Privacy & Cookies Policy

Topics

This Privacy Policy is divided into the following sections:

• Introduction
• About Us
• Contacting Us
• Data protection principles
• Personal information we collect
• What we do with your personal information
• Disclosure of your personal information to third parties
• International transfers
• Security of your personal information
• How long we keep your personal information
• Access to and updating your personal information
• Right to object
• Your other rights
• Exercising your rights
• Cookies and other tracking technologies
• Links
• Complaints
• Changes to our Privacy Policy

Introduction

At Kamma, we are committed to respecting your privacy. This Privacy Policy explains how we collect, use and disclose personal information that we receive when you visit this website, use our services, or communicate with us, both on this website and offline as a customer. If you are a landlord or tenant of a property, we may also receive your information from one of our customers. This Privacy Policy explains how we use your information.

It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your data.

About Us

This Privacy Policy is issued on behalf of Kamma Limited (“Kamma”, “we”, “us” or “our”).  We are registered in England and Wales under company registration number 09546202, and our registered office is at Thanet House – Lentaspace, Kamma Limited, Strand, London, England, WCR2 1DA. We are registered as a data controller with the UK Information Commissioner’s Office and our data protection registration number is ZA119280.

The Kamma platform provides information and services to private rented sector landlords and agents to enable automatic compliance monitoring of their property portfolios across the UK.   When Kamma processes your personal information it is responsible as ‘controller’ of that personal information for the purposes of data protection laws including the EU General Data Protection Regulation 2016/679 (“GDPR”).

Contacting Us

If you have any questions about our Privacy Policy or your information, or to exercise any of your rights as described in this Privacy Policy or under data protection laws, you can contact us at support@kammadata.com.

Data Protection Principles

Kamma adheres to the following principles when processing your personal information as data controller:

1. Lawfulness, fairness and transparency: data must be processed lawfully, fairly and in a transparent manner.
2. Purpose limitation: data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
3. Data minimisation: data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4. Accuracy: data must be accurate and, where necessary, kept up to date.
5. Storage limitation: data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal information are processed.
6. Integrity and confidentiality: data must be processed in a manner that ensures appropriate security of the personal information, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage by using appropriate technical or organisational measures.

Personal Information we Collect

Information you give us as a customer (“Customer Information”)

You may provide us with information through the website, the Kamma platform, by email, over the phone or otherwise communicate or be in contact with us, when:

• you request information about our business or ask us to contact you;
• we provide our services to you and/or enter into transactions with you;
• you register to use, and complete your profile on, our Kamma platform;
• you make any comment or contribution on our website; and
• you send any other information about you to us.

The categories of personal information you provide may include:

• first and last name;
• profile pictures;
• job title and company name;
• address;
• phone number;
• email address;
• financial information and history; and
• where you are an NRLA landlord (further details regarding the NRLA are set out below in “Disclosure of your personal information to third parties”) your own portfolio of properties

Information we receive from our customers (“Property Personal Information”)

Our customers upload property information onto the Kamma platform. Some of that information may consist of personal information of the landlord and tenant relating to a particular property. As such, the following Property Personal Information may be uploaded onto the Kamma platform:

• first and last name;
• email address;
• age;
• gender;
• address;
• people you are living with;
• marital status; and
• additional details about your property.

As part of an additional service to customers, we may also collect criminal conviction data as part of a due diligence check on a landlord. We would be carrying out this activity as data processor on behalf of the customer, the data controller.

Our customers are required to ensure that they provide clear and sufficient information to you, in accordance with the GDPR, of the purposes for which they will process your personal data, the legal basis for such purposes and such other information as is required by the GDPR including information explaining the disclosure of your personal data to Kamma and the uses which Kamma may make of your personal data (please see “What We Do With Your Personal Data” for further information on this).

Sensitive personal data

We do not seek to collect sensitive personal information through our website or as part of our business transactions and our customers are required not to upload such information onto the Kamma platform. Sensitive personal information is information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; health; sex life, sexual orientation; or genetic or biometric information.

Technical information we collect from you (“Technical Information”)

Kamma collects, stores and uses information about your visits to the website and platform, and about your computer, tablet, mobile or other device through which you access the website. This includes the following information:

• technical information, including the Internet protocol (IP) address, browser type, internet service provider, device identifier, your login information,  time zone setting, browser plug-in types and versions, operating system and platform, and geographical location;
• information about your visits and use of the website, including the full Uniform Resource Locators (URL), clickstream to, through and from our website, pages you viewed and searched for, page response times, length of visits to certain pages, referral source/exit pages, page interaction information (such as scrolling, clicks and mouse-overs), and website navigation and search terms used.

Aggregated Data

We may also collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data as this data will not directly or indirectly reveal your identity.

Children

This website and the Kamma platform is not intended for or directed at children under the age of 16 years and we do not knowingly collect information relating to children under this age.

What we do with your Personal Information

As a data controller, Kamma will only use your personal information if we have a legal basis for doing so. The purpose for which we use and process your information and the legal basis on which we carry out each type of processing is explained in the table below.

Generally, we do not rely on consent as a legal basis for processing your personal data although we may need your consent before sending direct marketing communications to you via email or text message where you are not an existing customer.  Where you provide consent, you can withdraw your consent at any time and free of charge, but without affecting the lawfulness of processing based on consent before its withdrawal. You can update your details or change your privacy preferences by contacting us as provided in Contacting us above.

Disclosure of your Personal Information to Third Parties

Kamma will not sell, rent, lease or otherwise share your personal information other than as outlined in this Privacy Policy or without obtaining your consent beforehand.

We will share your personal information with any member of our group of companies (this means our subsidiaries, our ultimate holding company and all its subsidiaries) insofar as reasonably necessary for the purposes set out in this policy.

We may also publish, disclose and use Aggregated Data and non-personal information for statistical analysis within the property sector, demographic profiling, marketing and advertising, and other business purposes.

Personal information will also be shared with our third party service providers and business partners who assist with the running of the platform and website and the operation of our business including third party hosting providers. Our third party service providers and business partners are subject to security and confidentiality obligations and are only permitted to process your personal information for specified purposes and in accordance with our instructions.

In addition, Kamma may disclose information about you:

• to our professional advisers including lawyers, auditors and insurers;
• in the event that we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets;
• if all or substantially all of Kamma Limited’s (or one of its group company’s) assets are acquired by a third party, in which case personal information held by it about you will be one of the transferred assets;
• if we are under a duty to disclose or share your personal information in order to comply with any legal or regulatory obligation. We will use commercially reasonable efforts to notify you where this is the case, to the extent permitted by law;
• if necessary to protect the vital interests of a person; and
• to enforce or apply our contracts or to establish, exercise or defend the rights of Kamma, its staff or other related persons.

National Landlords Association

Where you are a customer, personal information may be shared with the National Residential Landlords Association Limited (“NRLA”). This is part of the NRLA Licensing 365 project which is a joint partnership between the NRLA and Kamma. The NRLA’s services are promoted on the Kamma website to users who can voluntarily sign up to the NRLA from within Kamma’s services. In addition, members of the NRLA are invited to sign up to Kamma’s services on the NRLA website. Members of the NRLA can add up to 16 properties to Kamma’s platform. Where a genuine mistake has been made in adding a property, you may request it be removed via support@kammadata.com. Kamma reserve sole and absolute discretion over the removal of properties. Where a user requests, on the Kamma website, to sign up to the NRLA, Kamma will pass data about the user (including personal information) to the NRLA. Where a user requests, on the NRLA website, to sign up receive Kamma’s services, data about the user (including personal information) will be passed from the NRLA to Kamma. In the latter scenario, Kamma will periodically check with the NRLA whether the user’s NRLA membership is still valid.

International Transfers

Where we collect personal data from you, it may be necessary for us to transfer your personal information outside of the European Economic Area (“EEA”) to our service providers and business partners located outside the EEA.

Where personal information is transferred to and stored in a country not determined by the European Commission as providing adequate levels of protection for personal, we take steps to provide appropriate safeguards to protect your personal information, including entering into standard contractual clauses approved by the European Commission, obliging recipients to protect your personal information. If you would like further information on the specific mechanism used by us when transferring your personal information outside of the EEA, please contact us using the details set out above.

Security of your Personal Information

We use appropriate technical and organisational security measures to protect personal information both online and offline from unauthorised use, loss, alteration or destruction. We use physical and procedural security measures to protect information from the point of collection to the point of destruction.

Where data processing is carried out on our behalf by a third party, we take steps to ensure that appropriate security measures are in place to prevent unauthorised disclosure of personal information.

Despite these precautions, however, Kamma cannot guarantee the security of information transmitted over the Internet or that unauthorised persons will not obtain access to personal information. In the event of a data breach, Kamma have put in place procedures to deal with any suspected breach and will notify you and any applicable regulator of a breach where required to do so.

If you have any questions about security on our website or within our business operations, you can contact us as provided in Contacting Us above.

You are responsible for keeping your password for accessing our website confidential; we will not ask you for your password except when you log in to our website.

How long we keep your Personal Information

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Access to and updating your Personal Information

You have the right to access information which we hold about you (“data subject access request”).

You may also have the right to receive personal information which you have provided to us in a structured and commonly used format so that it can be transferred to another data controller (“data portability”). The right to data portability only applies where your personal data is processed by us with your consent or for the performance of a contract and when processing is carried out by automated means.

Right to Object

Direct marketing

You have the right to object at any time to our processing of your personal information for direct marketing purposes.

Where we process your information based on our legitimate interests

You also have the right to object, on grounds relating to your particular situation, at any time to processing of your personal information which is based on our legitimate interests. Where you object on this ground, we shall no longer process your personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Your other Rights

You also have the following rights under data protection laws to request that we rectify your personal information which is inaccurate or incomplete.

In certain circumstances, you have the right to:

• request the erasure of your personal information: this enables you to ask us to delete or remove personal data where there is no good reason for us to continuing to process it (“right to be forgotten”);
• restrict the processing of your personal information.

Please note that the above rights are not absolute and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

For example, we may refuse a request for erasure of personal information where the processing is necessary to comply with a legal obligation or necessary for the establishment, exercise or defence of legal claims. We may refuse to comply with a request for restriction if the request is manifestly unfounded or excessive.

Exercising your Rights

You can exercise any of your rights as described in this Privacy Policy and under data protection laws by contacting us as provided in Contacting Us above.

Save as described in this Privacy Policy or provided under data protection laws, there is no charge for the exercise of your legal rights. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested; or (b) refuse to act on the request.

Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm your identity.

Cookies and other Tracking Technologies

In order to improve the website, we may use small files commonly known as “cookies”. A cookie is a small amount of data which often includes a unique identifier that is sent to your computer or mobile phone (your “device”) from the website and is stored on your device’s browser or hard drive.

By continuing to browse the website, you are agreeing to our use of cookies.

If you do not want us to use cookies when you use the website, you can set your internet browser not to accept cookies. However, if you block cookies some of the features on the website may not function as a result.

You can find more information about how to do manage cookies for all the commonly used internet browsers by visiting www.allaboutcookies.org. This website will also explain how you can delete cookies which are already stored on your device.

We ask for your consent to place cookies on your device, except where these are essential for us to provide you with a service that you have requested.

We currently set the following cookies:

Cookies from Third Parties

We currently use the following third party cookies:

We are obliged by Google Analytics to state the following:

The website uses Google Analytics, a web analytics service provided by Google Inc. (“Google“). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the website. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.  Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.  Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google.  You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of the website.  By using the website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Links

The website may, from time to time, contain links to and from the websites of our business partners, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and Kamma does not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

Complaints

If you have any questions or concerns regarding our Privacy Policy or practices, please contact us as provided in “Contacting Us” above.

You also have the right to complain to the Information Commissioner’s Office (https://ico.org.uk/).

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Changes to our Privacy Policy

Kamma reserves the right to change this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. If we make any material changes to this Privacy Policy, we will notify you by email or by means of a prominent notice on the website prior to the change becoming effective.