Privacy Policy

Little Chimney Ltd

1. 1. Overview

   We understand that your privacy and the security of your personal information is extremely important.This privacy policy is provided in accordance with our obligations under applicable privacy and data protection law, including the UK retained version of Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018. We ask that you read this privacy policy carefully as it sets out what we do with your personal information, what we do to keep it secure, from where and how we collect it, as well as your rights in relation to the personal information we hold about you and how to contact us and supervisory authorities in the event you have any questions regarding the processing of your personal information or wish to make a complaint.

   This privacy policy applies where:

   • you enquire about our services;
   • we provide services to you; and/or
   • you interact with us, over the phone, online, via email, by using our website (www.chimnie.co.uk) ("Website") or interacting with us on social media.

2. 2. Who are we?

   This privacy policy governs the manner in which Little Chimney Limited (also referred to in this privacy policy as "our", "us" or "we"), a company registered in England and Wales with Company No: 13346445 and having its registered address at 14 North Street, Bourne, England, PE10 9AB, collects, uses, maintains and discloses personal information about you ("your data") when you:

   • enquire about services from us;
   • use our services; and/or
   • interact with us online, by email, by phone or through our social media channels or Website.

   For the purposes of data protection law, the "data controller" is the entity which determines the purposes and means of any processing of personal data which relates to you under this privacy policy. We are the Data Controller in relation to the personal information we process about you pursuant to this privacy policy.

3. 3. What personal information do we hold and how do we obtain it?

   Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (e.g. anonymous data). We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

   • information that you provide to us such as your name, address, telephone number, email address, bank account and payment card details as part of using or accessing our services and/or interacting with us through our Website;
   • data relating to your property such as its location, images of your property and room information;
   • feedback you provide to us, including by phone, email, post, or through our Website;
   • communications that you have with us through our Website (e.g. in our web chat facility, through our "contact us" form and/or by email);
   • information about the services that we provide to you (including for example, the things we have provided to you, when and where, what you paid, the way you use our services, and so on);
   • information about properties you have viewed, liked or commented on, or communicated about with other users;
   • information you have provided in relation to a survey, competition or promotion you have taken part in, and
   • your account login details for our Website, including your user name and chosen password.

   We use different methods to collect data from and about you including through:

   • Direct interactions. You may give us your personal data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
     • apply for our products or services;
     • create an account on our website;
     • subscribe to our service or publications;
     • request marketing to be sent to you;
     • enter a competition, promotion or survey; or
     • give us feedback or contact us.
   • Automated technologies or interactions. As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.
   • Third parties or publicly available sources. We will receive personal data about you from various third parties such as IP API, PAF and HM Land Registry.

4. 4. Our legal basis for processing your personal data

   We will process your personal information lawfully, fairly and in a transparent manner. Whenever we process your personal information we have to have something called a "legal basis" for what we do. The most appropriate legal basis will depend on the processing taking place as set out in section 5 (How do we use your personal information?) below.

   The different legal bases we most commonly rely on are:

   • Legitimate interests: The processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights.
   • Performance of a contract: We must process your personal information in order to be able to provide you with our services.
   • Legal obligation: We are required to process your personal information by law.

   Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email. We will obtain and need your consent when sharing information with third parties like the IFAs for the purpose of third parties using it to market or provide services to you as a user. You have the right to withdraw consent to marketing at any time by contacting us. With your permission, we may feature you or your profile in publicity and marketing campaigns and to feature you or your profile on the Service.

   Where we process any "special category personal data", in addition to one of the legal bases noted above, we also need that we have a further legal basis for such processing. This will most commonly be one of the following:

   • Explicit Consent: where you have given us your explicit consent to the processing (e.g. you want to register your property for sale and submit information so we may carry out verification checks via our service providers).
   • Legal claims and judicial acts: the processing is necessary for the establishment, exercise or defence of legal claims.
   • Substantial public interest: the processing is necessary for reasons of substantial public interest (e.g. regulatory requirements, preventing or detecting unlawful acts).

   When we refer to "special category personal data" we mean personal data that reveals racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, sex life or sexual orientation of an individual. We only collect special category personal data in the performance of verification checks for sellers. We do not request such personal data in any other context and ask that you do not submit any other special category personal data to our Service. If you do enter your own special category personal data, you acknowledge that you are voluntarily making this personal data public.

5. 5. How do we use your personal information?

   We have set out below a description of the ways we use your personal information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We may process your personal information for more than one lawful ground depending on the specific purpose for which we are using your information.

   Please contact us if you need details about the specific legal basis we are relying on to process your personal information where more than one ground has been set out in the table below:

   Purpose of processing

   Why do we collect personal information?

   Why are we using the information (legal basis for processing)?

   To provide our services to you

   We need to use your personal information to make our services available to you.

   This processing may include using your personal information to:

   • allow you to list your property within our off-market inventory of real estate profiles which provides access to buyers searching for their dream home;
   • provide you access to our "Digital Community" functionality on the Website;
   • authenticate payments from you;
   • provide you with service related documentation; and/or
   • notify you of any changes to your terms of use;

   Performance of a Contract: We process your personal information because have a contract with you and we have to use your information in this way as a necessary part of that contract.

   Legitimate Interests: Once you no longer are receiving services from us, we keep your information for a period of time afterwards as part of our legitimate interests in case needed for a complaint or regulatory enquiry.

   To manage and improve our services and our Website

   We use personal information to conduct data analytics to improve our services and the Website to ensure customers are offered the best possible services and experience.

   Legitimate Interests: This includes to study how customers use our services in order to improve and to develop them and to grow our business.

   Consent: Where we do this by way of cookies, with your consent.

   To manage payments that you make to us

   We use personal information to facilitate and manage payments that you make to increase the visibility of your property on the Website.

   Legitimate Interests: This allows us to ensure that we receive the money due to us for the services we provide and to maintain the financial viability of our business.

   To record calls to our call centres or online conversations (e.g. web chats)

   We use call recordings and transcripts from web chat conversations to prevent fraud, for staff training and to manage customer complaints.

   Legitimate Interests: To protect and develop our business as call recordings and web chat transcripts help us to meet our responsibilities to combat fraud, provide good customer service and respond to complaints.

   To make suggestions and recommendations to you about goods or services that may be of interest to you

   Legitimate Interests: To grow our business and develop our products and services.

   To check your identity

   In order to ensure that you are listing a property through our services which you own and to avoid any fraudulent use of our services.

   We require to undertake verification checks of sellers of properties via our Service. This may include a requirement on you to provide certain documents to verify your identity and ownership of the property such as a mortgage statement and/or passport. We may use this information to conduct checks on the property (including the ownership information held by HM Land Registry) to verify you as the homeowner.

   Legitimate Interests: To ensure that properties listed on our site are owned by the person listing the property and to ensure our services are accurate for other users.

   Substantial Public Interest: To ensure that our services are not used in a fraudulent manner and to prevent or detect unlawful acts by users.

   Your Marketing Preferences

   We may send you emails about products and services we think you will like, but you can always tell us if you don't want to receive these anymore.

   • Email: We may contact you by email about our services. If you don't want us to contact you by email with marketing messages, you can unsubscribe from our marketing emails by clicking on the unsubscribe link in the emails we send to you.

6. 6. Who do we share your personal information with?

   We may share your personal information with the following third parties as part of the purposes set out in section 5 (How do we use your personal information?) above:

   Our service providers - we work with different companies so that they can help us provide the products and services you require from us. These third parties include:

   • credit reference agencies, fraud prevention agencies, law enforcement agencies, verification agencies such as Fluent®;
   • third party providers of fraud screening services;
   • third party vendors who help us manage and maintain our IT infrastructure;
   • where relevant, our professional advisors, such as lawyers, auditors, accountants, tax advisers and consultants that provide advice and services to us;
   • security and fraud prevention companies to ensure the safety and security of our customers, colleagues and business; and
   • companies that enable us to collect your reviews and comments, both online and offline;

   Other organisations and individuals – in addition to the disclosures set out above, we may also share your personal information in certain scenarios such as:

   • if we're discussing selling or transferring part or all of our business, we may share information about you to prospective purchasers and their advisers - but only so they can evaluate the relevant business;
   • if we are reorganised or sold to another organisation, we may transfer information we hold about you to them so they can continue to provide products and/or services to you;
   • if we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority;
   • to HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances;
   • to HM Land Registry in order to confirm property ownership; or
   • if we need to do so in order to exercise or protect our legal rights, users, systems and services (e.g. disclosures to courts, tribunals and/or law enforcement officers as part of legal proceedings or investigations).

7. 7. International transfers of personal information

   Many of our external third parties listed above are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK.

   Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

   • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the ICO.
   • Where we use certain service providers outside the UK or EU, we may use specific contracts approved by the ICO and/or European Commission, as applicable, which give personal data the same protection it has in the UK and/or Europe as applicable.

8. 8. Your rights and consent

   You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you.

   These include:

   • the right to access a copy of the personal information we hold about you;
   • the right to correction of inaccurate personal information we hold about you;
   • the right to restrict our use of your personal information;
   • the right to request erasure of your personal information;
   • the right of data portability; and
   • the right to object to our use of your personal information.

   We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

   Consent
   Where we rely on consent as the legal basis on which we process your personal information, you may also withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

   If you are seeking to exercise any of these rights, please contact us using the details set out in section 11 (Contact Us) below. Please note that we may need to verify your identity before we can fulfil any of your rights under data protection law (including where you are a third party wanting to enforce these rights on behalf of someone else). This helps us to protect the personal information belonging to our customers against fraudulent requests.

9. 9. How long will we keep your personal information for?

   We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

   To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

10. 10. Security

    We take protecting your personal information seriously and are continuously developing our security systems and processes. Some of the controls we have in place are:

    • we use HTTPS SSL certificates;
    • we limit physical access to our buildings and user access to our systems to only those that we believe are entitled to be there or use such systems;
    • we use technology controls for our information systems, such as firewalls, user verification, strong data encryption, and separation of roles, systems & data;
    • systems are proactively monitored through a "detect and respond" information security function;
    • we utilize industry "good practice" standards to support the maintenance of a robust information security management system; and
    • we enforce a "need to know" policy, for access to any data or systems.

11. 11. Contact us

    If you would like to exercise one of your rights as set out in section 8 (Your Rights and Consent) above, or you have a question or a complaint about this privacy policy, or the way your personal information is processed, please contact us by one of the following means:

    By email: hello@chimnie.co.uk; or
    By post: Little Chimney Limited 14 North Street, Bourne, England, PE10 9AB

    You also have the right to lodge a complaint with the UK regulator, the Information Commissioner's Office ("ICO"). Go to ico.org.uk/concerns to find out more. The ICO may be contacted at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113. Our ICO registration number is ZB221480.

12. 12. Cookies and similar technologies

    We use cookies on our Website. Please read this cookie policy ("cookie policy", "policy") carefully before using www.chimnie.co.uk website ("website", "service") operated by Little Chimney Limited ("us", "we", "our").

    What are cookies?

    Cookies are simple text files that are stored on your computer or mobile device by a website's server. Each cookie is unique to your web browser. It will contain some anonymous information such as a unique identifier, website's domain name, and some digits and numbers.

    What types of cookies do we use?

    Necessary cookies
    Necessary cookies allow us to offer you the best possible experience when accessing and navigating through our website and using its features. For example, these cookies let us recognize that you have created an account and have logged into that account.

    How to delete cookies?

    If you want to restrict or block the cookies that are set by our website, you can do so through your browser setting. Alternatively, you can visit www.internetcookies.org, which contains comprehensive information on how to do this on a wide variety of browsers and devices. You will find general information about cookies and details on how to delete cookies from your device.

    Contacting us
    If you have any questions about this policy or our use of cookies, please contact us.

13. 13. Policy change

    This privacy policy was most recently updated in December 2023. If we make changes to it, then we will take appropriate steps to bring those changes to your attention (e.g. by communicating the change to you through email).