Privacy & Data Protection Notice

1. Introduction

Charles J Harrison Inventory Specialists (“CJH”, “we”, “us” or “our”) respects the privacy of our clients, landlords, letting agents, tenants, occupiers, subcontractors, contractors and website users.

This notice explains what personal data we collect, why we use it, who we may share it with, how long we retain it and the rights available to individuals.

We process personal data in accordance with applicable UK data-protection and privacy legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations where relevant, as amended from time to time.

2. Contact details

Business name

Charles J Harrison Inventory Specialists

Website

www.charlesjharrison.co.uk

Email

info@charlesjharrison.co.uk

Telephone

01223 979 001

Head office

Privacy and data-protection enquiries should be sent to:

info@charlesjharrison.co.uk

3. Our data-protection role

Our role under data-protection law depends on the particular processing activity.

We generally act as a data controller where we determine why and how personal data is processed. This includes data relating to:

• website enquiries;
• direct customer instructions;
• business administration;
• accounting and compliance;
• subcontractor and contractor management;
• website security;
• our own legal and regulatory obligations.

Where we process personal data solely on the documented instructions of a letting agent, landlord or other client, we may act as a data processor for that specific activity.

Where we use information for our own separate legal obligations, dispute management, security or business-record purposes, we may act as a controller for that separate processing.

4. Personal data we collect

We collect only personal data that is reasonably necessary and proportionate for our services and business operations.

Identity and contact information may include:

• full name;
• email address;
• telephone number;
• property address;
• business contact details;
• communication records.

Tenancy, appointment and property information may include:

• tenancy start and end dates;
• tenant or occupier names;
• appointment details;
• access arrangements;
• key collection and return information;
• meter readings;
• property condition observations;
• details relating to fixtures, fittings, appliances and contents.

Photographic and digital evidence may include:

• property condition photographs;
• images of fixtures, fittings, appliances and contents;
• supporting evidence supplied during a tenant-review process;
• images that may incidentally include personal possessions.

We do not intentionally collect special-category personal data such as health information, ethnicity, religious beliefs, political opinions, sexual orientation or biometric data.

Where such information is incidentally visible or supplied, we take reasonable steps to minimise, restrict and protect it.

5. Subcontractor and contractor data

Where a person applies to work with us as a subcontractor or contractor, we may collect:

• full legal name;
• contact details;
• Unique Taxpayer Reference;
• proof of identity, such as a passport or driving licence;
• public-liability insurance certificates;
• signed subcontractor agreements;
• digital-signature records;
• compliance records;
• insurance-renewal records.

We use this information for:

• identity verification;
• confirmation of contractual or self-employed status;
• insurance and professional-compliance checks;
• contract administration;
• legal and accounting record keeping;
• protection of our business and client interests.

The lawful basis will ordinarily be contract, steps taken before entering a contract, legal obligation and legitimate interests, depending on the specific processing activity.

Subcontractor compliance records may be retained throughout the working relationship and for up to seven years afterwards where required for legal, audit, tax, insurance or dispute purposes.

Access is restricted to authorised personnel and approved service providers where necessary.

6. How we obtain personal data

We may obtain personal data:

• directly from the individual;
• from landlords or letting agents instructing us;
• from tenants or occupiers during an appointment or review process;
• through website enquiry or booking forms;
• through email and telephone correspondence;
• through secure reporting and verification platforms;
• from subcontractors and contractors;
• from documents or evidence supplied in connection with our services.

Where a client provides another person’s information, the client should ensure that it has an appropriate basis for doing so and that any required privacy information has been provided.

7. Purposes and lawful bases

We may process personal data for the following purposes.

Enquiries, quotations and booking requests:

• to respond to enquiries;
• provide information;
• prepare a quotation;
• take steps before entering a contract.

Applicable lawful bases may include contract, steps before contract and legitimate interests.

Property inventory and inspection services:

• to arrange appointments;
• manage access and keys;
• attend properties;
• prepare inventory, check-in, check-out and mid-term reports;
• document condition;
• record meters and detectors;
• create photographic evidence;
• deliver reports.

Applicable lawful bases may include contract, legitimate interests and, where relevant, legal obligation.

Communications:

• to communicate with clients, landlords, letting agents, tenants, occupiers and contractors;
• provide service updates;
• respond to questions;
• manage report-review processes.

Applicable lawful bases may include contract and legitimate interests.

Claims and disputes:

• to preserve evidence;
• support adjudication or legal proceedings;
• establish, exercise or defend legal claims;
• respond to complaints.

The applicable lawful basis is generally legitimate interests and, where relevant, processing connected with legal claims.

Business, accounting and compliance:

• to issue invoices;
• maintain accounting records;
• manage taxation;
• administer contracts;
• satisfy legal and regulatory obligations.

Applicable lawful bases may include contract and legal obligation.

Website security and operation:

• to protect the website and connected services;
• prevent abuse;
• diagnose faults;
• maintain security logs;
• ensure reliable operation.

The applicable lawful basis is generally legitimate interests and, where relevant, legal obligation.

Analytics and non-essential website technologies:

Where consent is legally required, analytics or other non-essential technologies will not be activated until the user has made an appropriate choice.

8. Whether information must be provided

Some information is necessary for us to:

• respond to an enquiry;
• prepare a quotation;
• arrange an appointment;
• identify the correct property;
• complete a report;
• manage access safely;
• comply with legal or accounting obligations;
• assess contractor compliance.

Where required information is not supplied, we may be unable to provide the requested service or complete the relevant process.

9. How we use personal data

We may use personal data to:

• prepare professional property reports;
• document property condition;
• record meter readings and key handovers;
• arrange appointments and access;
• communicate with relevant parties;
• deliver reports securely;
• administer tenant-review processes where included;
• investigate concerns;
• support dispute-resolution processes;
• maintain accounting, compliance and audit records;
• protect our services, systems and legal interests.

We do not sell, rent or trade personal data.

10. Data sharing

Where necessary and proportionate, personal data may be shared with:

• the letting agent or landlord responsible for the instruction;
• the tenant or occupier where relevant;
• tenancy-deposit protection schemes;
• dispute adjudicators;
• legal representatives;
• approved IT, storage and cloud-service providers;
• professional advisers;
• regulators, courts or public authorities where required by law.

Information is shared only where there is an appropriate purpose and lawful basis.

Service providers acting on our behalf are required to protect personal data and use it only for authorised purposes.

11. International transfers

Some approved technology or cloud providers may process personal data outside the United Kingdom.

Where a restricted international transfer takes place, we use an appropriate legal transfer mechanism and assess the protection available to the data.

Depending on the circumstances, safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to European Commission Standard Contractual Clauses;
• another legally permitted transfer mechanism;
• a transfer-risk assessment and additional protections where required.

12. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, accounting, contractual, insurance and dispute-related requirements.

Inventory reports, inspection reports and associated evidence may generally be retained for up to seven years where this is justified by legal limitation periods, potential claims, contractual requirements or audit needs.

Subcontractor and contractor compliance records may be retained during the working relationship and for up to seven years afterwards.

Accounting and tax records are retained for the applicable statutory period.

Website security logs, enquiries and other operational records are retained according to their purpose, sensitivity and the configured retention schedule.

Data is securely deleted, destroyed or anonymised when it is no longer required.

13. Data security

We use appropriate technical and organisational measures designed to protect personal data from accidental or unlawful loss, destruction, alteration, disclosure or access.

Measures may include:

• encrypted transmission and storage where supported;
• password protection;
• role-based access controls;
• multi-factor authentication;
• secure cloud infrastructure;
• backups and recovery controls;
• security monitoring;
• access logging;
• restrictions on authorised personnel.

No internet or storage system can be guaranteed to be completely secure, but we review and improve our controls as appropriate.

14. Individual rights

Depending on the circumstances, individuals may have the right to:

• be informed about the use of their personal data;
• request access to their personal data;
• request correction of inaccurate or incomplete data;
• request erasure in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent where processing is based on consent;
• complain about the handling of their personal data;
• receive information about applicable automated decision-making.

Rights are subject to legal conditions and exemptions.

Requests may be sent to:

info@charlesjharrison.co.uk

We ordinarily respond without undue delay and within one calendar month. The response period may be extended where permitted by law.

We may request reasonable information to verify identity before disclosing or changing personal data.

15. Automated decision-making and AI

We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals.

Technology may assist with administrative, drafting, transcription, extraction or quality-control activities.

Where an AI-assisted service is introduced, it must operate under defined business rules, access controls and human oversight.

AI must not independently determine:

• negotiated pricing;
• legal rights;
• service eligibility;
• appointment availability;
• payment outcomes;
• booking confirmation;
• dispute outcomes.

This notice must be reviewed before any new AI processing involving personal data is enabled.

16. Website data, cookies and similar technologies

The website may process limited technical information such as:

• IP address;
• browser and device type;
• pages requested;
• date and time of access;
• security and diagnostic information.

Strictly necessary technologies may be used for:

• website security;
• authentication;
• load balancing;
• fraud prevention;
• essential functionality;
• remembering privacy choices.

Where analytics, tracking or other non-essential technologies require consent, they must remain disabled until the user has provided a valid choice.

Users must be able to reject non-essential technologies as easily as accepting them and must be able to change their choice later.

17. Personal data breaches

Where a personal data breach is suspected, we will:

• investigate and contain the incident;
• assess the potential impact on individuals;
• take steps to reduce further risk;
• maintain an internal record of the incident;
• notify the relevant client or controller where we are acting as processor;
• notify the Information Commissioner’s Office where the legal reporting threshold is met;
• notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Where a breach is reportable to the Information Commissioner’s Office, the notification will be made without undue delay and, where feasible, within 72 hours of becoming aware of it.

18. Complaints

Questions or concerns about the use of personal data should first be sent to:

info@charlesjharrison.co.uk

We will review and respond to data-protection complaints appropriately.

Individuals also have the right to complain to the Information Commissioner’s Office.

Make a complaint to the Information Commissioner’s Office

19. Changes to this notice

We may update this notice where our services, systems, legal obligations or processing activities change.

The current version will remain available on our website.

Where a change materially affects how personal data is used, we will take appropriate steps to bring the change to the attention of affected individuals.

20. Contact us

Privacy and data-protection enquiries

Charles J Harrison Inventory Specialists

Email

info@charlesjharrison.co.uk

Telephone

01223 979 001