Privacy Notice.
What personal data we hold about owners, tenants and applicants, why we hold it, who we share it with, how long we keep it and what you can ask us to do with it.
This page is a working draft prepared for review. It has not been checked or signed off by a solicitor, and every item marked [CONFIRM: …] is a fact still to be supplied or verified before publication. Nothing on this page should be relied on as a statement of Redpoint’s current practice until it has been.
1. About this notice
This notice explains what personal data Redpoint Property Group Ltd collects, why we collect it, who we share it with, how long we keep it and what rights you have over it. It is written to meet the UK GDPR and the Data Protection Act 2018.
It covers property owners and their representatives, tenants and tenancy applicants, guarantors, people who contact us through this website, and the contractors and suppliers we work with.
2. Who we are
Redpoint Property Group Ltd is the data controller for the personal data described here.
| Detail | Value |
|---|---|
| Company | Redpoint Property Group Ltd, registered in England & Wales, company no. 16306988 |
| Registered office | 31 Church Road, Manchester M22 4NN |
| Data protection contact | [CONFIRM: the definitive data-protection email address. The site currently shows hello@redpoint.property in its page copy and propertymanagement@redpointproperties.uk in its structured data — these need to agree] |
| ICO registration | [CONFIRM: ICO registration number, or confirm registration is still outstanding. Most organisations that process personal data must pay the ICO data protection fee and appear on the public register] |
| Data Protection Officer | [CONFIRM: whether a DPO is required and, if one has been appointed, who] |
3. The personal data we collect
Property owners and their representatives
- Name, postal address, email address and telephone numbers.
- Identity and proof-of-address documents, and confirmation of your right to let the property.
- Details of the property or properties we manage for you, including title, tenure, service charge and ground rent information, mortgage lender consents and insurance details.
- Bank account details for paying rent across to you, and the fees and statements on your account.
- Your correspondence with us, including emails, messages sent through the Owner Portal, and notes of calls and meetings.
- Tax residence and nationality where these affect how rent must be handled — for example under the Non-resident Landlord Scheme.
Tenants, tenancy applicants and guarantors
- Name, contact details, date of birth and current and previous addresses.
- Identity documents and, where the property is in England, the documents needed for a Right to Rent check.
- Employment, income, affordability and referencing information, including credit-reference and landlord-reference results.
- Tenancy documents, deposit records, rent payment history and arrears.
- Maintenance requests, access arrangements, inspection notes and photographs of the property.
Contractors and suppliers
- Contact details, trading details, insurance and certification, and payment details.
Website visitors
- Anything you type into an enquiry form on this site.
- If you have an Owner Portal login: your account details and a session cookie that keeps you signed in.
- [CONFIRM: whether the site runs analytics, advertising or heat-mapping tools. If it does, name them here and the cookie banner must obtain consent before they load]
4. Where we get it from
Most of it comes directly from you. We also receive personal data from:
- Referencing and credit-reference agencies, and previous landlords or employers who give references.
- Property listing portals and other agents, when an applicant enquires about a property.
- Contractors, block managers, freeholders and utility providers, in the course of managing a property.
- Other companies in the Crestbrick Group, where an owner has been introduced to us by them.
- Publicly available sources such as HM Land Registry and Companies House.
5. Why we use it, and our lawful basis
We must have a lawful basis under Article 6 of the UK GDPR for every use of your personal data. Ours are set out below.
| What we use it for | Lawful basis |
|---|---|
| Answering an enquiry and quoting for our services | Steps taken at your request before entering into a contract; or our legitimate interest in responding to people who contact us. |
| Managing a property under a management agreement, including letting it, collecting rent, arranging repairs and reporting to the owner | Performance of our contract with the owner. Where the person concerned is a tenant rather than our client, our legitimate interest in managing the property on the owner’s behalf. |
| Referencing an applicant and running Right to Rent checks | Steps taken before entering into a tenancy; and, for Right to Rent, compliance with a legal obligation. |
| Protecting a tenancy deposit and handling deposit disputes | Compliance with a legal obligation, and performance of the tenancy. |
| Meeting safety and compliance duties — gas, electrical, EPC, fire, smoke and carbon monoxide alarms, licensing | Compliance with a legal obligation. |
| Anti-money-laundering and sanctions checks | Compliance with a legal obligation. [CONFIRM: whether Redpoint is registered with HMRC for anti-money-laundering supervision, and which parts of the business the registration covers] |
| Accounting, tax, VAT and statutory reporting | Compliance with a legal obligation. |
| Keeping records, resolving disputes and defending legal claims | Our legitimate interest in protecting the business, and compliance with a legal obligation. |
| Improving our service, and monitoring the quality of our work | Our legitimate interest in running the business well. |
| Sending marketing about our services | Consent, or our legitimate interest in marketing to existing clients about similar services. You can opt out at any time. |
Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights. You can ask us for our assessment.
6. Sensitive information
We do not set out to collect special category data. Sometimes it reaches us anyway — for example health information in a repair request, or when someone tells us about a disability so we can make reasonable adjustments. Where that happens we rely on your explicit consent, or on the substantial public interest condition in Schedule 1 to the Data Protection Act 2018 [CONFIRM: the specific Schedule 1 condition relied on, with legal advice].
Right to Rent documents show nationality and immigration status. We take copies only where the law requires it, and we keep them for the period the Home Office specifies.
7. Who we share it with
- Contractors and tradespeople — the name, address and contact number needed to attend the property and do the work.
- Property listing portals and marketing channels — property details and photographs when a property is marketed. [CONFIRM: which portals — for example Rightmove, Zoopla, OnTheMarket — and any social channels used for listings]
- Referencing and credit-reference agencies — applicant details, for tenant referencing. [CONFIRM: which referencing provider]
- The tenancy deposit scheme we protect deposits with. [CONFIRM: which scheme, and the membership number]
- Payment, banking and accounting providers — to collect rent, pay owners and contractors, and keep the books. [CONFIRM: the payment provider and the accounting platform — for example Xero — and confirm a written data-processing agreement is in place with each]
- Our software and IT suppliers — the providers who host our systems and email, acting on our instructions as processors.
- Professional advisers — solicitors, accountants, auditors and insurers, where needed.
- Other companies in the Crestbrick Group — where an owner is a shared client and the sharing is necessary to look after them. [CONFIRM: which group entities, and confirm an intra-group data-sharing agreement is in place]
- Freeholders, managing agents and utility and council-tax providers — where a property or a tenancy requires it.
- Public authorities — HMRC, local authorities, the police and the courts, where the law obliges us or a claim requires it.
We do not sell personal data, and we do not share it for anyone else’s marketing.
8. Where your data is stored
Our management platform and its database run on a single cloud server.
[CONFIRM: the cloud provider and the region or country the server and the PostgreSQL database physically sit in. This decides the jurisdiction the data sits under and whether anything below counts as an international transfer — it must be settled before this page is published]
Redpoint works across two locations: property operations in the United Kingdom and client relationships in Singapore. Where personal data is accessed from or transferred to Singapore, that is a transfer outside the UK. Singapore is not covered by UK adequacy regulations, so the transfer needs an approved safeguard.
[CONFIRM: which Crestbrick entity in Singapore holds or accesses the data, and whether an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, together with a transfer risk assessment]
9. How long we keep it
| Record | Retention |
|---|---|
| Enquiries that do not become business | [CONFIRM: proposed 12 months from last contact] |
| Owner management agreements, property files and correspondence | [CONFIRM: proposed 6 years after the agreement ends — the ordinary limitation period for a contract claim under the Limitation Act 1980] |
| Tenancy files, references and deposit records | [CONFIRM: proposed 6 years after the tenancy ends. Deposit records may need to follow the scheme’s own rules] |
| Right to Rent check copies | For the tenancy and then the further period set out in current Home Office guidance. [CONFIRM: the period in the guidance in force at publication] |
| Accounting and tax records | Six years from the end of the accounting period they relate to, as HMRC requires of a company. |
| Anti-money-laundering records | [CONFIRM: five years from the end of the business relationship if the Money Laundering Regulations 2017 apply to this business — confirm they do] |
| Safety certificates — gas, electrical, EPC | [CONFIRM: proposed for the life of the certificate plus 2 years, and longer where a claim is possible] |
| Marketing contacts | Until you unsubscribe, and reviewed [CONFIRM: proposed every 24 months]. |
| Owner Portal account records | [CONFIRM: proposed deletion 12 months after the management agreement ends] |
When a retention period ends we delete the data or anonymise it so it can no longer identify anyone.
10. Your rights
Under the UK GDPR you have the right to:
- Be informed about how we use your data — which is what this notice is for.
- Ask for a copy of the personal data we hold about you.
- Have it corrected if it is wrong or incomplete.
- Ask us to delete it, where we have no continuing reason to hold it.
- Ask us to restrict what we do with it while a question about it is resolved.
- Object to us using it where we rely on legitimate interests, and to object to direct marketing at any time.
- Ask for it to be ported to you or another provider in a machine-readable format, where we hold it on the basis of consent or a contract and process it by automated means.
- Withdraw consent at any time, where consent is what we relied on. That does not affect anything we did before you withdrew it.
To exercise any of these, email [CONFIRM: data-protection email address] or write to us at the registered office. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may need to confirm your identity first.
11. Automated decisions
We do not make decisions about you by automated means alone. Tenant referencing may produce an automated score, but a person always reviews it before any decision is made about a tenancy. [CONFIRM: that this matches how the chosen referencing provider actually works]
12. Cookies
This website uses a cookie to keep you signed in to the Owner Portal. That cookie is strictly necessary, so it does not need your consent.
[CONFIRM: whether any analytics, advertising or third-party embed cookies are in use. If they are, the site needs a compliant cookie banner that loads them only after consent, and this section needs a full cookie table]
13. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right — our complaints procedure explains how.
You also have the right to complain to the Information Commissioner’s Office at any time:
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Helpline 0303 123 1113
- ico.org.uk
14. Changes to this notice
We will update this notice when what we do with personal data changes. The date it was last updated is shown at the top of the page. Where a change matters to you, we will tell you directly.