1. When this Privacy Policy applies

This Privacy Policy applies:  

• to your use of any of our services where we are performing a data controller function;
• where you apply to us for a job or work placement;
• to your supply of services to us where this involves any personal data; and/or
• to any personal data collected from third parties where we are the controller of such data.

This Privacy Policy additionally applies to our website and online services, including our website www.forbury.com and our Forbury Portal and any other website, mobile app or other online service created or hosted by us from time to time on which this Privacy Policy appears (together, our "online services") through which we may collect certain details if, for example, you want to subscribe to any publications or newsletters that we may periodically issue.

This Privacy Policy does not apply to, and Forbury is not responsible for, any third-party websites which may be accessible through links from this website (please see section 11 Online Services - Links to Third Party Sites, Services and Content, below for more information).

As Forbury is made up of different legal entities, there may be more than one data controller of your personal data within our group where you have engaged different parts of our broader organisation to provide different or jointly delivered services. When we mention Forbury, "we", "us" or "our" in this privacy policy, we are referring to the relevant company in the Forbury Group responsible for processing your data. Forbury Property Valuation Solutions (UK) Ltd is the controller and responsible for this website.

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out in section 15 How to Contact us.

2. The personal data that we collect

"Personal data" is any information that can be used to identify you or that we can link to you. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data including first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data including billing address, delivery address, email address and telephone numbers.
• Financial Data including bank account and payment card details.
• Transaction Data including details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data including your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
• Usage Data including information about how you use our website, products, and services.
• Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

3. How we collect your personal data

Where you use our services, we will collect personal data directly from you that you voluntarily provide to us, including when you communicate with us via email or other channels; when you sign up for or request that we send you newsletters, alerts, or other materials; when you sign up for a webinar or event; and when you respond to our communications or requests for information.

The information you provide may include current and historical personal data including your name, contact details, title, identification, usernames, employment, positions held and enquiry/complaint details and information about the organisation with which you are affiliated. We may also collect personal data about your other dealings with us and our clients, including any contact we have with you in person, by telephone, email or online.

We may collect your personal data in a number of ways, including:

• through customers providing details of authorised users or other contacts;
• through our website, by telephone or email;
• through computer code in our products which send us log activity about use of our products;
• while providing technical support, consultation, or product information;
• through details of visits made to our online services including, but not limited to, the volume of traffic received, logs (including, where available, the IP address and location of the device connecting to the online services and other technical information and identifiers about the device and the nature of the visit) and the resources accessed;
• through third party referrals; and
• through the process of maintaining and upgrading our products, services and website.

We may also collect personal data from third parties such as your employing organisation, regulatory authorities, recruitment agencies, credit reporting agencies, information or service providers, publicly available records, and the third parties described in the section 6 (Disclosure of your Personal Data).

We may collect personal data from other sources, such as social media platforms that share information about how you interact with our social media content, and any information gathered through these channels will be governed by the privacy settings, policies, and/or procedures of the applicable social media platform, which we strongly encourage you to review.

We will handle any unsolicited personal data in accordance with law, including destroying or de-identifying such data where we are required to do so.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

4. Your obligations when you provide personal data of others

You must not provide us with personal data of any other individual unless you have the express consent of that individual to do so. If you do provide us with personal data about another individual:

• before doing so you must tell that individual that you will be providing their personal data to us and that we will handle their personal data in accordance with this privacy policy;
• provide that individual with a copy of (or refer them to) this privacy policy; and
• you warrant that you have that individual's consent to provide their personal data to us.

5. The Legal Basis for collecting your personal data and how we use it

We will only use your personal data when the law allows us to. Most commonly, we collect and use your personal data to enable us to provide you, or your employing organisation, with our products and services, and for any directly related purposes as set out below. If we are unable to collect personal data we reasonably require, we may not be able to do business with you or the organisation with which you are connected.

Where we intend to use your personal data, we rely on the following legal grounds:

Performance of a contract: We may need to collect and use your personal data to enter into a contract with you, or your employing organisation, or to perform a contract that you have (or your employing organisation has) with us and where we respond to your requests and provide you (or your employing organisation) with services in accordance with our terms and conditions or other applicable terms of business agreed with you or with your employing organisation.

Legitimate interests: Where we consider use of your personal data as being (a) non-detrimental to you, (b) within your reasonable expectations, and (c) necessary for our own, or a third party’s legitimate purpose, we may use your personal data, which use may include:

• business and product development purposes;
• to monitor use of our products and services and improve the quality;
• for our own direct marketing or continued communication;
• the prevention of fraud;
• our own internal administrative purposes;
• personalisation of the service(s) we provide to you;
• ensuring network and information security, including preventing unauthorised access to electronic communications networks and stopping damage to computer and electronic communication systems; and/or
• reporting possible criminal acts or threats to public security to a competent authority.

Compliance with a legal obligation: We may be required to process your personal data due to legal requirements, including employment laws, tax laws and other regulatory provisions applicable to Forbury.

Consent: You may be asked to provide your consent in connection with certain services that we offer, for example in respect of any processing of your personal data for our marketing purposes where you or your employing organisation is not a client of Forbury. Where we are reliant upon your consent, you may withdraw this at any time by contacting us however, please note that we will no longer be able to provide you with the products or services that rely on having your consent.

We will not use your personal data other than as set out in this privacy policy or as required or permitted by law or as disclosed to you when we collect it. If at any time we intend to change the purpose for which we hold your personal data, for example to offer you with a complimentary service that we may provide in the future, we will give you prior information of that new purpose, so you are aware of this.

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased products or services from us and you have not opted out of receiving that marketing.

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. You can ask us or third parties to stop sending you marketing messages at any time by checking relevant boxes to adjust your marketing preferences, by following the opt-out links on any marketing message sent to you, or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, product/service experience or other transactions.

6. Disclosure of your personal data

We may disclose your personal data to our related entities, agents, contractors and external service providers (such as IT providers) where any of the following apply:

• You have consented to us sharing your personal data in this way.
• We deem it reasonably necessary to provide you with the services that you, or your employing organisation, have requested at any particular time.
• Such sharing is provided for under contract, including our terms and conditions for any particular service that we may provide to you or your employing organisation.
• Such sharing is to law enforcement bodies or other government authority.
• We need to enforce or apply our terms and conditions to which you have agreed (or other terms that have been agreed to apply to our relationship with you or your employing organisation).
• It is necessary to protect the rights and interests, property, or safety of Forbury, our clients or others.
• It is relevant in the circumstances to disclose the personal data to parties with whom we have co-promotional arrangements (such as jointly sponsored events, external venues, or caterers).
• Our agents or contractors who assist us in providing our services require such personal data, for example in fulfilling requests for personal data, receiving and sending communications, updating marketing lists, analysing data, providing support services or in other tasks from time to time. Our agents and contractors will only use your personal data to the extent necessary to perform their functions.
• We use third party service providers to provide services that involve data processing, for example archival, web-hosting, analytics providers in connection with the operation of our online services, event hosting, information technology providers, auditing, reference checking, professional advisory (including legal, accounting, financial and business consulting), mailing vendor, delivery, technology, website, research, banking, payment, client contact, data processing, insurance, forensic, litigation support, marketing and security services.
• All, or most, of the assets of Forbury or any single business unit within Forbury are merged with or acquired by a third party, or we expand or re-organise our business, in which case your personal data may form part of the transferred or merged assets.
• We are under a legal, regulatory or professional obligation to do so (for example, in order to comply with a Court Order).

We require all third parties to respect the security of your personal data. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Any third parties that we may share your personal data with are obliged to keep your details securely, to use them only to fulfill the service they provide you on Forbury’s behalf, and at all times to treat it in accordance with the law. When such third parties no longer need your personal data to fulfill this service, they will dispose of such personal data in line with Forbury’s procedures unless they are themselves under a legal obligation to retain personal data (provided that this will be in accordance with applicable data privacy laws).

The third parties to whom we may share your data with include Microsoft Azure, HubSpot and Salesforce.

We may, in providing our services and operating our business, allow access to your personal data to the different entities within Forbury’s group for our internal administrative purposes such as billing, promoting our events and services, and providing you or your organisation with services, provided in all instances that such processing is consistent with section 5 (Legal Basis for Usage of Personal Data) above and applicable law.

We also provide anonymous statistical information about users of our websites and related usage information to reputable third parties, including analytics and search engine providers.

We own the database rights in the information collected via our online services. We do not sell, rent, or otherwise share personal data with unaffiliated entities for their independent use except as expressly described in this Privacy Policy or with your express prior permission.

We may disclose your data to an actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger, acquisition, restructuring or insolvency of any part of our business, provided that we inform any recipient that it must use your personal data only for the purposes disclosed in this Privacy Policy.

We may share information that does not reasonably identify you as permitted by applicable law.

7. International Transfers

Where you are submitting personal data from within the UK, or the European Economic Area (“EEA”), such information may be transferred to countries outside the UK and/or EEA. By way of example, this may happen if one or more of our third-party service providers with whom we share personal data in accordance with section 6 (Disclosure of Your Personal Data) are located, or have their servers located, outside your country or the country from which the data were provided.

The third parties located outside the UK and/or the EEA include Microsoft Azure (based in the United States), HubSpot and Salesforce.

Whenever we transfer your personal data out of the UK and/or the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or
• Where we use certain service providers, we may use specific contracts approved for use in the UK and/or the EU which give personal data the same protection it has in the UK and/or the EU. This includes entering into appropriate data transfer agreements, including the use of Standard Contractual Clauses.

Where you are submitting personal data from within New Zealand or Australia, such information may be transferred overseas to countries including the United States of America. Where this occurs, we will take reasonable steps to ensure there are appropriate privacy, data handling and security arrangements in place to protect your information.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside of the country from which you are submitting your personal data.

8. Retention of your personal data

We retain the personal information we collect for no longer than is reasonably necessary to fulfill the purposes that such data was originally collected in accordance with our internal data retention policies or to comply with our legal, regulatory, tax, accounting or reporting obligations. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

9. Security of your personal data

We take steps to hold personal data securely in electronic or physical form. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our information security policy is supported by a variety of processes and procedures, and we store personal data in access-controlled premises or electronic databases requiring logins and passwords. All employees, officers, or contractors of Forbury and third-party providers with access to confidential information are subject to access controls and confidentiality obligations, and we require our third-party data storage providers to comply with appropriate information security industry standards.

Whilst we continually strive to ensure that our systems and controls are updated to reflect technological changes, the transmission of information via the internet is not completely secure, and as such we cannot guarantee the security of your personal data transmitted to our online services which is at your own risk.

If you communicate with us using non-secure web platforms, you assume the risks that such communications between us are intercepted, not received, delayed, corrupted or are received by persons other than the intended recipient.

Once we have received your personal data, we will take reasonable steps to use procedures and security features to try to prevent unauthorised access, modification or disclosure.

You can help us to keep your personal data secure by ensuring that any username or password in relation to our online services is kept strictly personal to you and not made available to any other person. You should stop using your username and password and notify us immediately if you suspect that someone else may be using your user details or password.

10. Cookies

Our website and services delivered online use cookies and other similar technologies, for example, to distinguish you from other users when you browse our website(s) or use our online services and to allow us to improve our online services.

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently to improve the user experience, as well as to provide certain information to the owners of the site.

We may, for example, collect information about the type of device you use to access our online services, the operating system and version, your IP address, your general geographic location as indicated by your IP address, your browser type, the content you view and features you access on our online services, the web pages you view immediately before and after you access our online services, whether and how you interact with content available on our online services, and the search terms you enter on our online services.

Forbury’s website sets cookies which remain on your computer for differing times. Some expire at the end of each session and some remain for longer so that when you return to our website, you will have a better user experience.

Which cookies we use

Detailed below are the cookies we use and why and how long they last.

Google Analytics

_utma: expires after 2 years

_utmb: expires after 30 minutes

_utmc: expires at end of the session

_utmz: expires after 2 years

We collect standard internet log information and details of visitor behaviour patterns by using Google Analytics cookies. We do this to compile reports and to help us find out things such as the number of visitors to the various parts of our website, so that this can be improved. This information does not identify visitors or collect any personal details. We do not make any attempt to find out the identities of those visiting our websites. We will not associate any data gathered in this way with any personal data from any source. For more information about Google Analytics cookies please see the link here.

To provide website visitors with more choice on how their data is collected by Google Analytics, Google have developed the Google Analytics Opt-out Browser Add-on. The add-on communicates with the Google Analytics JavaScript (ga.js) to indicate that information about the website visit should not be sent to Google Analytics. The Google Analytics Opt-out Browser Add-on does not prevent information from being sent to the website itself or to other web analytics services. For more information about Google Analytics Opt-out Brower Add-on please see the link here.

Google Analytics’ Data Retention, for Universal Analytics properties has been set to 26 months and for Google Analytics 4 properties we have it set at 14 months.

Control of cookies

Web browsers allow you to exercise some control of cookies through the browser settings. Most browsers enable you to block cookies or to block cookies from particular sites. Browsers can also help you to delete cookies when you close your browser. You should note however, that this may mean that any opt-outs or preferences you set on our website will be lost. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org which includes information on how to manage your settings for the major browser providers.

11. Online services - Links to third party sites, services and content

In addition to our online services, which we control directly, we also use and provide links to websites which are controlled by third parties, which may include:

• Twitter, LinkedIn and YouTube, where we have certain Forbury accounts and profiles.
• Facebook, where we have a social page.
• Our status page via Atlassian
• Customer websites in the case of testimonials

If you use or follow a link to any of these third-party websites, please be aware that these websites have their own privacy policies and that we cannot accept any responsibility for their use of information about you.

Our online services may include integrated content or links to content provided by third parties (such as video materials). This Privacy Policy does not address the privacy, security, or other practices of the third parties that provide such content.

We engage third parties that support the operation of our online services, such as analytics providers. These third parties may use technologies to track your online activities over time and across different websites and online platforms. Please see section 10 (Cookies Policy) above for more information.

12. Data Subject Rights

We take reasonable steps to ensure that your personal data is accurate, complete and up-to-date whenever we collect, use or disclose it. However, we also rely on you to advise us of any changes to your personal data.

Please let us know as soon as possible if there are any changes to your personal data or if you believe the personal data we hold about you is not accurate, complete or up-to-date.

If you make a request by contacting us at the contact details below, we will provide you with access to the personal data we hold about you unless otherwise required or permitted by law. We will notify you of the basis for any denial of access to your personal data.

Where you have consented to our processing of certain personal data, you can at any time withdraw such consent and/or tell us not to contact you with updates and information regarding our products and services (or part of them) either at the point such personal data is collected (by leaving the relevant box unticked) or, where you do not wish us to continue to use your personal data in this way, by following the unsubscribe instructions on any communications sent to you. Please note that where you withdraw your consent we will no longer be able to provide you with the products or services that rely on having your consent. You can also exercise this right at any time by contacting us using the contact details at the end of this Privacy Policy.

You can request:

• request access to the personal data we hold about you;
• request corrections or updates to your details;
• request the erasure of your personal data;
• object to processing of your personal data;
• request restriction of processing your personal data;
• request the transfer or portability of personal data that you have provided to us in a structured, commonly used and machine-readable format; and
• withdraw your consent.

If you would like to exercise any of the rights set out in this section, please contact us using the details set out below. We may refuse to provide access where we have legitimate reasons for doing so under applicable data privacy laws, and in exceptional circumstances may charge a fee for access if the relevant legislation allows us to do so, in which case we will provide reasons for our decision.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

13. How to make a complaint

If you wish to make a complaint about a breach of this privacy policy or under the relevant Data Privacy Laws, you can contact us using the contact details below. You will need to provide us with sufficient details regarding your complaint together with any supporting evidence and information.

We will investigate the issue and determine the steps (if any) that we will undertake to resolve your complaint. We will contact you if we require any additional information from you and will notify you in writing of the outcome of the investigation. If you are not satisfied with our determination, you can contact us to discuss your concerns or complain to:

• If in the UK: the Information Commissioners Office, details of which can be found at https://ico.org.uk/global/contact-us
• If in the EU: the European Commission, or the relevant data authority for the Member State, details of which can be found via https://edpb.europa.eu/about-edpb/about-edpb/members_en
• If in Australia: Australian Privacy Commissioner via oaic.gov.au
• If in New Zealand: Privacy Commissioner via https://www.privacy.org.nz/

14. Status of this Privacy Policy

Your provision of personal data to us or use of our online services constitutes your acceptance of the terms of this Privacy Policy.

As technologies and information governance practices develop, and data privacy laws (and surrounding guidance) evolve, we may need to revise this Privacy Policy. You should therefore review this page regularly to ensure that you are aware of any changes to its terms.

We will post any Privacy Policy changes on this page and, if the changes are significant or may materially impact upon your rights, we will provide a more prominent notice or contact you by other means (including, for certain services, email notification of Privacy Policy changes.

15. How to contact us

If you wish to gain access to your personal data, want us to correct or update it or you have a complaint about a breach of your privacy or any other query relating to this privacy policy, please contact us via the following means:

United Kingdom

Forbury Property Valuation Solutions (UK) Limited

Address: 180 Great Portland Street, London, W1W 5QZ, United Kingdom.

E-mail: contact@forbury.com

Australia

Forbury Property Valuation Solutions (AUS) Pty Limited

Address: Level 12, 1 Market Street, Sydney NSW 2000, Australia.

E-mail: contact@forbury.com

New Zealand

Altus Group New Zealand Limited

Address: 107/150 Lichfield St, Christchurch, Canterbury 8011, NZ

E-mail: contact@forbury.com