Last reviewed: October 2022
Data Protection is a priority issue for Forbury therefore, we want to inform you in accordance with the applicable data protections provisions about the personal data we hold about you (including the personal data we collect when you visit our website and online services) and the rights you have as a data protection subject.
- The personal data that we collect
- How we collect your personal data
- Your obligations when you provide personal data
- The legal basis for collecting your personal data
- Disclosure of your personal data
- International transfers
- Retention of your personal data
- Security of your personal data
- Online services – links to third party sites, services and content
- Data Subject Rights
- How to make a complaint
- How to contact us
- to your use of any of our services where we are performing a data controller function;
- where you apply to us for a job or work placement;
- to your supply of services to us where this involves any personal data; and/or
- to any personal data collected from third parties where we are the controller of such data.
2. The personal data that we collect
"Personal data" is any information that can be used to identify you or that we can link to you. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Identity Data including first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
- Contact Data including billing address, delivery address, email address and telephone numbers.
- Financial Data including bank account and payment card details.
- Transaction Data including details about payments to and from you and other details of products and services you have purchased from us.
- Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
- Profile Data including your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
- Usage Data including information about how you use our website, products, and services.
- Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
3. How we collect your personal data
Where you use our services, we will collect personal data directly from you that you voluntarily provide to us, including when you communicate with us via email or other channels; when you sign up for or request that we send you newsletters, alerts, or other materials; when you sign up for a webinar or event; and when you respond to our communications or requests for information.
The information you provide may include current and historical personal data including your name, contact details, title, identification, usernames, employment, positions held and enquiry/complaint details and information about the organisation with which you are affiliated. We may also collect personal data about your other dealings with us and our clients, including any contact we have with you in person, by telephone, email or online.
We may collect your personal data in a number of ways, including:
- through customers providing details of authorised users or other contacts;
- through our website, by telephone or email;
- through computer code in our products which send us log activity about use of our products;
- while providing technical support, consultation, or product information;
- through details of visits made to our online services including, but not limited to, the volume of traffic received, logs (including, where available, the IP address and location of the device connecting to the online services and other technical information and identifiers about the device and the nature of the visit) and the resources accessed;
- through third party referrals; and
- through the process of maintaining and upgrading our products, services and website.
We may also collect personal data from third parties such as your employing organisation, regulatory authorities, recruitment agencies, credit reporting agencies, information or service providers, publicly available records, and the third parties described in the section 6 (Disclosure of your Personal Data).
We may collect personal data from other sources, such as social media platforms that share information about how you interact with our social media content, and any information gathered through these channels will be governed by the privacy settings, policies, and/or procedures of the applicable social media platform, which we strongly encourage you to review.
We will handle any unsolicited personal data in accordance with law, including destroying or de-identifying such data where we are required to do so.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
4. Your obligations when you provide personal data of others
You must not provide us with personal data of any other individual unless you have the express consent of that individual to do so. If you do provide us with personal data about another individual:
- you warrant that you have that individual's consent to provide their personal data to us.
5. The Legal Basis for collecting your personal data and how we use it
We will only use your personal data when the law allows us to. Most commonly, we collect and use your personal data to enable us to provide you, or your employing organisation, with our products and services, and for any directly related purposes as set out below. If we are unable to collect personal data we reasonably require, we may not be able to do business with you or the organisation with which you are connected.
Where we intend to use your personal data, we rely on the following legal grounds:
Performance of a contract: We may need to collect and use your personal data to enter into a contract with you, or your employing organisation, or to perform a contract that you have (or your employing organisation has) with us and where we respond to your requests and provide you (or your employing organisation) with services in accordance with our terms and conditions or other applicable terms of business agreed with you or with your employing organisation.
Legitimate interests: Where we consider use of your personal data as being (a) non-detrimental to you, (b) within your reasonable expectations, and (c) necessary for our own, or a third party’s legitimate purpose, we may use your personal data, which use may include:
- business and product development purposes;
- to monitor use of our products and services and improve the quality;
- for our own direct marketing or continued communication;
- the prevention of fraud;
- our own internal administrative purposes;
- personalisation of the service(s) we provide to you;
- ensuring network and information security, including preventing unauthorised access to electronic communications networks and stopping damage to computer and electronic communication systems; and/or
- reporting possible criminal acts or threats to public security to a competent authority.
Compliance with a legal obligation: We may be required to process your personal data due to legal requirements, including employment laws, tax laws and other regulatory provisions applicable to Forbury.
Consent: You may be asked to provide your consent in connection with certain services that we offer, for example in respect of any processing of your personal data for our marketing purposes where you or your employing organisation is not a client of Forbury. Where we are reliant upon your consent, you may withdraw this at any time by contacting us however, please note that we will no longer be able to provide you with the products or services that rely on having your consent.
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).
You will receive marketing communications from us if you have requested information from us or purchased products or services from us and you have not opted out of receiving that marketing.
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. You can ask us or third parties to stop sending you marketing messages at any time by checking relevant boxes to adjust your marketing preferences, by following the opt-out links on any marketing message sent to you, or by contacting us at any time.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, product/service experience or other transactions.
6. Disclosure of your personal data
We may disclose your personal data to our related entities, agents, contractors and external service providers (such as IT providers) where any of the following apply:
- You have consented to us sharing your personal data in this way.
- We deem it reasonably necessary to provide you with the services that you, or your employing organisation, have requested at any particular time.
- Such sharing is provided for under contract, including our terms and conditions for any particular service that we may provide to you or your employing organisation.
- Such sharing is to law enforcement bodies or other government authority.
- We need to enforce or apply our terms and conditions to which you have agreed (or other terms that have been agreed to apply to our relationship with you or your employing organisation).
- It is necessary to protect the rights and interests, property, or safety of Forbury, our clients or others.
- It is relevant in the circumstances to disclose the personal data to parties with whom we have co-promotional arrangements (such as jointly sponsored events, external venues, or caterers).
- Our agents or contractors who assist us in providing our services require such personal data, for example in fulfilling requests for personal data, receiving and sending communications, updating marketing lists, analysing data, providing support services or in other tasks from time to time. Our agents and contractors will only use your personal data to the extent necessary to perform their functions.
- We use third party service providers to provide services that involve data processing, for example archival, web-hosting, analytics providers in connection with the operation of our online services, event hosting, information technology providers, auditing, reference checking, professional advisory (including legal, accounting, financial and business consulting), mailing vendor, delivery, technology, website, research, banking, payment, client contact, data processing, insurance, forensic, litigation support, marketing and security services.
- All, or most, of the assets of Forbury or any single business unit within Forbury are merged with or acquired by a third party, or we expand or re-organise our business, in which case your personal data may form part of the transferred or merged assets.
- We are under a legal, regulatory or professional obligation to do so (for example, in order to comply with a Court Order).
We require all third parties to respect the security of your personal data. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Any third parties that we may share your personal data with are obliged to keep your details securely, to use them only to fulfill the service they provide you on Forbury’s behalf, and at all times to treat it in accordance with the law. When such third parties no longer need your personal data to fulfill this service, they will dispose of such personal data in line with Forbury’s procedures unless they are themselves under a legal obligation to retain personal data (provided that this will be in accordance with applicable data privacy laws).
The third parties to whom we may share your data with include Microsoft Azure, HubSpot and Salesforce.
We may, in providing our services and operating our business, allow access to your personal data to the different entities within Forbury’s group for our internal administrative purposes such as billing, promoting our events and services, and providing you or your organisation with services, provided in all instances that such processing is consistent with section 5 (Legal Basis for Usage of Personal Data) above and applicable law.
We also provide anonymous statistical information about users of our websites and related usage information to reputable third parties, including analytics and search engine providers.
We may share information that does not reasonably identify you as permitted by applicable law.
7. International Transfers
Where you are submitting personal data from within the UK, or the European Economic Area (“EEA”), such information may be transferred to countries outside the UK and/or EEA. By way of example, this may happen if one or more of our third-party service providers with whom we share personal data in accordance with section 6 (Disclosure of Your Personal Data) are located, or have their servers located, outside your country or the country from which the data were provided.
The third parties located outside the UK and/or the EEA include Microsoft Azure (based in the United States), HubSpot and Salesforce.
Whenever we transfer your personal data out of the UK and/or the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or
- Where we use certain service providers, we may use specific contracts approved for use in the UK and/or the EU which give personal data the same protection it has in the UK and/or the EU. This includes entering into appropriate data transfer agreements, including the use of Standard Contractual Clauses.
Where you are submitting personal data from within New Zealand or Australia, such information may be transferred overseas to countries including the United States of America. Where this occurs, we will take reasonable steps to ensure there are appropriate privacy, data handling and security arrangements in place to protect your information.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside of the country from which you are submitting your personal data.
8. Retention of your personal data
We retain the personal information we collect for no longer than is reasonably necessary to fulfill the purposes that such data was originally collected in accordance with our internal data retention policies or to comply with our legal, regulatory, tax, accounting or reporting obligations. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
9. Security of your personal data
We take steps to hold personal data securely in electronic or physical form. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Our information security policy is supported by a variety of processes and procedures, and we store personal data in access-controlled premises or electronic databases requiring logins and passwords. All employees, officers, or contractors of Forbury and third-party providers with access to confidential information are subject to access controls and confidentiality obligations, and we require our third-party data storage providers to comply with appropriate information security industry standards.
Whilst we continually strive to ensure that our systems and controls are updated to reflect technological changes, the transmission of information via the internet is not completely secure, and as such we cannot guarantee the security of your personal data transmitted to our online services which is at your own risk.
If you communicate with us using non-secure web platforms, you assume the risks that such communications between us are intercepted, not received, delayed, corrupted or are received by persons other than the intended recipient.
Once we have received your personal data, we will take reasonable steps to use procedures and security features to try to prevent unauthorised access, modification or disclosure.
You can help us to keep your personal data secure by ensuring that any username or password in relation to our online services is kept strictly personal to you and not made available to any other person. You should stop using your username and password and notify us immediately if you suspect that someone else may be using your user details or password.
Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently to improve the user experience, as well as to provide certain information to the owners of the site.
We may, for example, collect information about the type of device you use to access our online services, the operating system and version, your IP address, your general geographic location as indicated by your IP address, your browser type, the content you view and features you access on our online services, the web pages you view immediately before and after you access our online services, whether and how you interact with content available on our online services, and the search terms you enter on our online services.
Forbury’s website sets cookies which remain on your computer for differing times. Some expire at the end of each session and some remain for longer so that when you return to our website, you will have a better user experience.
Which cookies we use
Detailed below are the cookies we use and why and how long they last.
_utma: expires after 2 years
_utmb: expires after 30 minutes
_utmc: expires at end of the session
_utmz: expires after 2 years
We collect standard internet log information and details of visitor behaviour patterns by using Google Analytics cookies. We do this to compile reports and to help us find out things such as the number of visitors to the various parts of our website, so that this can be improved. This information does not identify visitors or collect any personal details. We do not make any attempt to find out the identities of those visiting our websites. We will not associate any data gathered in this way with any personal data from any source. For more information about Google Analytics cookies please see the link here.
Google Analytics’ Data Retention, for Universal Analytics properties has been set to 26 months and for Google Analytics 4 properties we have it set at 14 months.
Control of cookies
Web browsers allow you to exercise some control of cookies through the browser settings. Most browsers enable you to block cookies or to block cookies from particular sites. Browsers can also help you to delete cookies when you close your browser. You should note however, that this may mean that any opt-outs or preferences you set on our website will be lost. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org which includes information on how to manage your settings for the major browser providers.
11. Online services - Links to third party sites, services and content
In addition to our online services, which we control directly, we also use and provide links to websites which are controlled by third parties, which may include:
- Twitter, LinkedIn and YouTube, where we have certain Forbury accounts and profiles.
- Facebook, where we have a social page.
- Our status page via Atlassian
- Customer websites in the case of testimonials
If you use or follow a link to any of these third-party websites, please be aware that these websites have their own privacy policies and that we cannot accept any responsibility for their use of information about you.
We engage third parties that support the operation of our online services, such as analytics providers. These third parties may use technologies to track your online activities over time and across different websites and online platforms. Please see section 10 (Cookies Policy) above for more information.
12. Data Subject Rights
We take reasonable steps to ensure that your personal data is accurate, complete and up-to-date whenever we collect, use or disclose it. However, we also rely on you to advise us of any changes to your personal data.
Please let us know as soon as possible if there are any changes to your personal data or if you believe the personal data we hold about you is not accurate, complete or up-to-date.
If you make a request by contacting us at the contact details below, we will provide you with access to the personal data we hold about you unless otherwise required or permitted by law. We will notify you of the basis for any denial of access to your personal data.
You can request:
- request access to the personal data we hold about you;
- request corrections or updates to your details;
- request the erasure of your personal data;
- object to processing of your personal data;
- request restriction of processing your personal data;
- request the transfer or portability of personal data that you have provided to us in a structured, commonly used and machine-readable format; and
- withdraw your consent.
If you would like to exercise any of the rights set out in this section, please contact us using the details set out below. We may refuse to provide access where we have legitimate reasons for doing so under applicable data privacy laws, and in exceptional circumstances may charge a fee for access if the relevant legislation allows us to do so, in which case we will provide reasons for our decision.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
13. How to make a complaint
We will investigate the issue and determine the steps (if any) that we will undertake to resolve your complaint. We will contact you if we require any additional information from you and will notify you in writing of the outcome of the investigation. If you are not satisfied with our determination, you can contact us to discuss your concerns or complain to:
- If in the UK: the Information Commissioners Office, details of which can be found at https://ico.org.uk/global/contact-us
- If in the EU: the European Commission, or the relevant data authority for the Member State, details of which can be found via https://edpb.europa.eu/about-edpb/about-edpb/members_en
- If in Australia: Australian Privacy Commissioner via oaic.gov.au
- If in New Zealand: Privacy Commissioner via https://www.privacy.org.nz/
15. How to contact us
Address: Forbury Property Valuation Solutions (UK) Limited
10 John Street, WC1N 2EB, London, England
Telephone:+44 7458 022885
Our Data Privacy Officer is Peter Rose.
Forbury Property Valuation Solutions (UK) Limited 10 John Street, WC1N 2EB, London, England
Forbury Property Valuation Solutions (AUS) Pty Limited
Address: Suite 2401, Level 24, 101 Grafton Street, Bondi Junction, New South Wales, Australia.
Telephone: +61 1800 157 442
Forbury Property Valuation Solutions Limited
Address: 150 Lichfield St, Christchurch, Canterbury 8011, NZ
Telephone: +64 20 402 88592