Tulsa Burg Limited: Privacy Policy

 
This is the Privacy Policy statement for Tulsa Burg Limited (Tulsa Burg or TulsaBurg.com) is dedicated to protecting and respecting your privacy. This policy sets out the basis on which any personal data we collect from you or that you provide to us, directly or indirectly, will be processed by our team. Please read the following carefully in order to understand our views and practices regarding personal data. Tulsa Burg’s Data Protection Officer can be contacted at dpo@tulsaburg.com

The General Data Protection Regulation 2016/679

   In this Document we have used certain terms, which are set out in the General Data Protection Regulation          2016/679 (GDPR or the Regulation):
  • Personal Data means: any information relating to an identified/identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Controller means: the natural or legal person, a public authority, an agency or other bodies which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processor means: a natural or legal person, a public authority, an agency or other bodies which processes personal data on behalf of the controller
  • Processing means: any operation or set of operations which is performed on personal data or on any sets of personal data, whether or not by automated means, such as collections, recordings, organisations, structuring, storage, adaptation or alterations, retrievals, consultations, use, disclosure by transmission, dissemination or otherwise making available, alignment or combinations, restriction, erasure or destruction.
What We Do

Tulsa Burg is an online letting agent, offering services and tools to make renting easy, safer and cheaper for everyone.

Tulsa Burg assists property owners and landlords (together, Landlords (being either actual or prospective Landlords) in finding tenants and creating tenancies; and offers a range of other services relating to renting out and managing rental properties.

Tulsa Burg assists prospective and actual tenants (collectively, Tenants (which for the purposes of this privacy statement, shall be deemed to include any individual guarantors of any Tenant) in finding properties to rent or creating tenancies; and offers a range of other services relating to renting properties.

For the purposes of this Privacy Policy, Landlords and Tenants are referred to collectively, as Users.

Our Status Under GDPR

Depending on the nature of the interaction, We may act as a processor in that We are acting upon instructions from our Clients when We provide our services to them; when We control the purposes and means of the processing of personal data information, such as processing our employees personal data, We act as a controller, as defined under GDPR.

What Lawful Reasons Do We Use To Process Personal Data Information?

The lawful reasons Tulsa Burg uses to process personal data information are set out in (Article 6 of the Regulation) with respect to the business model undertaken by Tulsa Burg, our processing is lawful given the fact that at least one of the followings applies:

  • The data subject has given consent to the processing of his/her personal data for one or more specific purposes (Consent).
  • Processing is necessary for the purpose and performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract (Contract Performance).
  • Processing is necessary for the compliance with a legal obligation, which We are subject to (Legal Obligations).
  • Processing is necessary for the purposes of the legitimate interests pursued by Tulsa Burg, except where our interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the subject data indicates is a child (Legitimate Interest).
Consent

Where We process personal data as a result of data subject consents, We ensure that consent is freely given, specifically informed; and established by a clear affirmative act. Where a consent is withdrawn, we have set out (below) how this may be undertaken.

Contract Performance

Where we enter into a contract, processing of personal data information may, as a matter of course, be necessary in order to execute such a contract or take pre-contracts preparation steps.

Legal Obligations

Where we have legal obligations, which apply to Tulsa Burg, processing of personal data may be required by law.

Legitimate Interest

Where we process personal data information, as it is necessary for the purpose of our legitimate interests, we do so on the basis of a balanced evaluation of our interests and the rights and freedom of the data subject, which require our protection.

Presently, We have concluded that the way we manage the processing of personal data information results in an accumulation of data subject protections, which show that the balance is in favour of Tulsa Burg being able to rely on (Article 6.1(f) of the Regulation) as a lawful reason to process personal data.

Sensitive Personal Data

Where Tulsa Burg processes sensitive personal data on behalf of a User, Tulsa Burg does so on the basis that the User has established a lawful exception to the prohibition on processing sensitive personal data under (Article 9 of the Regulation) and where Tulsa Burg is processing sensitive personal data of employees, it does so pursuant to its employment relationship with its employees and so uses the exception set out in paragraph 2(b) of (Article 9 of the Regulation.)

Tulsa Burg’s Use Of Personal Data: Overview

How Tulsa Burg collects and uses personal data differs based on the nature of the interaction with the individual whose personal data we are processing. For example, personal data provided by a prospective Tenant when registering on the Tulsa Burg website may be used for several purposes and in a different capacity by us, depending on the nature of the services we provide to our customer’s. Where Tulsa Burg’s engagement of an employee requires the processing of the employee’s personal data information, we have also set out how this will be conducted. As a result, we have explained in details how personal data may be processed when used within our business, and in the context of the services, we offer during our commercial life cycle, (i.e.) In the context of the service we provide Landlords and Tenants, respectively. In addition, we have referred to other services, which require the processing of personal data and how we process the personal data of third parties. Our objective is to inform our users by being transparent while at the same time being consistent with the requirements of the Regulation.

Landlords

How personal data is collected: Landlords interested in learning more about Tulsa Burg’s services can enter their details into our website at https://www.tulsaburg.com or any landing pages hosted at https://www.tulsaburg.com or via enquiry forms, or Landlords may email or call us directly using contact details provided on our website or elsewhere. This will likely be for the purposes of entering into a relationship with Tulsa Burg through acceptance of our terms and conditions, requesting that We contact them, reading or downloading the information, or requesting support from our support team. occasionally, We may also meet business-relevant connections at events or research individuals using social media platforms. Whereas these individuals are approached (or approach us) in their capacity as employees of their organisation, the interaction will be regarded as a business-to-business exchange.

Type of personal data collected:

Landlord personal data information might include such as name, telephone number, home address, email address, company of work and IP address from the device being used, online identifier, property and property-related information and location data information. We will not knowingly collect sensitive personal data. Where a Landlord might visit our website, We may collect and process information about their website usage (e.g. browsing history and information about their visit to our website or navigation through) using cookies and other similar technologies. During communications, We may process data information about the interactions undertaken with us.

Who controls the personal data: Where (by agreeing to Tulsa Burg’s terms and conditions) a Landlord enters into an agreement with Tulsa Burg and Tulsa Burg provides services to the Landlord, the Landlord controls the purposes of the processing of personal data information under the agreement and is a controller.

Who processes the personal data: Where Tulsa Burg is acting upon the instructions of the Landlord’s pursuant to the terms of their agreement, Tulsa Burg is a processor. In addition, Landlord personal data is processed by Tulsa Burg and our website, email, CRM, marketing platform providers and third-party contractors, who process personal data on our behalf. This is undertaken in a manner that is consistent with the Regulation and the Privacy Directive.

Where personal data is stored; how personal data is used: how personal data information is used: Landlord personal data is stored in our databases and is primarily used to allow us to deliver our services. It may also be used to send out news and information about our services, to implement and improve our services, including format and content, to administer our website and for internal operations, including troubleshoot, data analysis, testing, research, statistical and survey purposes, as part of our efforts to keep our website safe and secure, to measure up or understand the effectiveness of any advertising We serve to you and others, and to deliver relevant updates and information.

How long personal data is stored: Landlord personal data is stored by Tulsa Burg for the duration of the Landlord’s contract with the Tenant and thereafter in line with prescribed limitation periods under English law. Where the Landlord withdraws consent to receive marketing material from Tulsa Burg, or, retention of personal data is no longer necessary pursuant to the principles set out in (Article 5 of the Regulation), personal data information will either be completely deleted or archived. Where personal data is archived, it is kept to ensure that Tulsa Burg does not lose its records with respect to marketing consent, or the fact of its withdrawal.

Tenants

How personal data is collected: Tenants interested in learning more about Tulsa Burg’s services can enter their details into our website at https://www.tulsaburg.com or any landing pages hosted at https://www.tulsaburg.com or via an enquiry form, or Tenants may email or call us directly using contact details provided on our website or elsewhere. Tenants provide personal data to Tulsa Burg for the purposes of accessing Tulsa Burg’s services. Personal data is collected when the Tenant populates their details online via the Tulsa Burg website or an affiliate website run by partners such as Rightmove and Zoopla. During the course of the provision of Tulsa Burg’s services to the Tenant, the Tenant may disclose additional personal data, which may involve more than one media.

Type of personal data collected: Data collected via the Tulsa Burg website from Tenants may include name, telephone number, home address and past addresses, employment status and employment history, email address, online identifiers and IP address from the device being used and location data. On occasion, We may collect sensitive personal data. Whereas a Tenant visits our website, We may collect and process data information about their website usage (e.g. browsing history and information about their visit to our website or navigation through) using cookies and other similar technologies. During communications, we may process information about the interactions with us.

Who controls the personal data: When (by agreeing to Tulsa Burg’s terms and conditions) a Tenant discloses personal data to Tulsa Burg with a view to using Tulsa Burg’s services to assist the Tenant in finding properties to rent, the resulting disclosure of personal data to Landlords is controlled by Tulsa Burg. When the data of information has been disclosed to the Landlord for the purposes of further communication regarding renting the property, the Landlord will then be the controller of the data information. Where the Tenant instructs Tulsa Burg to assist the Tenant with creating a tenancy for a particular property (for example, by placing a holding deposit through Tulsa Burg’s website), the processing of personal data in this context is controlled by the Tenant only.

Who processes the personal data: Where the Tenant, through Tulsa Burg, commences discussions with the Landlord with a view to agreeing on a contract with the Landlord; and Tenant personal data has been disclosed to the Landlord by Tulsa Burg, Tenant personal data is sent to the Landlord through Tulsa Burg under agreed terms with the Landlord. Under these terms, Tulsa Burg is the processor. Tenant personal data may also be processed by Tulsa Burg through our website, email, CRM, marketing platform providers and third-party contractors, who process personal data on our behalf. This is undertaken in a manner that is consistent with the Regulation and the Privacy Directive.

Where personal data is stored; how personal data is used: how personal data is used: Tenant personal data is provided for the purposes of obtaining Tulsa Burg’s services and is stored in our databases and is mainly primarily used to allow us to deliver our services. It may also be used to send newsletters and information about our services, to implement and improve our services, including format and content, to administer our website and for internal operations, including troubleshoot, data analysis, testing, research, statistical and survey purposes, as part of our efforts to keep our website safe and secure, to measure up or understand the effectiveness or relevant of any advertising We serve to you and others, and to deliver relevant information.

How long personal data is stored: Tenant personal data is stored by Tulsa Burg for the duration of the Tenant’s contract with the Landlord and thereafter in line with prescribed limitation periods under English law. Where the Tenant withdraws consent to receive marketing material from Tulsa Burg, or, retention of personal data is no longer necessary pursuant to the principles set out in (Article 5 of the Regulation), personal data information will either be deleted or archived. Where personal data is archived, it is kept in order to ensure that Tulsa Burg does not lose its records with respect to marketing consent, or the fact of its withdrawal.

Payment Data

How personal data is collected: Users provide payment details to Tulsa Burg in the service onboarding process, in order to purchase Tulsa Burg services to set up automatic payments and to allow us to make payments to them (for example, rent and deposits).

Type of personal data collected: Payment data includes such as name, address, bank account sort code, bank account number, payment card long number, payment card issue date, payment card expiry date and three-digit security number.

Who controls the personal data: Payment data is controlled by Users and processed by Tulsa Burg under User instruction, subject to terms and conditions with Users.

Who processes the personal data: User payment data is processed by Tulsa Burg and our third-party payment gateways.

How personal data is used: User payment data is used to charge for the use of our services, or to send rent collected by Tulsa Burg on behalf of the Landlord. Tenant payment data may be used to debit the Tenant’s account for payments required when the Tenant uses Tulsa Burg services; it may also be used where the Tenant has overpaid the rent (for example) and a record is required to ensure suitable reimbursement.

Employees

How personal data is collected: Tulsa Burg employees provide Tulsa Burg with their personal data through email, digital or paper-exchange, in order for the employee and Tulsa Burg to undertake a normal employer-employee relationship.

Type of personal data collected: Personal data might include such as name, mobile number, email address, home address, photo, postcode and notes about their role and skills. We collect sensitive personal data Information with respect to health, as necessary and in a proportionate manner.

Who controls the personal data: Personal data  information of Tulsa Burg employees is controlled by Tulsa Burg.

Who processes the personal data: Tulsa Burg processes employee personal data information which is also processed within third-party platform used to help us provide standard employment requirements such as payment of the employee through a third-party payroll or dissemination of payment data to HMRC, as is required by law.

How personal data is used by the controller: All Tulsa Burg employee data is used in accordance with the Regulation in order to ensure that the relationship between the employee and Tulsa Burg is undertaken in a manner that is consistent with the legal expectations of the parties in addition to third parties (such as HMRC, as referred to above)

How long personal data is stored: Tulsa Burg employee personal data is stored within Tulsa Burg for the duration of the employee’s contract with Tulsa Burg and thereafter in accordance with Tulsa Burg’s data retention policy which shall take into account limitation periods under the general law.

Job Candidates

How personal data is collected: Candidates interested in applying for a role at Tulsa Burg may provide their personal information by email or through our job application platform to express their interest in a role.

Type of personal data collected: Personal data information inputs by job candidates may include such as name, email, phone number, home address, place of work, education and work history alongside their skills. We will not collect sensitive personal data.

Who controls the personal data: Job candidate data information is controlled by Tulsa Burg.

Who processes personal the data: Job candidate data information is processed by our software providers and consultants involved in helping us to recruit candidates and manage employees.

How personal data is used by the controller: Job candidate data is used by Tulsa Burg to manage and communicate with candidates in relation to the role they have applied for at Tulsa Burg.

How personal data is used by the processor: Job candidate data information is used by our processors to enable us to accept and manage applications and to support decision-making processes.

How long personal data is stored: Job candidate data information is stored for as long as necessary. It is then archived or completely deleted pursuant to our data retention framework.

Third Party Contractors

How personal data is collected: Tulsa Burg engages third parties to deliver some services, for example to carry out gas safety inspections. Tulsa Burg uses a number of businesses in various geographies and collects the personal data of data subjects connected to the third-party businesses concerned.

Type of personal data collected: Personal data input by data subjects connected to third parties may include: name, email, phone number, home address, place of work, skill-set and work history alongside their skills. We will not collect sensitive personal data.

Who controls the personal data: Third party personal data is controlled by Tulsa Burg.

Who processes the personal data information: Third party personal data information is processed by our suppliers where such third parties require instructions by email (for example); and where third parties are paid.

How personal data is used by the controller: Third party personal data is managed by Tulsa Burg where it is required to assist in the provision of services.

How personal data is used by the processor: Third party personal data informatio is used by our processors to ensure that third party contractors have the information they need to provide Tulsa Burg with services; and be paid for doing so.

How long personal data is stored: Third party personal data information is stored for as long as necessary. It is then archived or deleted pursuant to our data information retention framework.

Sharing Information

We may share data information with third parties so that they can assist us in providing our services; selected third parties could include:

  • Other Tulsa Burg Users, for example, supplying your details to a User advertising a property if you request to view that property.
  • Suppliers and sub-contractors for the performance of a contract, or (by way of example) supplying your information details to a gas engineer to allow them to contact you and arrange a date and time to visit the property at which the service has been ordered for.
  • Analytics and search engine providers are used to assist us in the improvement and optimisation of our website.
    We may also disclose your personal data information to third parties:

We may also disclose your personal data information to third parties:

  • If Tulsa Burg or substantially all of its assets are acquired by a third party, in which case personal data information held by Tulsa Burg (in part or in whole) may be one of the transferred assets.
  • If We are under a duty to disclose or share personal data information to comply with any legal obligation, or in order to enforce or apply our terms and other agreements; or to protect the rights, property, or safety of Tulsa Burg or others. This includes exchanging data information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
Transferring Out Of The EEA

Storing personal data: We use cloud providers to store our personal data. Occasionally, personal data information may be transferred to and stored at a destination outside the European Economic Area (EEA).

Processing personal data: We may use third parties to help us deliver our services and they may or may not be based outside the EEA. Where data information is transferred outside the EEA, We adhere to compliance mechanisms that are identified by the European Commission, for example, the use of EU model contract clauses or conformity to US Privacy Shield. Where We use sub-processors acting on our behalf, We ensure that they adhere to compliance mechanisms that are identified by the European Commission.

Where We are the processor: We may transfer personal data to non-EEA (and non-adequate) jurisdictions where We are a processor, pursuant to the instructions of a third-party controller, such as a Landlord. Where We do so, it is entirely third party’s responsibility to ensure that such transfer is consistent with GDPR.

Data Retention Periods

Tulsa Burg has a data retention policy which sets out how long it will store personal data, which is consistent with Article 5 of the Regulation. Tulsa Burg only keeps personal data for as long as is necessary. For example, Tulsa Burg is required to retain certain information in accordance with the general law, where information is needed for income tax and audit purposes. How long certain kinds of personal data information should be kept may also be governed by specific business-sector requirements and agreed practices. Personal data information may be held beyond these periods depending on Tulsa Burg’s business needs, which are balanced against the requirements of the Regulation and the rights of the individual.

Where We are the controller: We will retain personal data information for as long as necessary. As described above, in some cases, We will have a legal or statutory obligation to retain data information for a set period, such as the limitation period.

Where We are the processor: Personal data information is stored as instructed by Landlords in accordance with their approach to retention of personal data information provided that this is within the Regulation. We recommend that you view (where applicable) their Terms of Use and Privacy Policy for more information.

Security Measures

We have set placed and implemented security measures that are designed to help protect the personal data information We collect or receive in connection with our services, from unauthorised access or disclosure. For example, We use encryption techniques to ensure the security of data information; We also use password protection. However, no transmission or storage of data information can be guaranteed to be completely secure and We cannot ensure or warrant the security of any information which We collect and store.

Cookies

We use cookies to differentiate you from other users of our website. This helps us to present you with a good service experience when you browse our website and allows us to improve our website. By continuing to browse our website, you are accepting to our use of cookies. A cookie is a very small file of letters and numbers that We store on your browser or the hard-drive of your computer if you agree. Cookies contain data information that is transferred to your computer’s hard-drive. We use the following cookies:

Strictly necessary cookies: These are cookies that are normally required for the operation of our website. For example, They include cookies that enable you to log into secure areas of our website.

Analytical/performance cookies: These allow us to acknowledge and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to enhance the way our website works, for example, by ensuring that users are finding what they are looking for much easier.

The Functionality of cookies: These are used to recognize you when you return to our website. This enables us to customize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Targeting cookies: These cookies record your visit each time you come to our website, the pages you have visited and the links you have followed. We will use this type of information data to make our website more relevant to your interests.

First Party Cookies

How do I block first party cookies?

You block first-party cookies by simply activating the settings on your browser that allow you to refuse the setting of all or some cookies. Nevertheless, If you use your browser settings to block all the cookies (including the essential cookies) you may not be able to access all or parts of our website.

Third Party Cookies

We may use third-party services such as Google Analytics cookies to track unidentified usage statistics but We do not collect any personal information data that can be used to identify you. This data information helps us analyse web page usage and improve our website to tailor it to our audience needs. Services such as Google Analytics store data information about what pages you visit, how long you are on the website, how you got there and what pages you clicked on. These are cookies served by a third-party service provider and are normally used to identify your computer when it visits another website, for instance, when you log in to a social media site to share an article.

How do I block third party cookies?

You block third-party cookies simply by activating the setting on your browser that allows you to refuse the setting of all or some cookies. Nevertheless, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

Further Information

For more information about cookie simply visit: http://www.allaboutcookies.org

Internet Advertisement Bureau: Guide to online advertising and privacy

International Chambers of Commerce (United Kingdom): ICC UK cookie guide

Your Right To Complain

If you have an objection about the way We process your personal data information, you can register your concern by contacting the Information Commissioner of the United Kingdom (the Information Commissioner) and following the instructions set out at www.ico.org.uk. Where you wish to contact Tulsa Burg about your concerns, please contact dpo@tulsaburg.comInformation Commissioner) and following the instructions set out at www.ico.org.uk. Where you wish to contact Tulsa Burg about your concerns, please contact dpo@tulsaburg.com

Contacting You

The personal data information We process is subject to rigorous measures and procedures to reduce the risk of unauthorized access or disclosure. We will get in touch with the supervisory authority (which in Tulsa Burg’s case, is the Information Commissioner) and with affected data subjects where this is required under the Regulation.

Changes To Our Privacy Policy Statement

If we change this privacy policy statement, We will let you know about the changes by publishing the updated version on our website.

Your Rights

At the request of the data subject and where this is technically possible, We will confirm the data information We hold about the data subject and how it is processed. As set out in the Regulation a data subject can request the following information data:

  • Identity and the contact details of the person or organisation that has determined how and why to process personal data information. In some events, this will be a representative in the EU.
  • Contact details of the data protection officer, where suitable..
  • The purpose of the processing as well as the legal grounds for processing.
  • If the processing is based on the legitimate interests of Tulsa Burg or a third-party, data information about those interests.
  • The categories of personal data information collected, stored and processed.
  • Beneficiary(s) or categories of beneficiaries that the data is/will be disclosed to.
  • If We intend to transfer the personal data information to a third country or international organisation, information about how We ensure this is done securely. The EU has approved sending personal data information to some countries because they meet a minimum standard of data protection. In other events, We will ensure there are specific measures in place to secure data information.
  • How long the personal data information will be stored for.
  • Details of data subject’s rights to correct, delete, restrict or object to such processing.
  • Information about the data subject’s right to withdraw permission at any time.
  • How to submit a complaint with the supervisory authority.
  • Whether the provision of personal data information is a statutory or contractual requirement, or a requirement needed to enter into a contract, as well as whether We are obliged to provide the personal data information and the possible consequences of failing to provide such data.
  • The source of personal data information for instance, if it wasn’t collected directly from you.
  • Any details and data about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
What forms of ID will I need to present in order to access this?

Tulsa Burg accepts the following forms of ID when information on your personal data is requested: passport, driving licence, birth certificate, a utility bill from the previous 3 months. We reserve the right to request additional information where your identification is not clear.

Contact Details: Tulsa Burg Limited

Contact Name:

Data Protection Officer

Address:

Tulsa Burg, 86-90 New Paul Street, London, United Kingdom, EC2A 4NE

Email:

dpo@tulsaburg.com