Privacy Policy

Who are we

We are Vistry Group PLC a public limited company incorporated in England and Wales with company number 00306718. Our registered address is 11 Tower View, Kings Hill, West Malling, Kent, ME19 4UY.

In this policy we refer to ourselves as “we”, “us”, “our” and “Vistry Group”. A list of Vistry Group Entities is set out in the General Vistry Privacy Policy.

Vistry Group is a “data controller”. This means that we are responsible for deciding how we hold and use personal information we have collected from you.

We are entered in the UK Information Commissioner’s Office (ICO) Register of Fee Payers with registration number: Z1122226.

If you have any questions, or want more details about how we use your personal information, you can contact our Data Protection Lead as follows:

The Data Protection Lead

Vistry Group PLC
Cleeve Hall, Cheltenham Road,
Bishops Cleeve, Cheltenham,
Gloucestershire GL52 8GD

data.protection@vistrygroup.co.uk

What personal information we may hold about you

We may collect the following categories of information from you:

Contact: your name, your address, contact telephone number(s) and contact email address

Identification: this could include copies of your passport, driving licence, birth certificates and/or utility bills.

Communications: any personal information that you disclose to us in letters, emails and/or telephone conversations between us.

Financial: your bank account details and/or credit or debit card details which we may collect when you reserve or purchase one of our homes.

As well as personal information (such as your name, address, telephone number) we may collect sensitive personal information (also known as special categories of data), which may include:

• Religious or philosophical beliefs (e.g. if there are certain periods that you cannot be contacted)
• Health information (e.g. if you have special accessibility requirements).

We use this data to ensure our services are delivered appropriately. We will apply additional security and confidentiality measures when processing your sensitive personal information.

We will ask for your specific informed consent at the time of collecting this type of data, which is entirely optional. Where you provide consent for us to process sensitive personal information, you have the right to withdraw this consent at any time.

We may collect information from you in the following ways:

Information provided by you

• When you talk to us on the phone or face to face
• When you visit one of our show homes or developments
• When you contact us by email or by letter
• When you fill in one of our forms, for example, our reservation form when you agree to buy one of our homes and/or part exchange your home with us
• When you use our website to request brochures or for us to contact you by telephone, post and/or email about our products, developments and offers
• When you complete customer surveys
• When you contact us through social media
• When you make a complaint

Information we collect

• From third parties with your knowledge, including property portals such as Zoopla and Rightmove, estate agents, mortgage brokers, sub-contractors, the NHBC, utility suppliers, local authorities, legal advisors, agents working on our behalf to help us provide services to you.
• Profile and usage data: we gather this data from devices, such as computers and mobile phones that you use to connect to our website using cookies and other internet tracking software. Please see our cookie policy for more information about this.

If you choose not to give personal information

We may need to collect personal information by law, or under the terms of a contract we have with you. If you choose not to give us this personal information, it may delay or prevent us from meeting our obligations. It may also mean that we cannot provide our services or products to you (or further information about them).

Unless we have your consent, we will only collect the personal information that we need to be able to provide a product or service to you. The type of information we need from you will vary depending on our relationship with you and the product or service we are providing. When we ask you for information, we will make it clear why we need it. Any data collection that is optional will be made clear at the point of collection.

If you provide any personal information relating to another person, normally a joint buyer or someone who is living with you, we assume that you do so with their full knowledge and consent.

Our purpose for collecting and processing your personal data

Data Protection law says that we can use your personal information only if we have a lawful basis for doing so. This means that we can only process your personal data if we have one (or more) of these reasons:

• To fulfil a contract we have with you
• To comply with a legal obligation
• When it is in our legitimate interest
• When you consent to it
• To protect your vital interests e.g. in cases of life or death, or
• When we are exercising a statutory function or official task in the public interest, although this will only apply in exceptional situations.

A legitimate interest is when we (or someone else) have a business or commercial reason to use your information. However, such use of your personal data must not have an unduly negative or unfair impact on your privacy or prejudice your rights and freedoms.

Here is a list of all the ways that we may use your personal information when you are a customer, and which of the lawful reasons we rely on to do so.

Marketing

We will use your personal information to tell you about our products and services. This is what we mean when we talk about ‘marketing

The personal information we have for you is made up of what you tell us and data we collect from third parties we work with (with your knowledge or reasonable awareness). We use this to identify and inform us of what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant to you.

We can only use your personal information to send you marketing messages if we have either your consent or a ‘legitimate interest’ (as described above).

We rely on our legitimate interests to send you postal marketing communications (from time to time).

You can ask us to stop sending you marketing materials by contacting us at any time using the contact details above.

Before sending electronic marketing communications, we will follow the law and guidance where this requires us to seek your consent although as an existing customer we may be send you information regarding similar products and services.

You can withdraw your consent to receive further electronic marketing at any time. Please just contact us using the contact details above, or visit your marketing preferences page, or follow the ‘unsubscribe’ instructions on our targeted marketing communications.

We may ask you to confirm or update your choices from time to time and if there are changes in the law, regulation, or the structure of our business.

Vistry Group will never sell your personal data to third party organisations for marketing purposes.

Who we share your personal information with

Sometimes we need to share personal information we hold about you with other organisations that we work with or who provide services on our behalf. When sharing information, we will comply with all aspects of data protection law.

When we need to share personal data with our clients, Joint Venture Partners, contractors and third party suppliers, our relationships with them are governed by contracts which impose strict data sharing and confidentiality requirements.

Where the information is of a sensitive nature, for example about your health, we will generally obtain consent from you prior to sharing this information, unless we are required or permitted to share this by law.

Where sharing is in our legitimate business interests, we may share your information without seeking your consent first. This may be with:

• Our contractors to facilitate repairs, maintenance or improvement works to a home you have purchased from us.
• Other organisations in the Vistry Group, who are providing services to us or on our behalf.
• Utility companies (and their representatives) and Council Tax Departments to ensure billing details are correct.
• Local Authorities who we may need to share your personal information with in order to evidence that we are complying with planning obligations, for example, in relation to affordable housing.
• The National House Builders Council to provide you with warranties that relate to a home purchased from us.
• Third parties providing services on our behalf. For example, our legal advisors who process and manage your purchase of a property from us; a mailing company distributing our marketing materials; or a research company carrying out a customer satisfaction survey on our behalf.
• Government agencies, Help to Buy agents and other housing providers through shared ownership schemes as part of required administration relating to the purchase of your new property when using different purchase assistant schemes.
• Police and other relevant authorities (e.g. Department of Work & Pensions, Probation Service, HM Revenue and Customs) in relation to the prevention and detection of crime, the apprehension of offenders or the collection of tax or duty.
• We may also share information when required by law for example where ordered by the Court or with health professionals to protect an individual from immediate harm.

We may also share your personal information if the structure of Vistry Group changes in the future. We may choose to sell, transfer, or merge parts of our company, or our assets; or we may seek to acquire other companies or merge with them. During any such restructuring of our Group, we may share your information with other parties. We’ll only do this if those parties agree to keep your data safe and private.

Sending data outside of the UK or EEA

We will only send your data outside of the UK or European Economic Area (‘EEA’) to:

• Follow your instructions,
• Comply with a legal duty, or
• If legally permitted to do so although if we do transfer information outside of the UK or EEA in these circumstances we will make sure that it is protected in the same way as if it was being used in the UK or EEA. If so, we’ll use one of these safeguards:
  • Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA.
  • Put in place a contract with the recipient that means they must protect it to the same standards as in the EEA.

How long we keep your personal information

We will keep your personal information for as long as you are a customer of Vistry Group.

After you stop being a customer, we may keep your information for up to 12 months for one of these reasons:

• To respond to any questions or complaints or to resolve any follow up issues between us, or
• To show that we treated you fairly and lawfully in compliance with data protection law.

We may keep your data for longer than 12 months if we cannot delete it for legal or regulatory reasons or need to do so to deal with future legal claims or we have a legitimate need to do so. If we do, we will make sure that your privacy is protected and only use it for those purposes.

We have a document retention schedule which sets out how long we keep different types of information for. This is based on legal requirements and good industry practice.

We will apply appropriate technical and organizational measures to ensure your personal information is secure. For example, we have systems in place to ensure that access to personal information is restricted to authorised individuals on a strictly need-to- know basis.

To help us ensure the security and confidentiality of your personal information we will ask you (and any of your representatives) security questions to confirm your identity when you call us and as may be necessary when we call you.

We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so or where we have received a clear verbal instruction from you (as a one-off circumstance).

Your rights

Vistry Group is committed to upholding your data privacy rights.

The right to be informed

We will be open and transparent about how and why we use your personal information. This will be set out in our privacy notices.

The right of access

You have a right to ask us what personal information we hold about you and to request a copy of your personal information. This is known as a ‘subject access request’ (SAR).

If you are seeking to obtain specific information (e.g. about a particular matter or that relates to a specific time period), please clarify the details of what you would like to receive in your written request.

We will provide a copy of your information free of charge. However, we can charge a ‘reasonable fee’ if your request is manifestly unfounded or excessive, particularly if it is repetitive. Our fee will be based on administrative costs incurred by us in providing your information.

Where your request is manifestly unfounded or excessive we can refuse to respond. If we refuse to respond to your request, we will let you know why.

We have one month to provide you with the information you’ve requested (although we will try to provide this to you as promptly as possible). We may extend this period by a further two months if your request is complex or we have received a number of requests from you. If this is the case, we will inform you within one month of the receipt of your written request, explaining why an extension is necessary.

We will provide you with a copy of the personal information that we hold about you. This will not generally include information about your property such as repair logs or details of contractor visits as this is unlikely to constitute your ‘personal information’.

Please be clear if you are seeking property or repairs related information, as a SAR is unlikely to fulfil your information requirements.

The right to rectification

You can ask us to rectify your personal data if it is inaccurate or incomplete by contacting us using the contact details above. If you do, we will take reasonable steps to check its accuracy and correct it.

We will comply with your request free of charge. However, we can charge a ‘reasonable fee’ if your request is manifestly unfounded or excessive, particularly if it is repetitive. Our fee will be based on administrative costs incurred by us in complying with your request. Where your request is manifestly unfounded or excessive we can refuse to comply with your request.

If we refuse to comply with your request, we will let you know why.

We have one month to comply with your request (although we will try to do this as promptly as possible). We may extend this period by a further two months if your request is complex or we have received a number of requests from you. If this is the case, we will inform you within one month of the receipt of your written request, explaining why an extension is necessary.

Where we have shared the personal data in question to others, we will contact each recipient and inform them of the rectification of your personal data, unless this proves impossible or involves disproportionate effort.

Please help us to keep our records accurate by keeping us informed of any changes in your personal information.

The right to erasure

The right to erasure is also known as ‘the right to be forgotten’. In some circumstances, you can ask us to delete or remove personal data where there is no compelling reason for its continued processing.

This is not an absolute right, and we will need to consider the circumstances of any such request and balance this against our need to continue processing the data, for example, to comply with a legal obligation. Our response will also be guided by the provisions of our retention schedule.

We will comply with your request free of charge. However, we can charge a ‘reasonable fee’ if your request is manifestly unfounded or excessive, particularly if it is repetitive. Our fee will be based on administrative costs incurred by us in complying with your request.

Where your request is manifestly unfounded or excessive we can refuse to comply with your request.

If we refuse to comply with your request, we will let you know why.

We have one month to comply with your request (although we will try to do this as promptly as possible). We may extend this period by a further two months if your request is complex or we have received a number of requests from you. If this is the case, we will inform you within one month of the receipt of your written request, explaining why an extension is necessary.

Where we have shared the personal data in question with others, we will contact each recipient and inform them of the erasure of your personal data, unless this proves impossible or involves disproportionate effort.

The right to restrict processing

In some circumstances you can ask us to restrict the use of your personal information. This is not an absolute right and only applies if:

• You disagree with the accuracy of your personal information
• It has been used unlawfully but you don’t want us to delete it
• It’s not relevant any more, but you want us to keep it for use in legal claims
• You have already asked us to stop using your data but you are waiting for us to tell you if we can keep on using it
• If we’re processing your data on the grounds of legitimate interests (as detailed earlier), and whilst we consider whether our legitimate grounds override those of yours

We will comply with your request free of charge. However, we can charge a ‘reasonable fee’ if your request is manifestly unfounded or excessive, particularly if it is repetitive. Our fee will be based on administrative costs incurred by us in complying with your request.

Where your request is manifestly unfounded or excessive we can refuse to comply with your request.

If we refuse to comply with your request, we will let you know why.

We have one month to comply with your request (although we will try to do this as promptly as possible). We may extend this period by a further two months if your request is complex or we have received a number of requests from you. If this is the case, we will inform you within one month of the receipt of your written request, explaining why an extension is necessary.

If we restrict the processing of your personal information, we are permitted to store the personal data but we won’t use it.

Where we have shared the personal data in question to others, we will contact each recipient and inform them of the restriction of the personal data, unless this proves impossible or involves disproportionate effort.

The right to data portability

Data portability allows you to obtain and reuse your personal data for your own purposes across different services. You can ask us to move, copy or transfer your personal data from one IT environment to another by contacting us on the contact details above.

The right to data portability is not an absolute right and only applies to personal information you have provided to us:

• where our processing is based on your consent or for the performance of a contract; and
• when our processing is carried out by automated means.

We will provide your information free of charge. If you request it, we will transmit your data directly to another organisation, but only if this is technically feasible. We are not required to adopt or maintain processing systems that are technically compatible with other organisations.

We have one month to comply with your request (although we will try to do this as promptly as possible). We may extend this period by a further two months if your request is complex or we have received a number of requests from you. If this is the case, we will inform you within one month of the receipt of your written request, explaining why an extension is necessary.

The right to object

You can object to our processing of your personal data where that processing is based on legitimate interests and, in those cases, we will stop processing your personal data unless:

• we can demonstrate a compelling legitimate grounds for continuing the processing, which override your interests, rights and freedoms; or
• the processing is needed for the establishment, exercise or defence of legal claims.

If you object to our processing of your personal data for direct marketing purposes, we will immediately stop processing your personal data for that purpose although will keep your stop request on our records so as to respect your wishes.

Rights in relation to automated decision making and profiling

You can ask us to review any decisions that are determined by automated means (making a decision about you solely by automated means without any human involvement). You can also object to our use of your personal data for profiling (automated processing of personal data to evaluate certain things about you).

How to complain

If you are unhappy with why or how we have used your personal information or want to exercise your rights above, please contact our data protection lead using the contact details above.

If we cannot deal with your issue and you want to raise a complaint about our processing of your data, you can contact the Information Commissioner using the following contact details:

Information Commissioner
Wycliffe House,
Water Lane, Wilmslow,
Cheshire SK9 5AF

Tel: 0303 123 1113
www.ico.org.uk

Last updated 10.01.24