Fair Processing Notice – 6 Babmaes Street (including Member Website and App)

This Fair Processing Notice (the ‘Notice’) explains how The Crown Estate (‘we’ or ‘us’) will store and use personal data that is collected from you when you visit http://platform.6babmaesstreet.com (the ‘Member Website’), or use its associated application (the ‘App’) and/or apply for membership at 6 Babmaes Street.

The Crown Estate is the ‘controller’ of personal data collected through the Member Website and App for the purposes of applicable data protection laws, and is the organisation you should contact if you have questions about the use of your personal data.

Information that you provide to us

We will collect and process personal data about you: 

• If you apply to become or become a Member at 6 Babmaes Street;
• If you participate in the Community Forum on the Member Website;
• If you contact us by telephone, email or letter;
• If you visit 6 Babmaes Street in person.

The personal data we collect may include your name, email address, employer, telephone number, mailing address, and payment information. We will keep this information for as long as it is necessary for us to process it for your membership.

We will also collect CCTV images when you visit 6 Babmaes Street.

We will use the information you provide to us

• To create and maintain your account on the Member Website;
• To communicate with you about your application and/or membership, and to administer your membership at 6 Babmaes Street;
• To process payments;
• To facilitate and manage the Community Forum and respond to any comments or queries that you may post on the Community Forum;
• To notify you about changes to the Member Website or to our services (including building maintenance issues);
• If you become a Member at 6 Babmaes Street, to notify you about events or promotions at 6 Babmaes Street, the surrounding area and the wider community;
• To send you occasional email updates (see ‘Email Updates’ below); 
• To perform surveys and analysis with the aim of improving the services we provide;
• To ensure that your visit to the Member Website is safe and secure;
• To comply with any legal obligations to which we are subject, such as health and safety laws, and to protect and defend our rights and interests.

Categories of data processing

The personal data that The Crown Estate processes relating to our customers, in this case those occupying one of our properties, typically consists of the following:

1. Contact and billing information      Personal details from occupiers, their employees and contractors on site,      including names, addresses, emails, phone numbers and contact details are      processed for the following purposes:

• fulfilling obligations and ongoing billing and management arrangements;
• providing property and facility management services – we may take personal details to register facility issues and report back resolutions;
• providing secure access to the premises as a service;
• reporting any injuries or potential insurance claims – these may include special categories of personal data – to discharge our legal obligations or defend a claim;
• provide business continuity services to allow us to alert occupiers and their employees of an incident that may impact their business operations.
• Security system data As part of security services, The Crown Estate may collect personal images including those of occupiers, their employees and visitors entering such areas. Signs will be displayed notifying you of our CCTV arrangements. The Crown Estate provides surveillance services with the primary purpose of preventing and detecting of crime. Retention policies are in place to govern how long this information should be kept, which is generally for no longer than 30 days unless an incident has been logged.
  
  
• Access control and visitor management

At 6 Babmaes Street, we provide an access control system that allows secure entry to the building. We deliver these services at the property to provide security to our Members and staff, as well as to prevent and identify crime. These systems hold personal data – typically an individual’s name, image, the organisation with which they are associated and movement data as they access various parts of the building.

For the purposes of providing access control services to you, The Crown Estate’s managing agents act as your data processor. In relation to any subject right requests for the personal data included in the access control systems and/or visitor systems, The Crown Estate’s managing agents will refer requests to us as the data controller and respond to your instructions as to how these should be actioned. To ensure compliance with data protection laws, The Crown Estate’s managing agents will review personal data within any access control and visitor systems, and any personal data relating to expired access cards will be permanently deleted.

Transfers of personal data

Where necessary, The Crown Estate may transfer your personal information to its joint venture partners, suppliers or service providers based outside the European Economic Area (EEA). If The Crown Estate does this, your personal information will continue to be subject to one or more appropriate safeguards as required by law. These might include the use of model contractual clauses, or having suppliers sign up to an independent privacy scheme approved by regulators (such as ‘Privacy Shield’).

The Crown Estate will ensure that where information is transferred outside the EEA, transfers will only take place where appropriate safeguards are in place to protect it. Further information on such transfers are included below under ‘Service providers’.

Recipients of personal data

We may disclose the personal data we hold about you to: 

• Jones Lang LaSalle Limited trading as Regent Street Management Direct (or other trading name) and/or BNP Paribas; 
• Our service providers, including IT hosting companies, platform providers (such as Nexudus) and payment platforms – please see further details below under ‘Service providers’;
• Professional advisors such as solicitors, accountants, auditors, financial and other professionals; 
• Regulatory authorities, law enforcement agencies, courts and other relevant tribunals where we are required or permitted to do so by law, or in order to protect and defend our interests;
• A prospective buyer or seller of our business or assets in the event that we sell or buy any business or assets.

Service providers

Our app and Member Website link you to third party service providers, as explained below. We have also provided links to each supplier’s privacy policy or fair processing notice. Processing will take place within the European Economic Area except where otherwise stated.

• Nexudus. Nexudus provide our Member Website and App and use Amazon Web Services servers based in London and Ireland.
• Salto: Salto provides us with security services including access control and security services. 
• WorldPay and Spreedly. These companies allow you to make payments for services to The Crown Estate. Spreedly enables you to do this without re-entering all your details each time, while WorldPay allows the payment to be taken. Using each of these services may involve the transfer of personal data to the US, with transfers protected by Privacy Shield. 
• Twilio SendGrid. We use SendGrid to facilitate our email messaging service. SendGrid is based in the US and uses appropriate safeguards – such as Privacy Shield, binding corporate rules and standard contractual clauses – in order to transfer any personal data to the US.

Cookies

When you visit the Website cookies may collect certain information about your device and activity. You can find out more about this in our cookie statement. 

The Community Forum

Any messages that you post in the Community Forum will be viewable by other Members of 6 Babmaes Street, as well as your name and any photograph that you have uploaded. Please do not post anything in the Community Forum that you would not wish to become public information.

Where we store your personal data

The data we collect is stored on information technology systems owned and run by or on behalf of The Crown Estate or on systems run by those businesses processing it on our behalf. All information you provide to us is stored on secure servers. Unfortunately, the transmission of information via the internet is not completely secure and although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted over the internet to the Member Website; any transmission is at your own risk. Once we have received your data, we will use all necessary procedures and security measures to try to prevent unauthorised access, loss, disclosure or amendment.

Our legal basis for processing your personal data

• If you are a Member, our legal basis for processing information is legitimate interests. This is because we need to process certain personal data in order to provide you with the services you need at 6 Babmaes.
• If you otherwise contact us, our legal basis for processing your personal data is that it is necessary for our legitimate interest in conducting our business and meeting the requirements of customers.
• Our legal basis for processing personal data as part of our security systems is legitimate interests; it is in the legitimate interests of the controller, The Crown Estate, to maintain robust security procedures, retain footage of possible criminal acts or threats to public security and, where appropriate, to pass that footage to a competent authority.

Retention of personal data 

We store the personal data we collect about you for as long as is necessary for the purpose(s) for which we originally collected it, or for other legitimate business purposes, including to meet our legal, regulatory or other compliance obligations. 

Your rights

Individuals are afforded rights under GDPR including the right to access, correct, object, restrict and erase. To exercise these rights please contact 6 Babmaes Street staff or email the Data Protection Officer at The Crown Estate using the contact details below.

• You have the right of access to your personal data.

This includes a description of the personal data being processed, the purposes of processing and any recipients to whom the personal data is disclosed. To exercise this right, please make a Subject Access Request in writing to the Data Protection Officer at The Crown Estate, 1 St James’s Market, London SW1Y 4AH, stating the information you require. We do not charge a fee. We may contact you to verify your identity or to clarify the precise information you require before processing your request.

• You have the right to ask us not to process your personal data for direct marketing purposes.
• You have the right to rectify your personal data at any time if it is incorrect.
• You have the right to have your personal data erased under certain conditions.
• You have a right to restrict or object to some forms of data processing.
• You have the right to prevent any unwarranted processing likely to cause damage or distress.

Please note that some of these rights may not apply to processing where it is necessary to fulfil a contract or where a legal obligation for us to process the information exists.

Please note that in the event The Crown Estate or its managing agent receives a request to access surveillance data from an occupier in relation to a member of their staff, they cannot provide it without sufficient cause so as to preserve the privacy rights of the individual.

Complaints

You have the right to complain about the use of your personal data to the Information Commissioner’s Office (www.ico.org.uk). 

Changes to this Notice 

This Notice will be reviewed from time to time to take account of changes to our operations and practices. If we make changes, we will notify you by revising the date at the top of this Notice, and if the changes are significant, we may provide you with additional notice, such as adding a statement to the homepage of the Member Website or sending you an email with the update. The processing of any personal data held will be governed by our most current Notice.

Contact us

If you have any questions about this Notice or the ways in which we use your personal data, you can contact our Data Protection Officer by writing to The Crown Estate, 1 St James’s Market, London, SW1Y 4AH, or emailing: enquiries@thecrownestate.co.uk.

This Privacy Notice was last updated on 9 January 2020. The Crown Estate is registered with the Information Commissioner’s Office with registration number Z6390151.