1. Introduction
Winkworth Franchising Limited (“WFL”) is a company registered in England and Wales with company registration number 0395011, whose registered office is at c/o Sherrards Solicitors, 1-3 Pemberton Row, London, EC4A 3BG. Our registered VAT number is 802 4915 49.
All of the Winkworth offices are independently owned and operated by franchisees (“Franchisee(s)”) under licence from WFL as the franchisor. In this privacy policy, references to “we”, “our” or “us” shall be deemed to mean WFL and its subsidiaries, any holding company of WFL and its subsidiaries and the Franchisees (whether separately or altogether).
We are committed to protecting your personal data. This privacy policy gives you detailed information on when and why we collect your personal data, how we use it and how we keep it secure. Please read this policy carefully alongside our Cookie Policy and our Data Retention Policy to understand our views and practices regarding your personal data and how we will treat it.
More information can be provided on request. Definitions, and words in bold type, are defined in the Appendix at the end of this privacy policy.
2. Our responsibilities
For the purposes of the applicable Data Protection Legislation, we are the data controller of any personal data we process. As a data controller, we are responsible for ensuring our systems, processes, suppliers and People comply with Data Protection Legislation in relation to the personal data we handle.
We provide our People with training and require our People to comply with this privacy policy, our Cookie Policy and our Data Retention Policy when dealing with personal data.
We take Personal Data Breaches very seriously, and are required to notify the Information Commissioner’s Office in the event of such a breach.
When using, collecting and disclosing personal data, we follow the core data protection Principles underlying the Data Protection Legislation.
We have policies, procedures and records to demonstrate compliance with the Principles.
For further information on these policies, procedures and records, please contact us by writing to:
The Data Protection Office
Winkworth Franchising Limited
80 Strand,
London,
WC2R 0RL
or by email to us at dpo@winkworth.co.uk
3. How we collect, use and disclose your personal data
Generally, we collect your personal data when you interact with us (for example, when entering into a relationship with us as Customer, a third party service provider or one of our People). However, from time to time we also need to collect personal data from other third parties
in connection with our relationship with you. We also look at how our users access and use our Website, so we can offer the best possible experience. The following tables, summarise how we collect, use and disclose your personal data:
Website Terms of Use
Winkworth Customers
|
Types of personal data |
Collection |
Purpose |
Disclosure |
Retention Period |
|
Information such as:
|
Your personal data will be collected from various sources including:
|
Your personal data will be used for the following purposes:
Photographs and images of your property (internal and external) may be used in our marketing and promotional material including our Website only where you have given us explicit consent to do so. Often you will have given this consent as part of formalising our engagement. |
Your personal data may be transferred to:
We shall only transfer personal data to third parties which is limited to the relevant purpose and is adequately protected. |
Please refer to our Retention Policy. |
Service Providers
Types of personal data |
Collection |
Purpose |
Disclosure |
Retention Period |
|
Information such as your:
|
Your personal data will be collected from you directly. |
Your personal data will be used for relationship management and file opening, administration, to fulfil our contractual obligations and as required by law (e.g. anti money laundering). |
Your personal data may be disclosed to:
for the purposes of fulfilling our contractual obligations. |
Please refer to our Retention Policy. |
Subscribers to our promotional material
|
Types of personal data |
Collection |
Purpose |
Disclosure |
Retention Period |
|
Information such as your:
Additional information may be processed where it is provided by you, for example:
|
Your personal data is collected when you register and ‘opt in’ to receive:
You can contact us at any time to amend your preferences or opt out of communications from us. You will also be sent the option to opt out of future communications in every communication you receive from us. |
Where you have given us your clear, unambiguous consent to do so, your personal data will be used to:
|
Your personal data may be transferred to our third party service providers who support the operation of our business. |
Please refer to our Retention Policy. |
Users of our Website
|
Types of personal data |
Collection |
Purpose |
Disclosure |
Retention Period |
|
Your personal data is collected when you:
|
Your personal information is used to:
|
Your personal data may be transferred to our third party service providers who support the operation of our business. |
Please refer to our Retention Policy. |
Our People and People making applications to become our People
Types of data |
Collection |
Purpose |
Disclosure |
Retention Period |
|
Personal data such as
We may also process sensitive personal data such as health details, racial origin, religious beliefs and information about offences/ alleged offences. |
Your personal data will be collected from various sources including:
Winkworth Academy |
Your personal data will be used for the following purposes:
Photographs and images of you, your name, and information about your education and employment may be used in our marketing and promotional material including our Website and pitches to Clients. |
Your personal data may be transferred to
for the purposes of fulfilling our contractual obligations. |
Please refer to our Retention Policy. |
4. Transfers of personal data
Personal data may be transferred to one of our Associated Agents for the purposes of fulfilling our obligations to our Customers.
We also use a number of suppliers in connection with the operation of our business and they may have access to the personal data we process. For example, an IT supplier may collect data on our behalf and/or see our personal data when providing software support, or a company which we use for a marketing campaign may process contacts’ personal data for us.
When contracting with suppliers and/or transferring personal data to a different jurisdiction, we take appropriate steps to ensure that there is adequate protection in place and that the Principles are adhered to.
All Winkworth offices are independently owned and operated. We operate as a network of estate agent offices, including offices in Europe and our China Desk, and therefore the data you provide to us may be transferred within the network for the applicable Purpose. For example, if you are looking to purchase a property and you give your personal data to one of our offices for that purpose that office may share your details with other offices to enable us to send you details of other properties which may be of interest to you.
5. Your rights
The Data Protection Legislation gives you certain rights in relation to the information held about you, including the right to:
- request a copy of your personal data;
- request your inaccurate personal data is corrected;
- request your personal data is deleted and destroyed;
- opt out of /unsubscribe from receiving electronic promotional/marketing communications from us ; and
- request the transfer of your personal data to another party.
Should you wish to make a request in line with your rights as an individual (a “Request”), please contact us as follows:
If you are:
- A Winkworth customer – please contact the Winkworth office you have registered with, or, if you have registered with multiple Winkworth offices contact the Data Protection Office, or, alternatively complete and submit the following Winkworth Data Request Form www.winkworth.co.uk/data-request.
- A Service Provider – please contact the Winkworth office you are working with, or, alternatively, contact the Data Protection Office .
-
- A Subscriber to our promotional/marketing material – please contact the Winkworth office you have registered with, or, alternatively, if you have registered with multiple Winkworth offices, email dpo@winkworth.co.uk Please note, you will always be given the option to unsubscribe from our promotional /marketing material in each communication you receive.
- A User of our Website – please contact webmaster@winkworth.com.
- One of our People or a person making an application to become one of our People – please contact the Winkworth office that employs you or with whom you have been dealing, or Winkworth’s recruitment team.
- Anybody else – please contact the Data Protection Office
Exercising Your Rights
1. Once you have made contact with us, you will be asked to complete a form and you will be asked to provide proof of your identity (except where your request relates to unsubscribing from marketing/ promotional material, which does not require proof of identity, or if it would be disproportionate to do so given the circumstances). We will provide information on the action taken on your Request without undue delay (and in any event within one month of receipt of proof of your identity, or, where you simply wish to unsubscribe, receipt of your Request).
2. This response period may be extended by two further months where necessary (see point 4 below for examples of when an extension might be necessary). We will inform you of any such extension within one month of receipt of the Request, together with the reasons for the delay.
3. If we do not take action on your Request, we will inform you without delay (and at the latest within one month of receipt of proof of your identity) of the reasons for not taking action, and on the possibility of lodging a complaint with the Information Commissioner. See point 4 below for examples of when we may not be able to take action on your Request.
4. Examples of when we may delay or be unable to take action on a Request include:
- if the Request includes information of other individuals;
- if you have not given us all the information we need, including proof of identity;
- if we have a legal obligation to keep certain information;
- if your Request is excessive;
- if the data is necessary for establishing, exercising or defending legal claims; and/or
- if we are not required to action your request under the Data Protection Legislation.
5. In accordance with our Data Retention Policy, Requests and correspondence regarding Requests will be held for the current year plus six years.
6. For further information about your rights under the Data Protection Legislation and how to raise any concerns you may have, please refer to the ICO website: www.ico.org.uk/your-data-matters
6. Security
Information security is a key element of data protection. We take appropriate measures to ensure our systems, processes, suppliers and People secure personal data and protect it from loss or unauthorised disclosure or damage. Please contact us if you require further information regarding our policy and approach to information security.
7.Computer Security
Keep yourself safe from malware and viruses with adequate, up to date security on your computer. You can usually download free basic protection from providers such as AVG and McAfee, but for more comprehensive cover, it’s best to choose security software. Keep your software switched on and up to date, and make sure that your operating system has the latest updates. It’s a good idea to run regular scans on your computer.
When you’re opening emails, be careful. Don’t click on links to download files or open attachments you haven’t asked for, or aren’t expecting, as they may contain viruses. Back up all your files so they’re available if the worst happens and your computer is infected by a virus.
8. Cookies
Our Website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our Website. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.
9. Consent to marketing
Where you have given us your clear, unambiguous consent to do so, your personal data may be used to contact you about, and provide you with, communications and/or marketing material for which you have specifically subscribed.
Where we wish to transfer your personal data to third parties who are not involved in the provision of our services (for example, mortgage providers and providers of legal services) but who we consider might interest you, we will always ask you to give your consent. Where you give us such consent (e.g. you tick the relevant consent box when registering in person at one of our offices), but you then decide/omit to provide consent at a subsequent opportunity (e.g. you later re-register online and do not tick the relevant consent box, having previously ticked an equivalent consent box in our office) you will be deemed to continue to consent until you contact us to formally confirm you wish to withdraw your initial consent (which you can do at any time).
10. Changes to our privacy policy
We keep our privacy policy under regular review. If we make changes to our Privacy Policy that affect how we handle your data, we will let you know by email. Minor changes will not be notified. You can check our Privacy Policy at this page at any time. This privacy policy was last updated on 1 April 2019.
11. Contacts and complaints
Questions, comments and complaints regarding this privacy policy should be addressed to:
The Data Protection Office
Winkworth Franchising Limited
80 Strand,
London,
WC2R 0RL
or by writing to us at dpo@winkworth.co.uk
Our People must inform our Data Protection Office immediately if they receive a complaint relating to how we have processed personal data so our complaints procedure can be followed.
Appendix
Associated Agents: estate agencies in the UK and also in jurisdictions outside of the UK who have either:
(a) engaged us to provide estate agency services on their behalf in the UK.; or
(b) been engaged by us to provide estate agency services on our behalf in a jurisdiction outside of the UK.
China Desk: a WFL department dedicated to providing a full property service to Chinese clients looking to buy and sell in Europe.
Consent: means the freely given, specific, informed and unambiguous consent given by a data subject in relation to his/her personal data being processed.
Controller: a personal/organisation who determines the purpose for which, and the manner in which, any personal data is processed.
Customer: a current or prospective Winkworth customer being a vendor, buyer, landlord or tenant.
Data Protection Legislation: all applicable data protection and privacy legislation in force from time to time in the UK including the General Data Protection Regulation ((EU) 2016/679); the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003 No. 2426) as amended and all related regulations, regulatory codes of practice, opinions and guidance issued from time to time, including by the Information Commissioner, and in each case any amending, superseding or replacement applicable law.
Legitimate Interests: our commercial interests, or the commercial interests of third parties, for which we have satisfied ourselves (through completing a Legitimate Impact Assessment) that:
- processing of personal data is necessary to achieve these commercial interests; and
- the data subject’s interests do not override these commercial interests.
Legitimate Interest Assessment: an assessment which we carry out in respect of each commercial interest we seek to rely on as a Legitimate Interest. We keep a record of each assessment and review it on a quarterly basis. If an assessment raises any concerns over the impact of the processing on the rights and freedoms of the data subject’s concerned, an additional “data protection impact assessment” will be carried out.
People: all people providing services to or working for us, including but not limited to our employees, directors, members, Franchisees and contractors.
Personal data: information (including opinions) which relates to an individual and from which he or she can be identified either directly or indirectly through other data which we have or are likely to have in our possession. These individuals are sometimes referred to as data subjects.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed by an organisation electronically. A personal data breach may mean someone outside the organisation gets unauthorised access to personal data, but a breach can occur if there is unauthorised access within the organisation or if an employee accidentally alters or deletes personal data.
Principles: these core principles specify personal data should be: processed lawfully, fairly and in a transparent manner; collected for specified, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; accurate and, where necessary, kept up to date; kept for no longer than is necessary; processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Additionally, organisations must adhere to the principle of accountability.
Process: the ‘processing’ of personal data captures a wide range of activities, and includes obtaining, recording and holding personal data and performing any operation of the personal data (including erasure/destruction).
Processor: any person (other than an employee of the data controller) who processes the data on behalf of the data controller.
Purpose: the purposes identified in the “Purpose” column of the tables in section 3 of this privacy policy (How we collect, use and disclose your personal data), as applicable.
Sensitive personal data: data consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Third party: a person, organisation or other body other than the data subject, controller or processor.
Website: https://www.winkworth.co.uk/(including all pages linked within the site map).
12. Credit Reference and Affordability Checks
To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.
- Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority
- FCA Firm Reference Number: 742313
- TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority
- FCA Firm Reference Number: 805757
The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.
Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:
- Creditsafe Privacy / Transparency Notice:
- TransUnion CRAIN (Credit Reference Agency Information Notice):
- TransUnion Bureau Privacy Notice:
Additional required updates
Below is a list of items that are currently missing from your privacy policy and are required in order to access or continue accessing consumer reports.
International data transfers outside the UK/EU and safeguards
We may transfer personal data to recipients or service providers located outside the UK and/or European Economic Area (EEA).
Where such transfers take place, we ensure appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws. These safeguards may include the use of approved standard contractual clauses, international data transfer agreements, or transfers to countries that have been recognised as providing an adequate level of data protection.
Data retention period
We keep personal data only for as long as necessary for its purpose and to meet legal or regulatory obligations. Data used for credit reference or affordability checks is retained only for as long as required and then securely deleted.
Right to lodge a complaint with the ICO
You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data.
Whether provision of data is statutory or contractual and consequences
Provision of Personal Data
Is the provision of personal data statutory or contractual?
The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations.
Personal data is required to:
- enter into and perform contracts with customers, suppliers, or business partners.
- process orders, manage accounts, and deliver goods and services.
- verify identity and prevent fraud; and
- comply with applicable legal, regulatory, accounting, and tax obligations.
What are the consequences of not providing personal data?
If you choose not to provide the personal data, we request:
- we may be unable to enter into a contract with you.
- we may be unable to fulfil orders, supply goods, or provide services.
- we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and
- as a result, our services may be delayed, restricted, or declined.
Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us.
13. Right to restrict processing
You have the right to request that we limit how we use your personal data in certain circumstances.
Right to object
You have the right to object to the processing of your personal data where we rely on legitimate interests or where data is used for direct marketing.
Automated decision-making/profiling
Based on this if they do NOT use Automated Decision Making
Non-Automated Decision Making and Profiling
We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management.
These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review.
The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement.
Based on this if they DO use Automated Decision Making
Automated Decision Making and Profiling
In some circumstances, we may conduct automated decision making or profiling using personal data. This involves the use of automated systems to evaluate certain information about an individual, such as risk factors, affordability indicators, or fraud signals, based on predefined rules or algorithms. Making or profiling using personal data. This involves the use of automated systems to evaluate certain information about an individual, such as risk factors, affordability indicators, or fraud signals, based on predefined rules or algorithms. Making or profiling using personal data. This involves the use of automated systems to evaluate certain information about an individual, such as risk factors, affordability indicators, or fraud signals, based on predefined rules or algorithms.
Where automated decision making is used, it may result in decisions such as the approval, restriction, or rejection of an application or service. Making is used, it may result in decisions such as the approval, restriction, or rejection of an application or service. Making is used, it may result in decisions such as the approval, restriction, or rejection of an application or service.
Individuals have the right to request human intervention, to express their point of view, and to challenge decisions made solely by automated means. Further information about automated decision making and how to exercise these rights can be obtained by contacting us using the details provided in this Privacy Policy. Making and how to exercise these rights can be obtained by contacting us using the details provided in this Privacy Policy‑making and how to exercise these rights can be obtained by contacting us using the details provided in this Privacy Policy.