Privacy Notice - Owners and potential owners

20th January 2022

At Cornish Gems, we are committed to protecting and respecting your privacy and safeguarding any personal data that you give to us. We are transparent about the processing of your personal data and this notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

We are a controller under the UK GDPR and the Data Protection Act 2018. Our data protection officer is Kristy Gouldsmith and she can be contacted at data.protection@cornishgems.com

We are:

Cornish Gems Ltd

Carne House
Western Extension
Threemilestone
Truro
Cornwall
TR4 9LD

Tel:+44(0)1872 241 241

Email:enquiries@cornishgems.com

What kind of personal data does Cornish Gems collect and process?

When you become an owner and engage our services, we need information in order to provide the services.

1. Being an owner

Cornish Gems collects and uses information you provide to us. When you become an owner, we need your:

2. Customer Service

We keep a record of all correspondence. We will monitor and/or record all phone conversations for training and customer service reasons. This information is kept for 6 years following the termination of your owner agreement incase of the unlikely event of any legal proceedings.

3. Marketing

You can subscribe to receive our email newsletters and you can opt-out at any time.

4. Surveys or Feedback

We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them and we will be clear about what information we are collecting and how the data will be processed.

5. Competitions

If you enter one of our competitions, we will use your data to let you know if you have won the prize. We will not use this data for marketing purposes unless you have consented to such marketing.

6. Site Data

We collect information about your computer, including your IP address, operating system and browser type, for system administration and for the security of our website.

We do not use cookies (except essential or necessary cookies) without your consent.

7. Personal data we receive from other sources.

We may also receive information about you from other sources, such as a guest or contractor.

Another way we might receive data about you is through the communication services integrated into our website, through social media platforms and via third party review websites completed by guests. Our chat service offers you a way to contact us. We receive data about these communication activities (such as who you are, where you are from, your email (if you choose to share it with us) and the date and length of the chat).

Why does Cornish Gems collect and use your personal data?

The main reason we ask you for personal details is to provide our services to you as a property owner.

Your personal data may be used in the following ways:

1. Property ownership: most importantly, we use your personal data to administer your contract with us. We will email you information about your contract and your property.

Providing your personal data to Cornish Gems is voluntary. Once you have decided to become one of our owners, then we rely on the legal basis of contract -- the processing of personal data is necessary for your contract with us. All administrative communications with you regarding your property are required because of your contract with us and you can’t opt out of them.

2. Customer service: we provide customer service 7 days a week. Sharing information allows us to provide you with an excellent service and deal with any issues that may arise at your property. For example, we may share your name with a contractor if there is an issue at your property. Our legal basis here is also contract – providing our customer service is part of our agreement with you.

3. Account facilities: you can create an account on our website to administer your property. This is also part of our contractual services to you.

4.Marketing activities: We use your information for marketing activities. These activities include:

Our legal basis for our marketing activities is either consent or legitimate interest. If you haven’t engaged with us by either becoming an owner or making an enquiry, then we will only contact you if you have asked us to do so.

If you have become an owner, or made an enquiry, we can contact you using the legal basis of legitimate interest. If you don’t want these communications, then you can opt out at anytime.

5. Market research: we sometimes invite our owners to take part in surveys or to provide feedback. You are free to take part or decide not to.

6. Improving our services: We use personal data for analytical purposes and product improvement. This is part of our commitment to making our services better and enhancing the user experience. As much as possible, we strive to use pseudonyms for this analytical work. Our legal basis is legitimate interest.

7.Call monitoring: we record all calls made to us. When you call, our staff may ask for authentication, which helps to keep your details confidential. Calls are recorded for quality control and training purposes and for the handling of complaints, legal claims and for fraud detection. Recordings are kept for 6 years before being automatically deleted. An exception to this rule would be if Cornish Gems has a legitimate need to keep the recordings longer for complaints, issues, fraud investigation or legal purposes. Calls are recorded under our legal basis of legitimate interest.

8. Legal purposes: we may need to use your information to handle and resolve legal disputes, for regulatory investigations and compliance or to comply with lawful requests from law enforcement. In these cases, our legal basis is legal obligation. For example, we are obliged to prevent money laundering and fraud so we need copies of your identification and the property ownership documents.

How does Cornish Gems share your data with third parties?

We share your personal data with third parties where required, including:

1. Guests: normally, we don’t share the names of property owners with guests. However, if you have a dispute with a guest, we may provide them with additional information about you.

2. Third-party service providers: we use service providers to support us in providing our services.

These include:

All service providers are required to continue to adequately safeguard your personal data.

3. Competent authorities: we disclose personal data to law enforcement to the extent that it is required by law or is strictly necessary for the prevention, detection or prosecution of criminal acts and fraud, or if we are otherwise legally obliged to do so. We may need to further disclose personal data to competent authorities to protect and defend our rights or properties, or the rights and properties of our accommodation owners.

What security and retention procedures does Cornish Gems use?

We have procedures in place to prevent unauthorised access to, and the misuse of, personal data.

We use appropriate business systems and procedures to protect and safeguard the personal data you give us. We also use security procedures and technical and physical restrictions for accessing and

using the personal data on our servers. Only authorised personnel are permitted to access personal data in the course of their work.

We keep financial data and booking data for seven years. We keep you on our newsletter email list until you opt out or we see that you are no longer opening our emails. If you have been an owner or made an enquiry, we keep your name and email or marketing purposes for five years. You can opt out at anytime.

Does Cornish Gems transfer data out of the UK?

We endeavour to hold most of your data in the UK but we do have some service providers who are based outside of the UK. Several of these providers are based in countries that are adequate for data transfer; for countries that are not, we use approved Standard Contractual Clauses as our data transfer safeguard.

What are your rights regarding your personal data?

You have the right:

If you want to exercise any of these rights, please contact us.

If you have a concern about the way we are collecting or using your personal data, please raise your concern with us in the first instance. You may also contact the Information Commissioner’s Office at https://ico.org.uk/concerns/.