as you would reasonably expect. You can contact us at [email protected], by telephone on 0161 962 0010, or by writing to the registered office above.

2. Introduction

This Privacy Notice sets out the relationship between the NRLA and you as a prospective, current, associate, or former member (‘you’, ‘your’). It tells you how and why we collect information about you, how it is used and stored and who it is shared with so we are open with you about what information we hold and what we do with it. We act according to the law to protect your rights and ensure the security of the data we hold about you. This Privacy Notice sets out the information we are obliged to give you under the UK General Data Protection Regulation.

A key role of the NRLA is to provide information about developments affecting the private rented sector as well as information and training for landlords, including courses, which are relevant to private landlords. We also provide the Portfolio service, which we own and operate ourselves, to help members manage their properties, finances and tax. We therefore collect, process and store personal data both to help us promote the interests of landlords, to educate them, keep them up to date, and to provide products and services, as well as administering NRLA memberships.

We are careful when selecting the persons with whom we share data and do not share data with third parties except with your consent or where we tell you in advance that this will happen. Data is shared across the NRLA between the companies within the group.

3. The information we hold about you

We collect and handle the following information about you:

• Your personal information and contact details (including joining data for members). This includes title, name, month and year of birth, address, email address and other contact information.
• Your cookie and website preferences on how you would like to be contacted and what about and your activity on our website e.g. pages visited and emails received and read.
• Website visits, including technical information such as how you accessed the site, how you engaged with us during the visit, etc.
• Any information you have provided to us about your rental properties, tenancies, and tenants that you manage. This includes any documentation you have shared with us.
• Any content posted in (Topics, Replies, Reactions etc) in the NRLA Connect Community.
• Membership details (where applicable), including membership type, date of joining, duration of membership, payment information and history, referral information and accreditation information.
• Bank and direct debit details (we do not store any payment card information).
• Where you use Portfolio Plus, financial account and transaction information that you choose to share with us through Open Banking. This can include account balances and categorised income and expenditure relating to your rental properties.
• Where you use Portfolio Pro, the income, expenditure and tax information needed to prepare and submit your Making Tax Digital for Income Tax updates and returns to HMRC.
• Products and services supplied/enquired about, including from third parties.
• Training courses and other events enquired about or attended.
• Communications between us, including emails and audio recordings of calls made to and from us, including complaints.
• Research and material gathered from you in connection with our campaigning and research activities.
• Profiling information that has been obtained from reliable 3rd parties e.g. Experian & Starcount.
• Segmentation information about you and your interactions and engagement with us and our services.
• Inferred and derived information, such as inferred interests, engagement scores and predicted preferences, which we generate to personalise your experience and recommend relevant content.
• Associate information about people who are linked to your membership account.

4. How we collect personal information

We collect personal information about you:

• Directly through our website, our community platform, via our partner websites, over the phone, through surveys and sometimes paper forms.
• Via Local Authorities, third-party intermediaries and our representatives who may provide us with your personal information when they register you for membership with us.
• Through the Portfolio service when you use it to manage your properties; and, where you use Portfolio Plus, from your bank through our Open Banking provider once you have given your consent.
• From your online access to our website or emails, we collect information about the software on your computer or device (your browser version etc.) and your IP address to improve your interaction with our website and for our records. This may happen automatically without you being aware of it.
• Through the use and monitoring of cookies to deliver a better and more personalised interaction. They enable us to recognise you when you return to our website, store information about your preferences and improve the way your searches are processed. For more information about cookies, please see our cookie policy.

5. How we use your personal information

We will not use your personal information unless we have first told you how we will use it, or it is obvious how we will use it. As a membership organisation, we need to collect and use your personal information for:

Managing membership

• Processing membership applications and membership administration, including payment, renewals, providing event information, delivery of continuous professional development and accreditation, campaigning and keeping a record of our relationship with a current or past member.
• Membership benefit administration by post, telephone, email and other electronic means.
• Providing additional member benefits e.g. tax investigation insurance, NRLA Connect Community, NRLA Concierge and access to Portfolio services, provided automatically as part of our membership offer.
• Complying with any legal obligations we have to share personal information.

Providing the Portfolio service

• Operating the Portfolio property management service, which the NRLA owns and runs, to help you list properties, stay compliant and manage your tenancies.
• Where you use Portfolio Plus, retrieving, aggregating and categorising your financial data through Open Banking to give you a view of the income and expenditure relating to your rental properties. Some of this categorisation is automated; you can ask us to review it.
• Where you use Portfolio Pro, preparing and submitting your Making Tax Digital for Income Tax updates and returns to HMRC on your behalf. We do not provide tax advice and you remain responsible for the accuracy of your return.

Facilitating interactions with our partners

• Carrying out credit checks and references on your behalf.
• Processing information about property advertisements, applicants, prospective or actual tenants and guarantors for the purposes of creating and maintaining a tenancy.
• Receiving information about you from a third party where you request a product, service or membership benefit via one of our selected providers.

General administration and marketing

• Keeping a record of your consent to receive marketing emails from us and our partners.
• Understanding the use of our website, including details of your visits.
• Developing profiling or segmentation models to allow us to be more targeted in our marketing.
• Combining your activity across our systems to infer your interests, score your engagement and recommend content, events and services relevant to you. This personalisation produces recommendations only — it does not make decisions with legal or similarly significant effects, it does not use the financial or tax information processed for Portfolio Plus or Portfolio Pro, and you can object to it at any time.

6. Our legal basis for processing personal information

The purposes for which we process personal information are: Contractual - the performance of our contract with you to provide information, membership services, facilitation of bookings; Legitimate interests - informing members of the activities of the NRLA or news in the sector we serve; Consent - providing you with targeted offers and marketing from us or our partners.

The law allows us to collect and use personal data if it is necessary for our legitimate business interest and so long as its use is fair, balanced and does not unduly impact your rights. However, we will ask for your consent to send you marketing emails and text messages. You can withdraw your consent at any time.

When you use Portfolio Plus and Portfolio Pro, we process your financial, income and tax information to perform our contract with you to provide those services. Access to your bank data through Open Banking is based on the consent you give to our Open Banking provider, which you can withdraw at any time. Where we submit information to HMRC through Portfolio Pro, we do so to help you meet your legal obligations under Making Tax Digital for Income Tax.

We personalise your experience and make recommendations on the basis of our legitimate interests in providing you with a relevant and engaging service. You can object to this profiling for direct marketing at any time, and we will stop.

In certain instances, we are required by law to process personal data. In extreme situations, we may share your personal details with the emergency services if we believe it is in your ‘vital interests’ to do so. We may also share your personal information where we are compelled by law to do so.

7. Special Category Data

Special category data (also known as sensitive personal data) is data which requires higher levels of protection. We need to have further justification for collecting and handling this kind of personal information.

The financial, banking and tax information we process for Portfolio Plus and Portfolio Pro is not special category data, but we recognise it is sensitive and we apply appropriate safeguards to it.

We may collect personal data relating to political opinions, and information about health, disability, race and ethnicity if you provide it, to better adjust our service delivery to you. We do not collect personal data regarding party politics, sexual orientation or religious beliefs. We rely on additional legal gateways, including your explicit consent and our legitimate interests as a not-for-profit organisation with a political aim, to process this data with appropriate safeguards.

8. Where we store your personal information

All our information is stored electronically on secure servers located predominantly within the United Kingdom; however, some information is stored in the EEA or the US. All data is encrypted whilst not being used. Personal data held within the Portfolio service, including financial and tax information, is stored in the United Kingdom. Telephone conversations are recorded electronically for monitoring, auditing and training purposes.

By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. Any payment transactions are encrypted and the NRLA do not store any payment information other than your bank details and transaction history.

9. How we may share personal information

We share your personal information across the NRLA group of companies to carry out different activities and provide different entitlements and benefits.

We may share some of your personal information with organisations that carry out processing operations on our behalf. We carry out checks on these companies before we work with them and put a contract and data processing agreement in place. Our primary data processors are:

• Salespoint Limited who provide our website and member management systems.
• GetResponse S.A. who provide our email and marketing automation system.
• Snowflake who provides our data warehouse capability.
• Stripe who handle our card payment services.
• MoneyHub who handle our Open Banking services for Portfolio Plus, including retrieving the financial data used in that service.
• Google who support our Portfolio service and provide advertising support for our services, and who host Portfolio data in the United Kingdom on Google Cloud.
• Tax’d who support the preparation and submission of Making Tax Digital for Income Tax returns for Portfolio Pro.
• Puzzel Ltd who provide our telephony and contact handling services.
• SmartSurvey who provide our survey, NPS and Customer Satisfaction measurement services.
• Microsoft 365 who provide our internal IT services.
• Social media services including Meta, TikTok, LinkedIn & X to better target our online advertising.

Where you use Portfolio Pro, we share your income, expenditure and tax information with HMRC, through the government Making Tax Digital service, to file your updates and returns. HMRC is a separate data controller for the information it receives.

We will not sell personal information other than as part of a sale of a substantial part of our assets. We may, however, need to disclose your details, if required, to the police, regulatory bodies or legal advisors. We will only ever share your data in other circumstances if we have your explicit and informed consent.

10. How we protect personal information

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff and contractors. We also provide guidance and regular data protection training to our staff.

We ensure there are appropriate technical controls in place to protect your personal details; for example, our computer network and servers are protected and routinely monitored to industry standards of good practice (Cyber Essentials Plus and IASME Cyber Assurance).

11. How long we keep personal information

We will only keep personal information for as long as we have a valid reason for keeping it. After that, we delete or dispose of the information securely. We keep personal information about:

• Our past members for six years after membership lapse, this includes records of the advice we have provided.
• Complaints and feedback for six years.
• Tax investigation insurance claims for three years after a settlement has been made.
• Surveys of members for six years after the survey so that data can be referenced for statistical analysis.
• Financial information you share through Open Banking for Portfolio Plus, for as long as you use the service and for [up to 12 months] after you stop using it, unless you ask us to delete it sooner.
• Records relating to your Making Tax Digital submissions for Portfolio Pro, in line with HMRC’s record-keeping requirements (generally at least [five] years after the relevant submission deadline).

12. Your rights

• You have a right to know what personal data we hold, who we acquired it from, how we process it, the logic involved in any automatic processing and to whom we disclose it.
• You have a right to ask us not to process your personal data for direct marketing purposes unrelated to NRLA membership.
• You have a right to ask us not to make decisions based solely on the automatic processing of your personal information.
• You have the right to object at any time to the profiling of your personal data for direct marketing, including the personalisation of content and recommendations.
• You have a right to ask us to erase your personal information.
• These statutory rights are qualified by exceptions and exemptions. To exercise any of these rights, please contact us using the details shown at the start of this Privacy Notice.

13. Complaints

We operate our own internal complaints policy; if you have any concerns about the way we collect or handle data please contact us. Additionally, you have the right to lodge a complaint with the UK supervisory authority at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by visiting www.ico.org.uk.

14. Changes to this policy

We may change this Privacy Notice from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on our website or by contacting you directly.

Document Control