Privacy Notice

Introduction

e.surv is committed to protecting your privacy and this notice sets out how we handle and/or process your personal data. In this Privacy Notice the terms, ‘e.surv’, ‘we’, ‘us’ and ‘our’ are references to e.surv Ltd (trading as e.surv Chartered Surveyors), company number 2264161, having a registered office
address of Orion House, Orion Way, Kettering NN15 6PP. e.surv is part of the LSL Property Services plc group of companies of which the ultimate parent company is LSL Property Services plc.

e.surv acts as both a data controller and a data processor depending on how we receive your personal data (e.g. if your data is provided to us directly by you, this makes us a data controller or, if your data was provided to us via a lender, this makes us the data processor and the lender the data controller).

We are committed to keeping your information secure and managing it in accordance with our legal responsibilities under applicable data protection laws. We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration number Z7734013.

This Privacy Notice sets out the basis on which any personal data we collect from you through our website (www.esurv.co.uk) (the “Site”), or that you provide to us via other methods, will be processed by us. Please read the following carefully to understand our practices regarding your personal data
and how we will treat it, including:

• Website
• Services
• What is the purpose of processing your data?
• What lawful basis do we have to process your personal data?
• Use of personal data
• What information is being collected?
• What information is collected if you are a job applicant?
• What do we do with the information we receive?
• Data retention
• Disclosure of information
• Links to third party sites
• Data privacy and security
• Data protection information
• Your rights
• Contact
• What if my personal data is compromised?
• Complaints

Website

By accessing, browsing, or otherwise using the site you are reminded to read and consider this Privacy Notice’ contents. If you do not agree with any part of this Privacy Notice, you should not use the site or use our services unless you are using the site or our services as a prospective employee.

We reserve the right to change the contents of the site, including this Privacy Notice at any time, by posting such changes on the Site. It is your responsibility to familiarise yourself with the Privacy Notice regularly to ensure that you are aware of any changes. Your continued use of the Site following the posting of any such changes will imply your acceptance of the revised Privacy Notice.

When accessing and using our website (https://www.esurv.co.uk) for our services we will collect and process the following personal information about you:

• Name
• Email
• Mobile
• Address

We will use the information that we collect about you for the following purposes:

• Marketing / Promotional
• Support
• Administration Information
• Targeted Advertising

If we want to use your information for any other purposes, we will ask you for consent and will use your information only on receiving your consent and then, only for the purpose(s) of for which grant consent unless we are required to do otherwise by law.

We will not transfer your personal information to any third party without seeking your consent, except in limited circumstances as described below:

• Ad Service
• Marketing Agencies
• Analytics
• Data Collection and Process

We may also disclose your personal information for the following: (1) to comply with applicable law, regulation, court order or other legal process; (2) to enforce your agreements with us, including this Privacy Policy; or (3) to respond to claims that your use of the Service violates any third-party rights. If the Service or our company is merged or acquired with another company, your information will be one of the assets that is transferred to the new owner.

Services

e.surv Chartered Surveyors (e.surv) is a leading provider of residential property risk and surveying services, committed to delivering accurate and professional guidance on time, every time.

Trading since 1989, e.surv now employs over 550 RICS (Royal Institution of Chartered Surveyors) registered valuers, supported by a network of consultant surveyors. We provide property risk expertise, RICS-compliant survey reports, energy performance certificates (EPCs) and residential property valuations for major UK mortgage lenders and private customers.

In June 2013, e.surv acquired Scottish surveying business, Walker Fraser Steele, which still operates under this brand across Scotland.

e.surv is part of the LSL Property Services group of companies, which includes an Estate Agency franchise, as well as the mortgage broker network, PRIMIS. It is one of the largest distributors and managers of valuation instructions in the UK and is appointed as Panel Manager for more than twenty mortgage lenders and other entities with interests in residential property.

We work on behalf of lenders, intermediaries, social housing entities, estate agents and provide a number of private survey products direct to the home-buying public (including Mortgage Valuations, RICS compliant Surveys, Building Surveys. EPCs and Remote Valuations). A Remote Valuation is an
inspection that is conducted using information accessible via online platforms and does not require a surveyor to physically visit the property.

The software used to provide e.surv’s services is a third-party software owned by CoreLogic UK. All personal data processed via this platform will be stored on CoreLogic UK and e.surv servers. All personal data within this platform will be ‘ring-fenced’ to the UK and will not be processed outside of
the UK for any purpose.

What is the purpose for processing your data?

Our business receives instructions from major Banks, Building Societies, and financial institutions (lenders) to inspect and value properties for residential mortgage lending purposes. Where this is the case, we do not have a direct relationship with the end consumer (i.e., the Bank, Building Society, or
financial institution’s customer – the mortgage applicant)

Our business however also receives instructions to value and or survey properties for residential purposes from members of the general public. Where this is the case, the member of public is our direct customer. Within the scope of the data protection legislation, e.surv is a “Data Processor” where it receives instructions from a lender client to value and or survey properties. This is because the customer relationship is directly between a lender and its customer, not e.surv. In this regard, the lender is defining the purpose for which and way its customer’s personal data are or are to be processed and
e.surv processes the data in accordance with the lender’s instructions.

e.surv is a “Data Controller” as defined in data protection legislation where it has a direct relationship with a member of the public. We receive instructions to value and survey properties from the general public and therefore it is e.surv who is defining the purpose for which and way the personal data is or is to be processed.

With regard to its employees, e.surv is a “Data Controller” as it is defining the purpose and manner of the processing of the data being given to it by its employees.

To support our processing activities, we use recognised and established UK suppliers, a list of these suppliers and what we use them for is available on request. The personal data supplied in the course of our duty as a Chartered Surveying Firm is not used by e.surv or any of our suppliers for marketing
purposes* or consumer profiling or selection.

*Where e.surv has received permission from a member of the general public; or a lender’s customer has given their permission to their lender, e.surv may make contact with the customer to offer other suitable survey or valuation products which will benefit the customer in relation to property energy
efficiency.

Use of personal data processed by e.surv

e.surv will only process the personal data it receives and collects if it has a lawful basis for processing it (see below, a requirement of UK GDPR and The Data Protection Act 2018).

Types of information processed

Personal data means any information relating to a living individual who can be identified, directly or indirectly from the information such as name, date of birth, address, NI number, email address, fingerprint, or an opinion about an individual.

The UK GDPR and the Data Protection Act 2018 categorise personal data into two categories, personal data, and special category data. The Data Protection Act 2018 classifies special category data as the processing of personal data revealing:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic or biometric data that can identify an individual
• sexual life or sexual orientation
• this can also include criminal offences and convictions, vulnerability, and child data.

e.surv may collect personal data from you in connection with your use of the site or when you call us to enquire about our services, this includes, but is not limited to:

• your name and contact information, including your email address and telephone number
• the first line of your address and property postcode.

We may also collect additional information from you if you decide to use our valuation or surveying products or services or if we contact you regarding your enquiry, including personal data such as:

• the type of property i.e., house, flat, bungalow;
• when the property was built;
• how many bedrooms the property has;
• the estimated value of the property.

Please note:

• For payment of our services, we do not store card details as we use a card payment processor which encrypts these details at the point of transmission.
• b. Telephone calls are recorded for training and monitoring purposes, however recording stops at the point where you are required to provide card payment details.

In some circumstances (e.g., where required by a lender client), we may also collect and/or process special category data, this includes, but is not limited to:

• vulnerability status and details
• child data
• for example, we may have to note that a child under the age of eighteen is at the property and we therefore could not carry out our services.

Methods of Collection

Data, including the personal data we process about you may be provided by a lender or directly provided by you or your appointed party/next of kin. Data is collected via:

• data provided from a lender
• making an enquiry
• making a complaint
• applying for employment with e.surv
• direct instruction to carry out a private survey
• online – e.surv web portal (powered by Survey Booker).

We may also receive information about you from trusted sources such as:

government / Land / Police registers

• insurance companies
• law firms
• health providers.

This information may be provided via:

• email, post, or telephone
• forms and documentation
• online portals
• cookies.

What information is being collected if you are a job applicant?

We may also collect personal data from you (and from others such as managers involved in the recruitment process and those supplying references and verification information) if you decide to apply for a job with us including

• contact details such as your name, address, previous addresses, telephone number(s) and email address
• information to identify you such as, photographic identification, passport and or driving licence;
• information about your suitability to work for us such as, references, notes from interviews, records of assessments
• eligibility to work in the UK (including any work visas)
• the results of a credit reference check, financial sanction check and a basic disclosure & barring criminal record check relating to unspent convictions
• information about your skills and experience including your CV, application form, records of qualifications and training
• information related to the outcome of your application including the decision and, if you are successful, details of our offer of employment to you; and certain sensitive or special category information including medical information where necessary to comply with legal obligations connected with employment.

What do we do with the personal data we receive?

Your information will be used by us in connection with the following purposes:
Providing you with Valuation and Surveying Services (see “Services”): to allow us to provide you with the valuation and surveying products and services which you have asked us to provide:

• to better understand your requirements and provide you with services specific to your needs
• to keep our client records up to date; and
• to improve our services.

Responding to your queries:

• to help answer any questions which you have asked one of our surveyors or staff members; and
• to provide you with a quote for our services
• improving our Site
• to analyse cookie and website usage data to keep improving the Site and search functionality; and
• to allow us to customise the content which is presented to you based on your likely interests.

Legal and Regulatory Obligations:

• to comply with applicable laws where we are obliged to retain and/or disclose certain information
• to investigate or address claims or complaints relating to your use of our services; and
• for internal and external auditing purposes.

Recruitment where you are a Job Applicant:

• to assess your suitability to work for us including shortlisting, assessments and interviews
• to conduct pre-employment checks including verification of your identity, checking your legal right to work, and obtaining references
• to conduct a pre-employment credit reference check, financial sanction check and a check in relation to unspent criminal convictions in order to prevent crime and other unlawful acts and to protect the business and customers from the risk of dishonesty, malpractice or improper conduct
• to compare you with other applicants and make a decision whether to offer you employment
• to consider any reasonable adjustments either for the recruitment process or if you were to commence employment with us in the event that you have a disability
• to make a job offer and provide a contract of employment
• to prepare to bring you on board as an employee where you accept an offer of employment from us.

In this case, we will continue to use some of the information gathered during recruitment for the purpose of your employment and will transfer some of this to our employment systems and files

• to contact you if you are not successful should another potentially suitable vacancy arise during the six months following the completion of the recruitment process for the role you applied for; and
• to deal with any query or request for feedback received in relation to our recruitment decision.

Where you are a job applicant we use your information either where necessary to comply with legal obligations (for example right to work checks or to carry out obligations under employment law in the case of medical information); to take steps to consider you as an applicant prior to being able to enter
into an employment contract with you; and where we consider it is necessary for the purpose of our legitimate interests listed above. We also use your information with your consent in relation to checks carried out in relation to unspent criminal convictions.

In the event that you were not satisfied with our recruitment decision and brought a legal challenge, we would use your information to defend the legal claim.

Other:

• to transfer information to any entity which may acquire rights in us.

What lawful basis do we use to process your personal data?

The lawful basis under Article 6 GDPR for processing your personal data can differ for each processing activity carried out. e.surv has identified the following lawful basis for processing:

• Consent: Where your permission and consent has been provided to allow the processing to be undertaken.
• Performance of a Contract: when you will or have entered into a contract with e.surv or we need to process your personal data as part of a contract.
• Legal Obligation: where e.surv are bound by laws and regulations to process your data. This includes but is not limited to:
  • Employment law
  • RICS
  • Data protection
• Vital Interest: when the processing is necessary to protect the vital interests of another natural person.
• Public Interest: when the processing is for the performance of a task carried out in the interest of the public.
• Legitimate Interest:
• Risk assessment
• Training, communication, and awareness
• Cloud storage
• Web analytics
• Acquisitions and monitoring.

The lawful basis under Article 9 GDPR and Schedule 1 of the Data Protection Act 2018 for processing your special category data can also differ for each processing activity carried out. e.surv has identified the following lawful basis for processing:

Article 9 GDPR

• explicit Consent: Your permission has been granted and documented directly to us
• processing for the purposes of employment and social security
• data has been made public by the data subject: for example, Electoral Roll
• establishing, exercising, or defending a legal claim.

Schedule 1 DPA 2018

• suspicion of money laundering
• insurance; advising, underwriting, arranging, or administering an insurance contract
• pensions
• legal claims in connection with criminal conviction data, advice, defending, establishing.

Data retention

The personal data that you provide will be retained by us in accordance with applicable laws and our internal Retention Policy. However, we will take reasonable steps to destroy or de-identify personal data we hold if it is no longer needed for the purposes set out above. We will only hold your personal data on our systems for up to 15 years in accordance with our regulators guidelines (The Royal Institution of Chartered Surveyors) and for the relevant purposes for which it was collected. A copy of our Retention Policy is available on request.

Where you have used our website for our services, we will retain your personal information for 90 days to 2 years after user accounts remain idle or for as long as we need it to fulfil the purposes for which it was collected.

Where you are a job applicant, we will keep the information we receive about you throughout the recruitment process and for a period of six months after completion of the process. If you have not commenced employment with us, we will then remove your information (or de-identify it) where we have not received any query or challenge which is outstanding. We will retain it if needed to deal with any outstanding query or challenge to the process. Where you become our employee, we will keep your information where relevant to your employment and this will become part of your employment records.

Disclosure of information

The information you provide to us will be held on our computers in the United Kingdom and will be accessed by or given to our staff to fulfil their duties in the provision of the service you have requested from us.

We may also disclose your information to the third parties listed below for the following purposes:

• entities who may or do acquire any rights in us for the purpose of a business sale or reorganisation
• our advisers (staff), for the purpose of assisting us to better manage, support or develop our business and comply with our legal and regulatory obligations
• third parties as necessary in the event of a professional indemnity claim or dispute relating to the use of our services (i.e. a Solicitor or Legal Firm acting for e.surv)
• service providers such as other surveying firms and other surveyors if we are instructed to use them as part of a contract with a lender client who need to know the information in order to provide us or you with a product or service
• service providers such as other surveying firms and other surveyors if we are unable to carry out the services, the data will be passed to a trusted panel firm to provide the required service
• law enforcement bodies and/or other regulatory entities in order to comply with any legal obligation or court order
• third parties we work with as part of providing our services, including (but not limited to) IT hardware and software providers and payment processing providers (based in the UK). We expect such third parties to attest to process any data disclosed to them in accordance with applicable law, including
  with respect to data confidentiality and security and have appropriate services agreements in place with each. Payments for services are processed securely and in compliance with the Payment Card Industry, Data Security Standard (PCI DSS); and
• where you are a job applicant, we use a recruitment platform provided by ICIMS (a data processor engaged by us to support our recruitment); we work with the Disclosure & Barring Service England & Wales and Disclosure Scotland to carry out criminal record checks, Experian UK to carry out
  credit referencing and Veriphy to complete identity verification.

We disclose information to the referees you have provided to obtain the relevant references.

These parties are located in the UK.

Links to third party sites

The site may contain links to other sites. e.surv is not responsible for and accepts no liability for the content of other sites which are not under its strict control, in particular, we are not responsible for the protection and privacy of any information which you provide whilst visiting other websites and such
sites are not governed by our Privacy Notice.

Data privacy and security

e.surv is certified to the globally recognised standard for Information Security, ISO 27001:2013 and is externally assessed for conformance to this standard annually by the British Standards Institute. Certification to this standard ensures that our business regularly assesses external and internal threats
to the safety of information and operates with the relevant technical and operational security controls to keep data safe.

Likewise, e.surv is also certified to ISO 9001:2015, the globally recognised standard for Quality Management, which ensures that adequate risk management practices are in place to identify and treat emerging risks and check that procedures are operating effectively. Continued assessment of
conformance to this standard is conducted by the British Standards Institute annually.

Data protection information

You can obtain further information about data protection laws by visiting the Information Commissioner’s website at https://www.gov.uk/data-protection/the-data-protection-act.

Your rights

Under relevant data protection legislation, individuals have rights over the processing, retention, and deletion of their Personal Data. Not all rights may be available to each data subject as the rights are dependent on the applicability of the purpose for processing and lawful basis of processing.

You can exercise your rights verbally or in writing. Upon request and where applicable, e.surv will comply with your request within 30 days of receipt. Where we have received your data from a lender (and you are their mortgage applicant), we will refer the request to the lender as the data controller and
comply with any of their requests in the first instance.

If your request is complex, we may require more time and can extend our response time by another 30 days (two months). If an extension is required, we will contact you within the original 30-day response date to explain why we are extending and provide you with a new response date.

Upon the event of having to verify your identification in order to proceed with the request, we will contact you as soon as possible. Once we are satisfied with your identity, we will continue to process your
request. Please note that only when we are satisfied with your identity will the 30-day response time begin.

If we refuse your request, we will provide you with a full explanation within 30 days of receipt along with justification as to why. We will also provide you with your right to complain to the supervisory authority and information of how to enforce your rights via judicial remedy.

The Right to be Informed; You have the right to know what personal data we are processing, how we process this data, why we process and to whom we share your data with. This right is satisfied upon receipt or notification of our privacy notice.

The Right of Access; You have the right to request copies of the personal data we hold and control relating to you and details of how we use that information.

The Right to Rectification; You have the right, if you think any of the personal data, we hold about you is inaccurate to request that it is corrected.

The Right to Erasure; You have the right to for your personal data to be deleted by us, however this only applies under certain circumstances.

The Right to Restrict Processing; You have the right to restrict what information we process about you depending on certain circumstances.

The Right to Object; You have the right to object/stop us processing your personal data where the lawful basis for this processing is legitimate interest, consent, or public interest.

The Right to Data Portability; You have the right to request an electronic copy of your personal data be sent to you, or to another organisation should you wish. This is however limited to the information being processed under the lawful basis of consent or the information is being processed under automated means.

The Right to Automated Decision Making and Profiling; you have the right to request that human intervention take place in such processing to challenge a decision being made under automated decision making and profiling.

Contact

If you have any questions or comments about our Privacy Notice or if you wish to exercise your right to access, correction or erasure or your right to ask us to stop processing your information mentioned you can contact us either by telephone, email or in writing whichever you prefer

• 01536 534000
• E-mail: [email protected]
• Post: e.surv Data Protection Officer, Orion House, Orion Way Kettering, Northants, NN16 6PP

Data Protection Officer:
e.surv has appointed its own data protection representative, Shane Ross. Shane is a member of the Risk & Governance teams at e.surv, reporting directly to the Risk & Governance director at e.surv.

For all e.surv related data protection matters, Shane can be contacted by writing to:
The Risk & Governance Department e.surv
Chartered Surveyors Orion House Orion
Way Kettering Northants, NN16 6PP

What if my personal data is compromised?

e.surv has an obligation to inform you within 72 hours of becoming aware of a data breach that is likely to result in a high risk to your data and rights and freedom, e.surv will also report such breach to the Information Commissioners Office (ICO) or its lender clients having investigated fully the suspected
breach.

If the breach is likely to result in a high risk to the rights and freedoms of individuals, e.surv will notify you if your personal data is NOT encrypted or NOT unintelligible.

Complaints

If you have any concerns or complaints as to how we have handled your personal data you may lodge a complaint with the UK’s data protection regulator, the ICO, who can be contacted through their website at https://ico.org.uk/global/contact-us/ or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF