Privacy Notice - e.surv Chartered Surveyors

CALL US FREE TODAY TO BOOK A SURVEY

0800 169 9661

Privacy Notice

e.surv is committed to protecting your privacy and this notice sets out how we handle and or process
your personal data.

In this Privacy Notice the terms, ‘e.surv’, ‘we’, ‘us’ and ‘our’ are references to e.surv Ltd (trading as
e.surv Chartered Surveyors), company number 2264161, having a registered office address of
Lahnstein House, Gold Street, Kettering NN16 8AP. e.surv is part of the LSL Property Services plc
group of companies of which the ultimate parent company is LSL Property Services plc.

e.surv works as both a data controller and a data processor depending on how we receive your
personal data (e.g. your data was provided to us directly, this makes us a data controller or, your data
was provided to us via a lender, this makes us the data processer and the lender the data controller).

This Privacy Notice sets out the basis on which any personal data we collect from you through our
website (www.esurv.co.uk) (the “Site”), or that you provide to us via other methods, will be processed
by us. Please read the following carefully to understand our views and practices regarding your
personal data and how we will treat it, including:

Your privacy is important to us, and we are committed to keeping your information secure and
managing it in accordance with our legal responsibilities under applicable data protection laws. We are
registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration
number Z7734013.

By accessing, browsing or otherwise using the Site you are you are reminded to read and agree with
this Privacy Notice’ contents. If you do not agree with any part of this Privacy Notice, you should not
use the Site or use our services unless you are using the Site or our services as a prospective
employee.

We reserve the right to change the contents of the Site, including this Privacy Notice at any time, by
posting such changes on the Site. It is your responsibility to familiarise yourself with the Privacy Notice
regularly to ensure that you are aware of any changes. Your continued use of the Site following the
posting of any such changes will imply your acceptance of the revised Privacy Notice.

Services

e.surv Chartered Surveyors (e.surv) is a leading provider of residential property risk and surveying
services, committed to delivering accurate and professional guidance on time, every time.

Trading since 1989, e.surv now employs over 550 RICS-registered valuers, supported by a network of
consultant surveyors, and a team of risk and data analysts. We provide property risk expertise, RICS
survey reports, and residential property valuations for major UK mortgage lenders and private
customers.

In June 2013, e.surv acquired Scottish surveying business, Walker Fraser Steele, and still operate
under this brand across Scotland.

e.surv is part of the LSL Property Services group of companies, which includes household names
YOUR MOVE and Reeds Rains, as well as the mortgage broker network, First Complete. We work
with lenders, intermediaries, social housing entities and estate agents, in addition to private customers.

e.surv is one of the UK’s largest valuation providers, directly employing over 550 residential surveyors
across the UK, supported by a network of consultant valuers. The business is one of the largest
distributors and managers of valuation instructions in the UK and is appointed as Panel Manager for
more than 20 mortgage lenders and other entities with interests in residential property. The business
also provides a number of private survey products direct to the home-buying public.

e.surv offers Mortgage Valuations, Homebuyer Surveys, Building Surveys and Remote Valuations
to lenders and members of the general public. A Remote Valuation is an inspection that is conducted
using information accessible via online platforms and does not require a surveyor to physically visit
the property.

The platform used for e.surv’s services is owned by CoreLogic UK. All personal data processed via
this platform will be stored on CoreLogic UK and e.surv servers. All personal data within this platform
will be ‘ring fenced’ to the UK and will not be processed outside of the UK for any purpose. All data
processed within Remote Valuation Assist is compliant with the DPA 2018 and the GDPR.

By using this platform, homeowners and occupiers submit property information, including
photographs, using their smart phone. We process the following personal data under the lawful
basis of Legitimate Interest:

  • Full name
  • Property address
  • Telephone number (to send you a text message with a link to the Remote Valuation Assist)
  • Location (via your mobile phone Location Services)
  • Photographs of the property

Your rights and freedoms will not be affected by the use of Remote Valuation Assist and all
processing of personal data in conjunction with this Privacy Notice.

What is the purpose for processing your data?

Our business receives instructions from major Banks, Building Societies and financial institutions
(lenders) to inspect and value properties for residential mortgage lending purposes. Where this is the
case, we do not have a direct relationship with the end consumer (i.e. the Bank, Building Society or
financial institution’s customer – the mortgage applicant).

Our business however also receives instructions to value and or survey properties for residential
purposes from members of the general public. Where this is the case, the member of public is our
direct customer.

Within the scope of the data protection legislation, e.surv is a “Data Processor” where it receives
instructions from a lender client to value and or survey properties. This is because the customer
relationship is directly between a lender and its customer, not e.surv. In this regard, the lender is
defining the purpose for which and manner in which its customer’s personal data are or are to be
processed and e.surv processes the data in accordance with the lender’s instructions.

Likewise, e.surv is “Data Controller” as defined in data protection legislation where it has a direct
relationship with a member of the public. We receive instructions to value and survey properties from
the general public and therefore it is e.surv who is defining the purpose for which and manner in which
the personal data is or is to be processed.

With regard to its employees, e.surv is a “Data Controller” as it is defining the purpose and manner of
the processing of the data being given to it by its employees.

To support our processing activities we use recognised and established UK suppliers, a list of these
suppliers and what we use them for is available on request. However, the personal data supplied in
the course of our duty as a Chartered Surveying Firm is not used by e.surv or any of our suppliers for
marketing purposes or consumer profiling or selection.

Use of personal data processed by e.surv

e.surv will only process the personal data it receives and collects if it has a lawful basis for processing
it (see below, a requirement under article 6 of the GDPR).

Types of information processed

Personal data means any information relating to a living individual who can be identified, directly or
indirectly from the information such as name, date of birth, address, NI number, email address,
fingerprint or an opinion about an individual.

The GDPR and the Data Protection Act categorise personal data into two categories, personal data
and special category data. The DPA classifies special category data as the processing of personal
data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union
membership, genetic or biometric data that can identify an individual, sexual life or sexual orientation.
This can also include criminal offences and convictions, vulnerability and child data.

e.surv may collect personal data from you in connection with your use of the Site or when you call us
to enquire about our services, this includes, but is not limited to:

  • your name and contact information, including your email address and telephone number
  • the first line of your address and property postcode;
  • such as your property address and property type details; and
  • cookie data

We may also collect additional information from you if you decide to use our valuation or surveying
products or services or if we contact you regarding your enquiry, including personal data such as:

  • the type of property i.e. house, flat, bungalow;
  • when the property was built;
  • how many bedrooms the property has;
  • the estimated value of the property; and
  • your card payment details including the name of the cardholder if you are paying for a valuation or
    survey.

Please note:

a. We do not store card details as we use a card payment processor which encrypts these details
at the point of transmission.
b. Telephone calls are recorded for training and monitoring purposes, however recording stops at
the point where you are required to provide card payment details.

We may also collect and/or process special category data, this includes, but is not limited to:

  • Vulnerability status and details
  • Child data. For example, we may have to not that a child under the age of 18 is at the property
    and we therefore could not carry out our services.
  • Criminal offences / convictions
  • Health and medical history

Methods of Collection

Data, including the personal data we process about you may be provided by a 3rd party lender or
directly provided by you or you appointed party/next of kin. Data is collected via:

  • Data provided from a lender
  • Making an enquiry
  • Making a complaint
  • Attempting employment with e.surv
  • Direct instruction to carry out a private survey

We may also receive information about you from trusted sources such as:

  • Government / Land / Police registers
  • Insurance companies
  • Law firms
  • Heath providers

This information may be provided via:

  • Email, post or telephone
  • Forms and documentation
  • Online portals
  • Cookies

What information is being collected if you are a job applicant?

We may also collect personal data from you (and from others such as managers involved in the
recruitment process and those supplying references and verification information) if you decide to apply
for a job with us including:

  • contact details such as;
    • name
    • address and previous addresses
    • telephone number(s)
    • email address
  • information to identify you including;
    • photographic identification
    • passport and or driving licence
    • signature
  • information about your suitability to work for us including;
    • references
    • notes from interviews
    • records of assessments
    • eligibility to work in the UK (including any work visas);

• the results of a credit reference check, financial sanction check and a basic disclosure & barring
criminal record check relating to unspent convictions;
• information about your skills and experience including your CV, application form, records of
qualifications and training;
• information related to the outcome of your application including the decision and, if you are
successful, details of our offer of employment to you; and certain sensitive or special category
information including medical information where necessary to comply with legal obligations connected
with employment.

What do we do with the personal data we receive?

Your information will be used by us in connection with the following purposes:
Providing you with Valuation and Surveying Services (see “Services”):

  • to allow us to provide you with the valuation and surveying products and services which you have
    asked us to provide;
  • to better understand your requirements and provide you with services specific to your needs;
  • to keep our client records up to date; and
  • to improve our services.

Responding to your queries:

  • to help answer any questions which you have asked one of our surveyors or staff members; and
  • to provide you with a quote for our services.
  • Improving our Site:
  • to analyse cookie and website usage data to keep improving the Site and search functionality; and
  • to allow us to customise the content which is presented to you based on your likely interests.

Legal and Regulatory Obligations:

  • to comply with applicable laws where we are obliged to retain and/or disclose certain information;
  • to investigate or address claims or complaints relating to your use of our services; and
  • for internal and external auditing purposes.

Recruitment where you are a Job Applicant:

  • to assess your suitability to work for us including short listing, assessments and interviews;
  • to conduct pre-employment checks including verification of your identity, checking your legal right
    to work and obtaining references;
  • to conduct a pre-employment credit reference check, financial sanction check and a check in relation
    to unspent criminal convictions in order to prevent crime and other unlawful acts and to protect the
    business and customers from the risk of dishonesty, malpractice or improper conduct;
  • to compare you with other applicants and make a decision whether to offer you employment;
  • to consider any reasonable adjustments either for the recruitment process or if you were to
    commence employment with us in the event that you have a disability;
  • to make a job offer and provide a contract of employment;
  • to prepare to bring you on board as an employee where you accept an offer of employment from us.
    In this case we will continue to use some of the information gathered during recruitment for the purpose
    of your employment and will transfer some of this to our employment systems and files;
  • to contact you if you are not successful should another potentially suitable vacancy arise during the
    six months following the completion of the recruitment process for the role you applied for; and
  • to deal with any query or request for feedback received in relation to our recruitment decision.

Where you are a job applicant we use your information either where necessary to comply with legal
obligations (for example right to work checks or to carry out obligations under employment law in the
case of medical information); to take steps to consider you as an applicant prior to being able to enter
into an employment contract with you; and where we consider it is necessary for the purpose of our
legitimate interests listed above. We also use your information with your consent in relation to checks
carried out in relation to unspent criminal convictions.

In the event that you were not satisfied with our recruitment decision and brought a legal challenge we
would use your information to defend the legal claim.

Other:

  • to transfer information to any entity which may acquire rights in us.

What lawful basis do we use to process your personal data?

The lawful basis under Article 6 GDPR for processing your personal data can differ for each processing
activity carried out. e.surv has identified the following lawful basis for processing:

  • Consent: Where your permission and consent has been provided to allow the processing to
    be undertaken.
  • Performance of a Contract: when you will or have entered into a contract with e.surv or we
    need to process you personal data as part of a contract.
  • Legal Obligation: where e.surv are bound by laws and regulations to process your data. This
    includes but is not limited to:
  • Employment law
    • RICS
    • Data Protection
  • Vital Interest: when the processing is necessary to protect the vital interests of another natural
    person
  • Public Interest: when the processing is for the performance of a task carried out in the interest
    of the public.
  • Legitimate Interest:
    • Risk assessment
    • Training, communication and awareness
    • Cloud storage
    • Web analytics
    • Acquisitions and monitoring
    • Remote Valuation Assist

The lawful basis under Article 9 GDPR and Schedule 1 of the DPA 2018 for processing your special
category data can also differ for each processing activity carried out. e.surv has identified the
following lawful basis for processing:

Article 9 GDPR

  • Explicit Consent: Your permission has been granted and documented directly to us
  • Processing for the purposes of employment and social security
  • Data has been made public by the data subject: for example Electoral Roll
  • Establishing, exercising or defending a legal claim

Schedule 1 DPA 2018

  • Suspicion of money laundering
  • Insurance; advising, underwriting, arranging or administering an insurance contract
  • Pensions
  • Legal claims in connection with criminal conviction data: advice, defending, establishing.

Data retention

The personal data that you provide will be retained by us in accordance with applicable laws and our
internal Retention Policy. However, we will take reasonable steps to destroy or de-identify personal
data we hold if it is no longer needed for the purposes set out above. We will only hold your personal
data on our systems for up to 15 years in accordance with our regulators guidelines (The Royal
Institution of Chartered Surveyors) and for the relevant purposes for which it was collected. A copy
of our Retention Policy is available on request.

Where you are a job applicant we will keep the information we receive about you throughout the
recruitment process and for a period of six months after completion of the process. If you have not
commenced employment with us we will then remove your information (or de-identify it) where we have
not received any query or challenge which is outstanding. We will retain it if needed to deal with any
outstanding query or challenge to the process. Where you become our employee we will keep your
information where relevant to your employment and this will become part of your employment records.

Disclosure of information

The information you provide to us will be held on our computers in the United Kingdom and may be
accessed by or given to our staff to fulfil their duties in the provision of the service you have requested
from us.

We may also disclose your information to the third parties listed below for the following purposes:

  • entities who may or do acquire any rights in us for the purpose of a business sale or reorganisation;
  • our advisers (staff), for the purpose of assisting us to better manage, support or develop our
    business and comply with our legal and regulatory obligations;
  • third parties as necessary in the event of a professional indemnity claim or dispute relating to the
    use of our services (i.e. a Solictor or Legal Firm acting for e.surv);
  • service providers such as other surveying firms and other surveyors if we are instructed to use them
    as part of a contract with a lender client who need to know the information in order to provide us or you
    with a product or service;
  • law enforcement bodies and/or other regulatory entities in order to comply with any legal obligation
    or court order;
  • third parties we work with as part of providing our services, including (but not limited to) IT hardware
    and software providers and payment processing providers (based in the UK). We expect such third
    parties to attest to process any data disclosed to them in accordance with applicable law, including
    with respect to data confidentiality and security and have appropriate services agreements in place
    with each. Payments for services are processed securely and in compliance with the Payment Card
    Industry, Data Security Standard (PCI DSS); and
  • where you are a job applicant we use a recruitment platform provided by ICIMS (a data processor
    engaged by us to support our recruitment); we work with Disclosure Scotland to carry our criminal
    record checks, Experian to carry out credit referencing and Veriphy to complete identity verification.
    We disclose information to the referees you have provided to obtain the relevant references.

These parties are located in the UK.

Links to third party sites

The Site may contain links to other sites. e.surv is not responsible for and accepts no liability for the
content of other sites which are not under its strict control, in particular, we are not responsible for the
protection and privacy of any information which you provide whilst visiting other websites and such
sites are not governed by our Privacy Notice.

Data privacy and security

e.surv is certified to the globally recognised standard for Information Security, ISO 27001:2013 and is
externally assessed for conformance to this standard every six months by the British Standards
Institute. Certification to this standard ensures that our business regularly assesses external and
internal threats to the safety of information and operates with the relevant technical and operational
security controls to keep data safe.

Likewise, e.surv is also certified to ISO 9001:2015, the globally recognised standard for Quality
Management, which ensures that adequate risk management practices are in place to identify and
treat emerging risks and check that procedures are operating effectively. Continued assessment of
conformance to this standard is carried out by the British Standards Institute every twelve months.

Data protection information

You can obtain further information about data protection laws by visiting the Information
Commissioner’s website at https://www.gov.uk/data-protection/the-data-protection-act.

Your rights

Under relevant data protection legislation (the General Data Protection Regulation), individuals have
rights over the processing, retention and deletion of their Personal Data. Not all rights may be available
to each data subject as the rights are dependent on the applicability of the purpose for processing and
lawful basis of processing.

You can exercise your rights verbally or in writing. Upon request and where applicable, e.surv will
comply with your request within 30 days of receipt. Where we have received your data from a lender
(and you are their mortgage applicant), we will refer the request to the lender as the data controller
and comply with any of their requests in the first instance.

If your request is complex, we may require more time and can extend our response time by another
30 days (two months). If an extension is required we will contact you within the original 30 day response
date to explain why we are extending and provide you with a new response date.

Upon the event of having to verify your identification in order to proceed with the request, we will contact
you as soon as possible. Once we are satisfied with your identity, we will continue to process your
request. Please note that only when we are satisfied with your identity will the 30-day response time
begin.

If we refuse your request, we will provide you with a full explanation within 30 days of receipt along
with justification as to why. We will also provide you with your right to complain to the supervisory
authority and information of how to enforce your rights via judicial remedy.

The Right to be Informed; You have the right to know what personal data we are processing, how
we process this data, why we process and to whom we share your data with. This right is satisfied
upon receipt or notification of our privacy notice.

The Right of Access; You have the right to request copies of the personal data we hold and control
relating to you and details of how we use that information.

The Right to Rectification; You have the right, if you think any of the personal data we hold about
you is inaccurate to request that it is corrected.

The Right to Erasure; You have the right to for your personal data to be deleted by us, however this
only applies under certain circumstances.

The Right to Restrict Processing; You have the right to restrict what information we process about
you depending on certain circumstances.

The Right to Object; You have the right to object/stop us processing your personal data where the
lawful basis for this processing is legitimate interest, consent or public interest.

The Right to Data Portability; You have the right to request an electronic copy of your personal data
be sent to you, or to another organisation should you wish. This is however limited to the information
being processed under the lawful basis of consent or the information is being processed under
automated means.

The Right to Automated Decision Making and Profiling; you have the right to request that human
intervention take place in such processing to challenge a decision being made under automated
decision making and profiling.

Contact

If you have any questions or comments about our Privacy Notice or if you wish to exercise your right
to access, correction or erasure or your right to ask us to stop processing your information mentioned
you can contact us either by telephone, email or in writing whichever you prefer.

  • 01536 534000
  • E-mail: Data.protection@esurv.co.uk
  • Post: e.surv Data Protection Officer, Lahnstein House, Gold Street, Kettering, Northants, NN16 8AP

Data Protection Officer:

e.surv has appointed its own data protection officer, Shane Ross. Shane is e.surv’s Head of Risk and Audit,
reporting to the e.surv Risk & Governance Director, a member of the e.surv Board of Directors.

For all e.surv related data protection matters, Shane can be contacted by writing to:

The Risk & Governance Department
e.surv Chartered Surveyors
Lahnstein House
Gold Street
Kettering
Northants, NN16 8AP

What if my personal data is compromised

e.surv has an obligation to inform you within 72 hours of becoming aware of a data breach that is likely
to result in a high risk to your data and rights and freedom, e.surv will also report such breach to the
Information Commissioners Office (ICO) or its lender clients having investigated fully the suspected
breach.

If the breach is likely to result in a high risk to the rights and freedoms of individuals, e.surv will notify
you if your personal data is NOT encrypted or NOT unintelligible.

Complaints

If you have any concerns or complaints as to how we have handled your personal data you
may lodge a complaint with the UK’s data protection regulator, the ICO, who can be contacted
through their website at https://ico.org.uk/global/contact-us/ or by writing to Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.