Your Valuation Tool and GDPR - What you need to know
by Holly Gown, Systems and Operations Manager | 31st May 2018
Given the nature of the relationship between you and the consumers that complete the valuation journey using this tool, we consider you would be justified in establishing Legitimate Interest as your lawful basis for processing this data and contacting the consumer regarding their valuation. The contact following the consumer’s completion of the form should be to discuss the valuation provided and to book a face to face market appraisal. During this contact, consent for any further communications, such as marketing, would be discussed.
1. Perform a Legitimate Interest Assessment to ascertain if you are justified to use Legitimate Interest as your legal basis for processing the data obtained from a consumer’s use of The ValPal Network’s valuation tool, for the purpose of contacting the consumer regarding their valuation. A Legitimate Interest Assessment template can be found within the Data Protection Network’s Legitimate Interests Guidance.
2. Ensure the only contact made with the consumer initially is regarding the valuation they received. Consent for other types of communication, such as marketing, newsletters, currently listed properties, can be discussed on this call.
3. Put steps in place to enable the deletion of Personally Identifiable Data obtained from the use of The ValPal Network’s valuation tool from all systems in which it is stored a maximum of 3 years post the most recent use of the valuation tool, unless further services have been taken or other communications have been requested. In which case the data retention policy associated with this service or communication will supersede this one.
4. You must not transfer the data obtained from a consumer’s use of The ValPal Network’s valuation tool outside of the European Economic Area (the “EEA”).The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein.
5. Only put the data in a CRM or admin system - unless further services have been taken, or other communications have been requested. In which case the data storage policy associated with this service or communication will supersede this one.