Privacy Policy

South Kensington Estates Limited (“SKE Ltd”) are committed to protecting and respecting your privacy. Below are the guidelines we adhere to for protecting your personal data. This policy sets out the basis on which any personal data we collect from you, or that you provide for us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, the data controller is South Kensington Estates Limited, whose registered office is 4 Cromwell Place, London SW7 2JE.

This notice explains how South Kensington Estates Limited and its subsidiaries (referred to in this notice as ‘SKE’, ‘we’, ‘us’ or ‘our’) act as data controllers, or where applicable joint data controllers, for personal data held about potential and existing customers.

This privacy notice is to inform you about:

1. The personal data we collect about you
2. How we collect personal data
3. How we use your personal data
4. The legal basis for processing your personal data
5. What happens if you withhold personal data that we request
6. How we share your personal data
7. How we keep your information secure
8. How long we keep your personal data
9. Your rights in relation to your personal data
10. Complaints procedure

Be assured that we treat all personal information as confidential and in accordance with data protection legislation. Your personal information may only be shared with others in accordance with this privacy notice. This privacy notice will be updated if there are any changes to the way in which your personal information is used.

THE PERSONAL DATA WE COLLECT ABOUT YOU

We collect personal data, which is any information about you from which you can be identified.

When you contact any member of SKE by telephone, email or post:

• Name, title, address, contact number and email address.

As a residential or commercial tenant:

• Name, title, address, contact number and email address
• Date of birth, nationality and gender
• Personal references, employment details and education details
• Marital status, dependents and next-of-kin emergency details
• Health information including health conditions or disabilities
• Information about criminal convictions and offences
• Financial information including credit score and bank account details
• Corporate information including audited accounts
• Directorships and shareholder information
• Copies of passports, visas, utility bills
• Land registry and property ownership details
• Insurance claim information
• Identifiers from passports or driving licenses
• CCTV footage (refer to our CCTV privacy notice)
• Access control data such as fobs and swipe cards
• Information about how you interact with our services and websites

HOW WE COLLECT PERSONAL DATA

We collect personal data when:

• You contact us directly
• Information is provided by legal advisers, agents or credit reference agencies
• We contact you during the term of our relationship
• From others, such as your neighbours, advisers, support workers
• You allow cookies on your browser when using our website
• You provide consent or permission for works or access

HOW WE USE YOUR PERSONAL DATA

We use your information for:

• Responding to enquiries
• Carrying out background, AML and credit checks
• Managing and administering leases
• Collecting sums payable under leases
• Refund of tenancy deposits
• Managing alterations and maintenance
• Arranging property access
• Enforcing lease terms
• Managing complaints, Legal compliance and court proceedings
• Proof of ownership and address
• Instructing approved contractors

LEGAL BASIS FOR PROCESSING

We rely on the following lawful bases:

• Contractual necessity
• Legal obligation
• Legitimate interests

For certain marketing and the use of cookies we rely on your consent.

Please see the table at the end of the notice for more detail.

SPECIAL CATEGORY AND CRIMINAL CONVICTION DATA

Certain personal data we process is classified as special category data under Article 9 UK GDPR, including health information. We may also process criminal conviction and offence data under Article 10 UK GDPR.

We do not rely on consent as the primary legal basis for processing special category or criminal conviction data due to the imbalance of power inherent in landlord-tenant relationships.

Such data is processed only where necessary to:

• Comply with legal obligations (including right-to-rent and AML)
• Establish, exercise or defend legal claims
• Serve substantial public interest under Schedule 1 of the Data Protection Act 2018
• Preventing and detecting unlawful acts
• To meet our obligations under money laundering requirements
• In limited cases we rely on explicit consent and in very rare situations (where we think you or another is in danger) we will process such data to protect vital interests.

WHAT HAPPENS IF YOU WITHHOLD DATA

Where required data is not provided, we may be unable to perform contractual or legal obligations and may not be able to continue the relationship.

SHARING YOUR PERSONAL DATA

We may share data with:

• Referencing agencies
• Utility providers
• Approved contractors and our advisers such as insurers, accountants, lawyers
• Third party service providers such as software tools we use within the business
• Regulators, courts and law enforcement

Where personal data is shared with other organisations, appropriate safeguards are always applied.

DATA SECURITY

Electronically held data on SKE’s business software and systems, that are within a secure cloud environment, in accordance with data protection legislation.

• Our ICT systems have appropriate security measures in place including firewalls, passwords and multi-factor authentications.
• Our ICT systems have appropriate audits, permissions and restrictions in place, so that the roles within the business only have access to the personal data they require in order to fulfil their roles.

DATA SECURITY

• Identity and right-to-rent documents: duration of tenancy + 6 years
• Financial records: 6 years
• Health and criminal data: retained only as strictly necessary
• CCTV footage: up to 30 days unless required for investigation

Please see the cookie policy for more information on cookie data retention

INTERNATIONAL TRANSFERS

If your data is transferred outside the UK (for example if our software tools are hosted in another country) we will ensure that recognised appropriate safeguards such as contractual terms are in place to protect your data.

AUTOMATED DECISION MAKING

We do not make any decisions about you using solely automated tools.

YOUR RIGHTS

You have a number of rights in relation to your personal information under UK data protection legislation. These include the right to:

• Be informed about how and why we use your personal information, including through this privacy notice.
• Obtain access to the personal information that we hold about you.
• Request rectification of your personal information where you believe it to be inaccurate, incomplete or out of date.
• Request erasure of your personal information in certain circumstances, including where:
  • we are continuing to process personal data beyond the period when it is necessary for the purpose for which it was originally collected.
  • we are relying on your consent as the lawful basis for processing and you withdraw that consent.
  • we are relying on legitimate interests as the lawful basis for processing and you object to that processing, and there are no overriding compelling grounds for us to continue.
  • the personal data has been processed unlawfully; or
  • erasure is required to comply with a legal obligation.
• Request restriction of processing of your personal information where:
  • you contest the accuracy of the personal information.
  • the processing is unlawful and you oppose erasure.
  • we no longer need the personal information, but you require it to establish, exercise or defend legal claims; or
  • you have objected to our processing, and we are considering whether our legitimate grounds override your rights.
• Request data portability, meaning you may ask us to provide certain personal information you have given to us in a structured, commonly used and machine‑readable format. This right applies only where the processing is carried out by automated means and is based on contractual necessity or your consent.
• Object to processing of your personal information where we are relying on legitimate interests or the performance of a task carried out in the public interest. Where you object, we will assess whether we have compelling legitimate grounds to continue the processing.
• Object at any time to direct marketing, including profiling related to direct marketing.
• Not be subject to automated decision‑making, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless permitted by law.

If you would like to exercise any of your rights or would like further information about how we process your personal data, please contact the PA to the Managing Director and Operations Director at SKE on 020 7761 6420, or by email at dataprotectionofficer@ske.org.

Further details about the personal data we process, the purposes for which it is used, the legal bases we rely on, and the rights that apply in each case are set out elsewhere in this privacy notice.

If you have any concerns about how we collect, use or protect your personal data, you have the right to raise a complaint with us at any time. We will investigate your concerns and aim to resolve them promptly and fairly in line with our internal complaints procedures.

You can submit a complaint by contacting our Data Protection team at dataprotectionofficer@ske.org. To help us investigate your concerns as quickly as possible, please include:

• Your name and contact details;
• Details of your complaint, including what has happened and when; and
• Any relevant correspondence or supporting information.

If you are not satisfied with our response, you may request that your complaint is reviewed.

If we are unable to resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, using the following details:

Information Commissioner’s Office (ICO)
icocasework@ico.org.uk
Telephone: 0303 123 1113
Textphone: 01625 545860
Monday to Friday, 9am to 4:30pm

By post:

Information Commissioner’s Office
Wycliffe House Water Lane
Wilmslow
Cheshire
SK9 5AF

We would, however, appreciate the opportunity to address your concerns first.