Last Updated: 16th November 2025
Data Controller: Paladin Property Management Ltd Address: 809 Salisbury House, 29 Finsbury Circus, London, EC2M 7AQ Contact: info@paladin-property.co.uk | 02080 792650 ICO Registration Number: ZB047008
Professional Memberships: We are registered with Property Redress Scheme (PRS) for sales and lettings, The Property Ombudsman (TPOS) for block management services, and The Property Institute (TPI) – Associate Members for block management. These memberships ensure we maintain high professional standards and provide you with access to independent redress schemes should you need to raise concerns about our services.
We are Paladin Property Management Ltd, a property services company providing letting, sales, management, and block management services. This Privacy Policy explains how we collect, use, and protect your personal information in accordance with UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What personal data we collect
We may collect and process the following categories of personal information:
All Clients and Website Users: Full name, date of birth, and contact details (address, phone, email), identification documents (passport, driving licence, utility bills), financial information (bank details, income, credit history, employment details), emergency contact information, communications with us (emails, calls, messages, online forms), website usage data and preferences, and vulnerability information where disclosed to support our services.
Tenants and Prospective Tenants: Previous rental history and landlord references, employment and income verification, guarantor information and details, housing benefit/universal credit information (with consent), right to rent documentation, and inventory and property condition reports.
Landlords and Property Owners: Property ownership documentation, insurance details and claims history, mortgage and financial arrangements, tax information (where relevant to services), and maintenance and repair records.
Buyers and Vendors: Property sale/purchase information, mortgage and financial arrangements, survey and valuation reports, legal representative details, and chain progression information.
Leaseholders (Block Management): Lease documentation and terms, service charge payment history, maintenance requests and communications, insurance claims and building records, and committee participation and voting records.
Guarantors: Financial verification documents, credit check information, employment and income details, and relationship to tenant/applicant.
Special Category Personal Data: In certain circumstances, we may process special category personal data, which requires additional protection under UK GDPR. This may include health information or disability-related requirements for property accessibility, criminal conviction data for Right to Rent checks or landlord references, and information about vulnerable circumstances that may affect housing needs. We will only process special category data where we have your explicit consent, or a legal obligation (such as Right to Rent compliance), or substantial public interest (such as preventing fraud or ensuring building safety). We take extra care to protect this sensitive information and will only share it where legally required or with your explicit consent.
3. Why we collect your information
We process your personal information under the following lawful bases:
Contract (Article 6(1)(b) UK GDPR): Managing tenancy agreements and property lettings, processing property sales and purchases, providing block management services, arranging maintenance and repairs, and processing rental and service charge payments.
Legal Obligation (Article 6(1)(c) UK GDPR): Right to rent checks under Immigration Act 2016, anti-money laundering compliance including PEP (Politically Exposed Persons) checks, UK sanctions list screening as required under OFSI regulations, deposit protection requirements, health and safety obligations, tax reporting requirements, and building safety and fire regulations compliance.
Legitimate Interests (Article 6(1)(f) UK GDPR): Credit and reference checking to assess suitability, debt collection and rent recovery, property marketing and advertising, fraud prevention and security, business administration and record keeping, and CCTV for security purposes.
Consent (Article 6(1)(a) UK GDPR): Marketing communications (where not based on legitimate interests), communication with housing benefit/universal credit, and sharing information with specific third parties beyond contractual requirements.
4. How we use your information
We use your personal information for:
Property Lettings: Assessing tenancy applications and conducting referencing, preparing and managing tenancy agreements, collecting rent and managing payments, arranging property inspections and maintenance, managing deposit protection and returns, resolving tenancy disputes, and sharing tenant information with landlords to facilitate the letting and management of the property.
Property Sales: Marketing properties and matching buyers with sellers, conducting viewings and negotiations, managing offers and chain progression, liaising with solicitors and mortgage providers, and completing sales transactions.
Block Management: Managing service charges and major works, arranging building maintenance and repairs, insurance administration and claims, health and safety compliance, leaseholder communications and meetings, and managing complaints and disputes.
General Business: Providing customer service and support, maintaining business records and accounts, compliance with legal and regulatory requirements, preventing fraud and ensuring security, and business development and improvement.
5. Who we share your information with
We may share your personal information with:
Essential Service Providers: Credit reference agencies and referencing companies, deposit protection schemes (TDS, MyDeposits, DPS), utility companies and local authorities, maintenance contractors and tradespeople, insurance companies and loss adjusters, solicitors and legal representatives, and landlords (for tenant information as part of lettings services).
Financial Services: Banks and payment processors, mortgage lenders and brokers, accountants and tax advisors, and debt collection agencies (where necessary).
Regulatory Bodies: HM Revenue & Customs, local authorities (for council tax, licensing, etc.), property redress schemes (TPO, PRS, etc.), Health and Safety Executive, and Information Commissioner’s Office.
Professional Services: Surveyors and valuers, property management software providers, IT support and secure cloud storage providers (for business administration and marketing purposes), and professional advisors (legal, financial, etc.).
We only share information where necessary for our services, legal compliance, or with your explicit consent. All third parties are required to keep your information secure and confidential.
6. International transfers
We do not routinely transfer personal data outside the UK. Where international transfers are necessary (e.g., secure cloud storage providers for business continuity), we ensure adequate protection through appropriate safeguards including standard contractual clauses and other approved transfer mechanisms in accordance with UK GDPR.
7. How long we keep your information
We retain personal information for the following periods:
Tenancy Records: Successful tenancies – 6 years after tenancy ends, unsuccessful applications – 12 months after application, financial records – 6 years for tax/accounting purposes.
Sales Records: Completed sales – 6 years after completion, unsuccessful sales – 2 years after instruction ends.
Block Management: Service charge records – 6 years, building records – permanently (for building safety), insurance records – 6 years after policy expires.
General Business: Correspondence – 3 years, marketing consents – until withdrawn, CCTV footage – maximum 30 days (unless required for investigations).
We review retention periods regularly and delete information when no longer needed.
8. Your rights under UK GDPR
You have the following rights regarding your personal information:
Right to be Informed: You have the right to know how we use your information (this Privacy Policy).
Right of Access: You can request a copy of the personal information we hold about you.
Right to Rectification: You can ask us to correct inaccurate or incomplete information.
Right to Erasure (‘Right to be Forgotten’): You can request deletion of your information in certain circumstances. Note: This may not apply where we need to retain information for legal compliance.
Right to Restrict Processing: You can ask us to limit how we use your information in certain situations.
Right to Data Portability: You can request your information in a machine-readable format.
Right to Object: You can object to processing based on legitimate interests or for marketing purposes.
Rights Related to Automated Decision Making: We will inform you if we use automated decision-making and provide information about the logic involved.
9. How to exercise your rights
To exercise any of your rights, contact us: Email: info@paladin-property.co.uk, Post: 809 Salisbury House, 29 Finsbury Circus, London, EC2M 7AQ, Phone: 02080 792650. We will respond within one month of receiving your request. For complex requests, we may extend this by up to two months.
10. Complaints
If you’re unhappy with how we handle your personal
information, you can: 1. Contact us directly using the details above 2.
Complain to the ICO: Website: ico.org.uk, Phone: 0303 123 1113, Post:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF.
11. Security
We implement appropriate technical and organisational measures to protect your personal information, including secure IT systems and encryption, access controls and staff training, regular security reviews and updates, secure disposal of documents and data, data stored securely in various formats including Microsoft Office applications (Word, Excel, Outlook), cloud platforms, and physical records, and CCTV monitoring systems for security purposes – we may access and obtain CCTV still images and footage for internal security purposes, which may be provided to points of authority such as police if required for legitimate investigations.
12. Cookies and website tracking
Our website uses cookies and similar technologies to enhance your browsing experience and provide analytics insights. Cookies are small text files stored on your device that help us improve website functionality and user experience, analyse website traffic and usage patterns through services like Google Analytics, remember your preferences and settings, provide targeted advertising and marketing content, and ensure website security and prevent fraud. We use both essential cookies (required for website operation) and non-essential cookies (for analytics and marketing). You can control cookie settings through your browser, though disabling certain cookies may affect website functionality. Website Analytics: We use Google Analytics and similar services to collect anonymised data about website usage, including page views, session duration, and user journey analysis. This helps us improve our services and website performance. For detailed information about specific cookies used, their purposes, and how to manage your preferences, please see our separate Cookie Policy available on our website.
13. Children's personal data
We do not actively seek to collect personal data from children under 16 years of age. However, we recognise that in the lettings process, tenants may voluntarily provide information about children as part of their application (such as for housing benefit calculations, occupancy requirements, or emergency contact purposes). Where information about children is provided, we will only process it where necessary for our legitimate interests in providing lettings services, we will take extra care to protect children’s information, we will not use children’s data for marketing purposes, and parents/guardians can request access, correction, or deletion of their child’s information. If you believe we have inadvertently collected personal data from a child without appropriate consent, please contact us immediately so we can take appropriate action.
14. Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, where feasible, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Our notification to you will include description of the nature of the breach, contact details of our Data Protection Officer, likely consequences of the breach, and measures we have taken or propose to take to address the breach and mitigate its possible adverse effects. We maintain appropriate technical and organisational measures to prevent breaches and have procedures in place to detect, report and investigate any potential incidents.
15. Marketing communications
We may send you marketing communications about our services based on your consent (which you can withdraw at any time) or legitimate interests (for existing clients about similar services). You can opt out of marketing communications by clicking ‘unsubscribe’ in emails, contacting us directly, or updating your preferences.
16. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email notification, website notice, or direct communication. Please check this page regularly for updates.
17. Contact information
Data Protection Officer: Andrew Wright, Managing Director
Email: info@paladin-property.co.uk
Address: 809 Salisbury House, 29 Finsbury Circus, London, EC2M 7AQ Phone: 02080
792650
For general enquiries: info@paladin-property.co.uk
This Privacy Policy was last updated on 16th
November 2025 and is reviewed at least annually to ensure continued compliance
with UK GDPR and Data Protection Act 2018.