This privacy policy ("Policy") has been developed and provided to help you understand how Duke Street Property Limited and relevant members of its group of companies ("DSP", "we", "us") use and protect the personal data that we process. For purposes of this Policy, "personal data" includes any information that relates to you as an identified or identifiable individual.
Duke Street Property Limited, in addition to any group affiliates identified below, will be the controller(s) of any personal data that we process in connection with the leased use of our premises, for example if you are the tenant or other occupier, the contact point for a business tenant, if you are an entity director and/or if you are providing tenancy guarantees. We are registered with the Information Commissioner’s Office (ICO) (registration number: ZB559866).
If you ever have any questions about this Policy or how we use your personal data, then you can always contact us using the information in the 'contact us' section below.
About this Policy
This Policy applies to information that we process in relation to occupiers of properties within our portfolio, including residential occupiers and for business occupiers their officers, employees, agents, contractors and other representatives ("you", "your").
This could include information that is provided when you engage with us directly, engage with one of our group companies, engage with a relevant letting agent or more commonly where we collect information about you indirectly through our network of property management agents.
We will do our best to be transparent about how we use your personal data and to give you the best information possible. To help us do that we reserve the right to change this Policy or create additional policies to take account of changed circumstances or new legal requirements. Since we might need to do that in the future, we ask that you check back here on a regular basis and read this Policy together with any other privacy policies or notices that we have provided to you on specific occasions. If required, we will notify you of any material change we make to this Policy.
The kinds of personal data we process
In order to enter into, administer and otherwise manage our tenancies, we may process the following types of your personal data:
• Business Contact Data: your name, address, job title, email address, telephone number
• Residential Contact Data: your name, address, email address, telephone number
• Residential Occupier Data: rental history and references, results of credit checks, right to rent information, details of employment status and role
• Contract Data: KYC data, signatures, details of guarantees
• Security Data: CCTV data, access control data
Why we process your personal data and our legal basis
We collect and process your personal data for different reasons in different circumstances, provided that we always have a legal basis for doing so. Our purposes and legal basis for using each type of personal data are set out below:
Commercial Occupiers
Business Contact Data
Purposes
- To manage our tenancies
Legal Basis
Necessary for our legitimate interests in engaging with you in relation to our business, including to manage our tenancy arrangements
Contract Data
Purposes
- To enter into a tenancy agreement
Legal Basis
Necessary for our legitimate interests in entering into tenancy agreements, administering those agreements and otherwise for the purposes of operating and administering our business
Security Data
Purposes
- To provide and manage security services to or on behalf of our occupiers
Legal Basis
Necessary for our legitimate interests and our occupiers' legitimate interests in ensuring site access and security arrangements
Residential Occupiers
Residential Contact Data, Residential Occupier Data
Purposes
- To manage our tenancies
Legal Basis
Necessary for the performance of the tenancy agreement we have entered into with you; and/or because it is necessary for compliance with our legal obligations
Residential Occupier Data
Purposes
- To enter into a tenancy agreement
Legal Basis
Necessary for entry into the tenancy agreement; and/or because it is necessary for compliance with our legal obligations
Security Data
Purposes
- To provide and manage security services to or on behalf of our occupiers
Legal Basis
Necessary for our legitimate interests and our occupiers' legitimate interests in ensuring site access and security arrangements
Who we share your data with
Sometimes we might share your data with third parties. This could include:
- our affiliates and group companies;
- property management agents;
- letting agents
- service providers we use for specific purposes, such as for our IT systems and access control providers, software providers;
- our professional advisers, such as lawyers, accountants and auditors;
- regulatory authorities, public authorities, law enforcement agencies and courts; and/or
- in the event of a disposal or refinancing of all or a part of our business, the buyer or funder and their professional advisers.
International transfers of personal data
Our ultimate parent entity, Wittington Investments, Limited, as well as certain other third parties we transfer personal information to are based outside the UK/ European Economic Area ("EEA"), including in countries which have a lower standard of protection for personal data than in the UK.
Where required by data protection laws, we will ensure that appropriate safeguards are in place to protect your personal data when it is transferred outside of the UK/ EEA. For example, putting appropriate contractual agreements, such as standard contractual clauses or the ICO’s international data transfer agreement, in place. You can request more information on the safeguards we rely on or ask to obtain a copy of these by getting in touch with us using the contact details set out below.
Keeping your data safe and secure
We are committed to securing your data and keeping it confidential. We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally or unlawfully destroyed, lost, altered, disclosed, used or accessed.
How long we keep your data
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, or as otherwise required for legal purposes. Once those purposes have been achieved then, unless a different purpose for processing your data arises, it will be permanently deleted.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal data, the purposes for which we process your personal information and whether we can achieve those purposes through other means. We also take into account legal and regulatory requirements which require the retention of personal information for a minimum period of time and limitation periods for taking legal action.
Your rights in connection with your personal data
You have certain rights under data protection laws in the UK in in relation to your personal data. We have set out a list of your rights below, although please note that they may not always apply in every case and may be subject to certain conditions.
- Access: you may have the right to obtain from us confirmation if your personal data is being processed by us in addition to certain related information, as well as the right to obtain a copy of your personal data undergoing the processing.
- Rectification: you may have the right to request the rectification of inaccurate personal data and to have incomplete data completed.
- Erasure request to erase your personal data if (i) it is no longer necessary for the purposes for which we have collected it, (ii) you have withdrawn your consent and no other legal ground for the processing exists, (iii) you objected and no overriding legitimate grounds for the processing exist, or (iv) the processing is unlawful, or erasure is required to comply with a legal obligation.
- Restriction: you may request that we restrict the processing of your personal data in certain cases, (so that we must suspend the processing, except for storage, with your consent or for legal claims) including for example where you object to us processing your personal data on the basis of our legitimate interests or where you want to establish the accuracy or the reason we are processing your personal data
- Objection: where we process your personal data on the basis of our legitimate interests, you may have the right to object to this processing for reasons relating to your particular situation. If this is the case, we will stop this processing of your personal data unless we can demonstrate compelling reasons why we need to process it which override your rights and freedoms, or where we need to process it for the purposes of legal claims. Where we process your personal data for direct marketing purposes, you may have the right to object to our processing of your personal data for this at any time.
- Portability: you may have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format and to transmit it to other data controllers. This right only exists if the processing is based on your consent or a contract and the processing is carried out by automated means.
- Right to refuse to provide information: you have the right to refuse to provide information when requested, however please note that where the processing of that information is necessary for the purposes of entering into or performing contractual obligations, or to comply with our legal obligations, then your failure to provide certain information when requested could mean that we are unable to comply with those obligations.
- Right to refuse or withdraw consent: in cases we ask for your consent to processing, you are free to refuse to give consent and you can withdraw your consent at any time without any adverse negative consequences. The lawfulness of any processing of your personal data that occurred prior to the withdrawal of your consent will not be affected.
Complaints
We would always welcome the chance to deal with your concerns in the first instance, but you have the right to make a complaint to the ICO if you feel that we have handled your data improperly. If you would like to contact the ICO, then you can do so through their website at https://ico.org.uk.
Contact us
If you have any questions about this Policy or how we process your data, then you can contact us at any time using the details below.
DSP Team Parcels Building 6th Floor, 14 Bird Street London, W1U 1BU United Kingdom
Email: info@dukestreetproperty.com