1. Privacy Policy

1.1 Civitas Investment Management Limited (we/us/our) is incorporated in the UK and is committed to safeguarding the privacy of our customers and users (you/your) who visit our website (the Website). This privacy policy (the Privacy Policy) sets out our personal data collection and sharing practices for our Website and is intended to inform you of the ways in which our Website collects personal data, the uses of that personal data and the ways in which we will share any personal data you choose to provide to us.

1.2 Our Website may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal data. Please check these policies before you submit any personal data to such third party websites.

1.3 This Privacy Policy is intended to explain our privacy practices and covers the following areas

(a) What personal data about you we may collect

(b) How we may use your personal data

(c) How we protect your personal data

(d) Contacting us & your rights in relation to your data

(e) Our Cookies Policy

(f) How changes to this Privacy Policy and the Cookies Policy will be made

2. Information we may collect about you

2.1 We will sometimes collect and process personal data about you (such as your name, email address and other contact details). For example, we will obtain your personal data when you complete an online form, contact us for any reason or sign up to a service provided by us.

2.2 We will collect details of your visits to our Website and personal data collected through cookies and other tracking technologies including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, and the resources that you access.

3. How we use and disclose your personal data

3.1 In this section, we set out the purposes for which we use personal data that we collect via the Website and, in compliance with our obligations under European law, identify the “legal grounds” on which we rely to process the personal data. It also describes who we may disclose your personal data to.

3.2 These “legal grounds” are set out in the General Data Protection Regulation (EU) 2016/679 and other applicable statutory data protections laws (the Applicable Data Protection Laws).

3.3 We may use your personal data:

(a) To communicate effectively with you and conduct our business ► to conduct our business, including to identify you, to respond to your queries, to otherwise communicate with you (including to notify you of any changes to the Website or our services), or to carry out our obligations arising from any agreements entered into between you and us;

Legal bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services to you)

(a) In relation to fraud prevention and detection ► we and other organisations may also access and use certain personal data (including monitoring certain communication) to undertake security vetting and to detect and prevent fraud as may be required by applicable law and regulation and best practice at any given time. If false or inaccurate personal data is provided and fraud is identified or suspected, details may be passed to fraud prevention agencies and may be recorded by us or by them;

Legal bases: legal obligations, legitimate interests (to ensure that you fall within our acceptable risk profile and to assist with the prevention of crime and fraud)

(b) For research and development purposes ► to analyse your personal data in order to better understand your and our other clients’ requirements, to better understand our business and develop our products and services;

Legal bases: legitimate interests (to allow us to improve our services)

(c) To analyse Website usage and to ensure Website content is relevant ► to analyse your usage of our Website and to ensure that content from our Website is presented in the most effective manner for you and for your device, which may include passing your personal data to business partners, suppliers and/or service providers; and

Legal bases: legitimate interests (to allow us to provide you with the content and services on the Website)

(d) In connection with legal or regulatory obligations ► We may process your personal data to comply with our regulatory requirements, which may include disclosing your personal data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so. 

Legal bases: legal obligations, legal claims, legitimate interests (to cooperate with law enforcement and regulatory authorities)

3.4 Please note that in addition to the disclosures we have identified below, we may disclose personal data for the purposes we explain in this Privacy Notice to service providers, contractors, agents, advisors (e.g. legal, financial, business or other advisors) and affiliates of Civitas Social Housing PLC that perform activities on our behalf.

4. Transmission, storage and security of your personal data

Security over the internet

4.1 No data transmission over the Internet or the Website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal data in accordance with requirements of the Applicable Data Protection Laws.

4.2 All personal data you provide to us is stored on our or our subcontractors’ secure servers and accessed and used subject to our security policies and standards.

Export outside the EEA

4.3 Your personal data may be accessed by staff or suppliers in, transferred to, and/or stored at, a destination outside the country in which you are located, whose data protection laws may be of a lower standard than those in your country. We will, in all circumstances, safeguard personal data as set out in this Privacy Policy.

4.4 Where we transfer personal data from inside the European Economic Area (the EEA) to outside the EEA, we may be required to take specific additional measures to safeguard the relevant personal data. Certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections to EEA data protection laws and therefore no additional safeguards are required to export personal data to these jurisdictions. In countries which have not had these approvals (see the full list here), we will establish legal grounds justifying such transfer, such as EU Commission-approved model contractual clauses, or other legal grounds permitted by the Applicable Data Protection Laws.

4.5 Please contact us as set out in the “Contacting us” section below if you would like to see a copy of the specific safeguards applied to the export of your personal data.

Storage limits

4.6 Our retention periods for personal data are based on business needs and legal requirements. We retain personal data for as long as is necessary for the processing purpose(s) for which the personal data was collected, and any other permissible, related purpose. For example, we may retain certain data to comply with regulatory requirements regarding the retention of such personal data. When personal data is no longer needed, we either irreversibly anonymise the personal data (and we may further retain and use the anonymised data) or securely destroy the personal data.

5. Your rights & contacting us

Your rights

5.1 If you have any questions in relation to our use of your personal data, you should first contact us as per the “Contacting us” section below. Under certain conditions, you may have the right to require us to:

(a) provide you with further details on the use we make of your personal data;

(b) provide you with a copy of personal data that you have provided to us;

(c) update any inaccuracies in the personal data we hold; and

(d) delete any personal data we no longer have a lawful ground to use.

You may also have the right to:

(e) where processing is based on consent, withdraw your consent so that we stop that particular processing;

(f) ask us to transmit the personal data you have provided to us and we still hold about you to a third party electronically;

(g) object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and

(h) restrict how we use your personal data whilst a complaint is being investigated.

5.2 Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). If you exercise any of these rights we will check your entitlement and respond in most cases within a month.

5.3 If you are not satisfied with our use of your personal data or our response to any exercise of these rights you have the right to complain to the Information Commissioner’s Office.

Contacting us

If you have any questions in relation to this Privacy Policy, please contact us at Civitas Social Housing PLC c/o Civitas Investment Management Limited at 13 Berkeley Street, W1J 8DU

6. Cookies Policy

6.1 We use cookies on the Website. To find out more about how we use cookies, please see our Cookies Policy

7. Changes to our Privacy Policy and/or Cookies Policy

7.1 We may change the content of our Website and how we use cookies and consequently our Privacy Policy and our Cookie Policy may change from time to time in the future. If we change this Privacy Policy or our Cookies Policy, we will update the date it was last changed below. If these changes are material, we will indicate this clearly on our Website.

7.2 This Privacy Policy was last updated on 6 June 2019.