Portunus Associates Ltd (Portunus) is a bespoke healthcare real estate agency specialising in care homes and housing with care across the UK. We are regulated by the Royal Institution of Chartered Surveyors (RICS).

For the purpose of the UK General Data Protection Regulations (“UK GDPR”), the Data Controller is Portunus Associates Ltd of 47 Southgate Street, Winchester, SO23 9EH. 

You can contact the Data Protection Officer (DPO) about issues relating to your personal data, including the contents of this policy, at [email protected].

This Policy sets out the information we collect about:

• People who use or enquire about using our services
• Visitors to our website
• Complainants
• People whose services we use
• Third parties whose personal data we are required to process in the course of providing our services (for example, Counter Parties in property transactions)

Job applicants, potential job applicants and employees are covered separately and privacy details will be provided to them as part of HR processes.

We may collect the following personal data:

• Name and contact details, such as first and last name, job title, email address, company name and address, phone number and other similar contact data;
• Information relevant to your enquiries into or your instructions for our services, for example your property search requirements or financial details; 
• Information to enable us to meet our regulatory obligations. For example, to check and verify your identity we may ask for your passport details and your date of birth;
• Information about our dealings with you; such as what information and emails we have sent you, what meetings, events and calls you have participated in. 
• Information about the device you are using to access our websites; such as the type of device, its operating system, browser, its IP address, and what cookies are on it.
• Information about your use of our websites, such as what pages you have visited and what content you have downloaded.
• Special Categories of Personal Data. We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data, criminal convictions and offences) unless required by law to do so, for example to meet Anti-Money Laundering Regulations. 

We collect this personal data about you from your interactions with us and from certain third parties and other sources (such as from publicly available sources where permissible):

This section explains the purposes for which we use your personal data. 

Marketing communications: we may use your personal data to send you marketing communications through various channels (e.g. email, phone or post) to inform you about our latest deals, our current property/ business instructions offered to the market, our other services and updates about developments in our sector that might be of interest to you. If you are our client and you have not “opted out” from receiving such marketing communications, we have a legitimate interest in processing your personal data for marketing purposes. Where you are not our client and we are required to get your consent to receive marketing communications under PECR (Privacy and Electronic Communications Regulations), we will ask for this consent separately and clearly. 

You have the right to opt out of receiving marketing communications at any time by clicking on the “unsubscribe” link located on the bottom of our marketing emails, or by contacting us using the details in the Who We Are section above.

We will never sell or share your personal data with other organisations for marketing purposes, except where we have obtained your consent in advance.  

Anti-Money Laundering Regulations (Regulations): To comply with the requirements of these Regulations, we are required to carry out Customer Due Diligence (CDD) checks on our Clients and the Counter Party to a property transaction, including sight of identification documents. Some of the personal data collected for CDD purposes may be special category data, as defined in the UK GDPR. We will only collect and use this information if UK GDPR allows us to do so and will take extra care with this data. 

We reserve the right to employ third party electronic verification services, such as Smart Search for the purpose of verifying identity and other CDD checks. These searches will not affect your credit rating. Smart Search acts as Data Controller in respect of its services – find out more on its website. 

The information will only be used by us in relation to complying with the Regulations and will not be shared with any other party unless we are required to do so by law. 

Provision of services, including administration and management of our records

We use personal data for relationship management purposes, both to build an ongoing relationship with you and to deliver our services to you. For example: dealing with your enquiries, carrying out your instructions in respect of the sale and/ or acquisition of properties (and where applicable the business) and other services we may provide to you. We may contact you using transactional emails, phone calls and meetings. We keep records of our contact with you on our CRM system. We may use this data for audit purposes and to enable us to respond to your data requests. 

Monitoring and improving our website

We compile general statistics (without personal identification) about our website’s usage patterns (how long visitors spend on particular pages; how they navigate around the website) to help improve the user experience of our website; and to measure and understand the effectiveness of our advertising activities. 

To protect our rights

We may use your personal data in order to protect, enforce, or defend our legal rights, safety, or property; to protect against and prevent fraud and other unlawful activity; to comply with and enforce applicable laws and regulations; or to respond to requests from a judicial process or public agencies, to the extent permitted by applicable law.

We will only use your personal data for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with the original purpose(s) and we need to use your personal data for that purpose. 

Under UK GDPR, we must have a legal basis for using your personal data. 

We may rely on legitimate interests as our legal basis. A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. 

The purposes of our legitimate interests will usually fall into the following:

We use other grounds to process your personal data in certain circumstances, as set out below:

We will not retain your personal data for longer than is necessary for the purposes you provide it to us. Generally, we will retain your personal data for a minimum of seven years after our last contact or dealing with you, at the end of which period, it will be deleted from our systems, except as may be required for any legal or regulatory compliance purpose, or if we face legal proceedings.

We do not sell or share your personal data for marketing purposes. 

We may share your personal data with other parties in the following circumstances:

Where we share your personal data with any third party, we will take steps to ensure that your personal data is protected by appropriate safeguards, including confidentiality obligations and only permitting the provider to process any personal data as instructed by us and in accordance with UK GDPR. Safeguards when personal data is transferred outside the UK are set out in the next section. 

We have appropriate security measures to prevent personal data from being accidentally lost or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. 

We have procedures for dealing with data breaches including notifying you and/or the Information Commissioner’s Office where we are legally required to do so.

We may store or transfer some or all of your personal data outside of the UK, for example where our cloud-based data services are located in another country. If the country is outside the European Economic Area (EEA), then it may not have similar data protection laws to the UK. To ensure that your privacy rights continue to be protected as outlined in this Notice, we will ensure that either:

• There is a s17A Data Protection Act 2018 “adequacy decision” with respect to the data protection laws of the country to which it is transferred (visit European Commission website); or
• Where we transfer your data to a third party based in the US, we ensure that they are part of the EU-US Privacy Shield, which requires them to provide data protection standards similar to those in the EU/ UK (visit the European Commission website); or
• We have entered into a suitable data processing agreement with the third party situated in that country to ensure the adequate protection of your data (visit the European Commission website).

Under data protection legislation, you have several rights regarding the use of your personal data, as follows: 

For further information on each of these rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the UK GDPR.

You may exercise any of your rights in relation to your personal data by contacting us as set out in the section Who We Are above.

If you wish to raise a complaint about how we have handled your personal data, you can contact us and we will investigate the matter for you. 

If you are not satisfied with our response, you have the right to lodge a complaint at any time to the ICO, the UK regulator for data protection issues (www.ico.org.uk)

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

Email address: [email protected]

Telephone number: 01962 589348

Postal Address: Data Protection Officer, Portunus Associates Ltd, 47 Southgate Street, Winchester SO23 9EH.

This Privacy Policy was last updated on 30 December 2021.

We may change this Privacy Policy from time to time to reflect changes in the law or our privacy practices. 

We encourage you to periodically review this Policy to keep informed of how we are processing your information