This privacy notice (the "Notice") has been developed and provided to help you understand how Duke Street Property Limited ("DSP", "we", "our" or "us") uses and protects the personal data that we process. For purposes of this Notice, "personal data" includes any information that relates to you as an identified or identifiable individual.
Duke Street Property Limited, is the controller of any personal data processed in connection with the leased use of our premises, for example if you are the tenant or other occupier, the contact point for a commercial occupier, if you are an entity director and/or if you are providing tenancy guarantees. We are registered with the Information Commissioner’s Office ("ICO") (registration number: ZB559866).
If you ever have any questions about this Notice or how we use your personal data, then you can always contact us using the information in the 'contact us' section below.
About this Notice
This Notice applies to information that we process in relation to occupiers of properties within our portfolio, including residential occupiers and for commercial occupiers their officers, employees, agents, contractors and other representatives ("you", "your").
This could include information that is provided when you engage with us directly, engage with one of our group companies, engage with a relevant letting agent or more commonly where we collect information about you indirectly through our network of property management agents.
We will do our best to be transparent about how we use your personal data and to give you the best information possible. To help us do that we reserve the right to change this Notice or create additional privacy notices to take account of changed circumstances or new legal requirements. Since we might need to do that in the future, we ask that you check back here on a regular basis and read this Notice together with any other privacy notices that we have provided to you on specific occasions. If required, we will notify you of any material change we make to this Notice.
The kinds of personal data we process
In order to enter into, administer and otherwise manage our tenancies, we may process the following types of your personal data:
- Business Contact Data: your name, address, job title, email address, telephone number
- Residential Contact Data: your name, address, email address, telephone number
- Residential Occupier Data: rental history and references, results of credit checks, right to rent information, details of employment status and role
- Contract Data: KYC data (which for commercial occupiers may include financial information and corporate structure charts), signatures, details of guarantees, financial information (of residential occupiers) and other information necessary to verify your identity (e.g. passport)
- Security Data: CCTV data, access control data
Why we process your personal data and our legal basis
We collect and process your personal data for different reasons in different circumstances, provided that we always have a legal basis for doing so. Our purposes and legal basis for using each type of personal data are set out below:
Commercial Occupiers:
Category of personal data:
Our purpose for processing:
Our legal basis:
Business Contact Data
To enter into and manage our tenancies
Necessary for our legitimate interests in engaging with you in relation to our business, including to manage our tenancy arrangements
Contract Data
To enter into and manage our tenancies
Necessary for our legitimate interests in entering into tenancy agreements, administering those agreements and otherwise for the purposes of operating and administering our business
Security Data
To provide and manage security services to or on behalf of our occupiers
Necessary for our legitimate interests and our occupiers' legitimate interests in ensuring site access and security arrangements
Residential Occupiers:
Category of personal data:
Our purpose for processing:
Our legal basis:
Residential Contact Data, Residential Occupier Data
To enter into and manage our tenancies
Necessary for the performance of the tenancy agreement we have entered into with you; and/or because it is necessary for compliance with our legal obligations
Contract Data
To enter into and manage our tenancies
Necessary for our legitimate interests in entering into tenancy agreements, administering those agreements and otherwise for the purposes of operating and administering our business
Security Data
To provide and manage security services to or on behalf of our occupiers
Necessary for our legitimate interests and our occupiers' legitimate interests in ensuring site access and security arrangements
Who we share your personal data with
Sometimes we might share your personal data with third parties. This could include:
- our affiliates and group companies;
- property management agents;
- letting agents;
- service providers we use for specific purposes, such as for our IT systems and access control providers, software providers;
- our professional advisors, such as lawyers, accountants and auditors;
- regulatory authorities, public authorities, law enforcement agencies and courts; and/or
- in the event of a disposal or refinancing of all or part of our business, the buyer or funder and their professional advisors.
We take appropriate steps to ensure that any third party to whom we disclose your personal data, who processes data as a processor, handles it in accordance with the law, uses it only for the purposes permitted under our contract with them, and keeps it secure. Other third parties may be separate controllers (such as our professional advisers or law enforcement) so you should consult their privacy notices for more information about how they process your personal data.
If you would like further information on the third parties with whom your personal data is shared, please contact us using the contact details set out below.
International transfers of personal data
We may transfer your personal data to third parties who are based outside the UK, including in countries which have a lower standard of protection for personal data than in the UK.
We will ensure that appropriate safeguards are in place to protect your personal data when it is transferred outside of the UK. For example, putting appropriate contractual agreements, such as standard contractual clauses or the ICO’s international data transfer agreement, in place. You can request more information on the safeguards we rely on or ask to obtain a copy of these by getting in touch with us using the contact details set out below.
Keeping your data safe and secure
We are committed to securing your data and keeping it confidential. We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally or unlawfully destroyed, lost, altered, disclosed, used or accessed.
How long do we keep your data
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, or as otherwise required for legal purposes.
To determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of the personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. We also take into account legal and regulatory requirements which require the retention of your personal data for a minimum period of time and limitation periods for taking legal action.
The retention periods which apply to the personal data we process are set out below:
Category of personal data:
Retention period:
Business Contact Data
12 or 6 years from the end of the tenancy, depending on whether the agreement is executed as a deed (12 years) or a simple contract (6 years), and for as long as we have a legitimate business interest to keep processing your personal data (e.g. to resolve disputes or comply with legal or regulatory obligations).
Contract Data
12 or 6 years from the end of the tenancy, depending on whether the agreement is executed as a deed (12 years) or a simple contract (6 years), reflecting the applicable limitation period for bringing claims.
Residential Contact Data, Residential Occupier Data
6 years from the end of the tenancy, reflecting the applicable limitation period for bringing claims.
Security Data
Up to 31 days from the date of recording.
Your rights in connection with your personal data
You have certain rights under UK data protection law in relation to your personal data. We have set out a list of your rights below, although please note that they may not always apply in every case and may be subject to certain conditions.
- Access: you have the right to obtain from us confirmation as to whether your personal data is being processed by us in addition to certain related information, as well as the right to obtain a copy of your personal data undergoing the processing.
- Rectification: you have the right to request the rectification of inaccurate personal data and to have incomplete data completed.
- Erasure: you may request that we erase your personal data if: (i) we no longer need it for the purposes for which we have collected it, (ii) you have withdrawn your consent and no other legal ground for the processing exists, (iii) you objected and no overriding legitimate grounds for the processing exist, or (iv) the processing is unlawful, or erasure is required to comply with a legal obligation.
- Restriction: you may have the right to request that we restrict the processing of your personal data in certain circumstances. This includes where you contest the accuracy of the data, where the processing is unlawful but you do not want us to erase the data, where we no longer need the data but you required it to establish, exercise or defend a legal claim, or where you have objected to our processing and we are considering whether our legitimate interests override your rights and freedoms.
- Objection: where we process your personal data on the basis of our legitimate interests, you may have the right to object to this processing for reasons relating to your particular situation. If this is the case, we will stop this processing of your personal data unless we can demonstrate compelling reasons why we need to process it which override your rights and freedoms, or where we need to process it for the purposes of legal claims.
- Portability: you may have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format and to transmit it to another controller. This right only exists if the processing is based on your consent or a contract and the processing is carried out by automated means.
- Right to refuse or withdraw consent: in cases where we ask for your consent to processing, you are free to refuse to give consent and you can withdraw your consent at any time. The lawfulness of any processing of your personal data that occurred prior to the withdrawal of your consent will not be affected.
Right to complain
If you have any concerns about the way we have handled your personal data, you have the right to make a complaint to us at any time by contacting us using the contact details set out below. Your complaint will be acknowledged within 30 days and investigated and responded to without undue delay. If you are not satisfied with the outcome of your complaint, you have the right to raise your concerns with the ICO, the UK supervisory authority for data protection issues (www.ico.org.uk).
Contact us
If you have any questions about this Notice or how we process your personal data, then you can contact us at any time using the details below.
DSP Team at
101 Wigmore Street
London, W1U 1QU
United Kingdom
Email: info@dukestreetproperty.com
Last updated: 08 October 2026