Data Protection & Client Information Handling Policy

1. Purpose of This Policy

This policy sets out how our agency collects, stores, processes, shares and protects personal data belonging to landlords, tenants, guarantors, contractors, vendors and business partners. It ensures full compliance with UK GDPR, the Data Protection Act 2018, and ICO best-practice guidelines.

2. Scope

This policy applies to:
– All employees, contractors and temporary staff
– All systems, devices and platforms used to process personal data
– All forms of data: digital, paper, emails, photos, ID documents, tenancy contracts, payment information, maintenance records and communications

3. Our Data Protection Principles

We commit to processing data in line with UK GDPR principles: Lawfulness, Fairness & Transparency; Purpose Limitation; Data Minimisation; Accuracy; Storage Limitation; Integrity & Confidentiality; Accountability.

4. Types of Data We Collect

Identification documents, contact details, financial information, references, tenancy documentation, property information, contractor details.

5. How We Store Client Information

Digital Data:
– Password-protected systems
– UK-based or GDPR-compliant cloud
– Role-based access
– MFA where possible
– Regular backups

Paper Documents:
– Locked cabinets
– Restricted access
– No documents left unattended
– Secure destruction when no longer needed

6. Data Sharing

Data may be shared only when necessary with landlords, approved contractors, referencing agencies, deposit schemes, utilities, and legal bodies. Never shared through personal emails or unauthorised channels.

7. Retention Periods

Tenancy agreements: 6 years
Financial records: 6 years
Right-to-rent checks: 1 year after tenancy ends
Complaints: 6 years
Legal claims: until resolved
All data deleted or shredded after retention period.

8. Staff Responsibilities

Staff must keep passwords secure, lock screens, use company devices, follow secure procedures and report issues immediately.

9. Data Breaches

Any loss or unauthorised access must be reported within 24 hours. Serious breaches may require ICO notification within 72 hours.

10. Client Rights

Clients may request access, correction, deletion (where possible), restriction, objection, or data transfer. Response time: 30 days.

11. Training

Annual training required: data protection, cybersecurity, confidentiality and fraud prevention.

12. Policy Review

Reviewed annually or when legislation changes.