Privacy Policy

This privacy notice explains how and why Annington Limited (“we, us, our”), part of the Annington Group of companies (each such company and all such companies together referred to as “Annington”), uses personal data collected through the Annington.co.uk website (the “Website”), about individual visitors to and users of the Website (“you, your”).

You should read this notice, so that you know what we are doing with your personal data.

This notice explains how we use your personal data when you visit or use our Website. Depending on your relationship with us, or Annington more widely, we or Annington may use your personal data for other purposes and one or more other Annington privacy notices may then also apply to such specific uses of your personal data.

Please also read any such other privacy notices from us or Annington.

Annington’s data protection responsibilities

“Personal data” is any information that relates to an identifiable natural person. Your name, address and contact details can be examples of your personal data, if they identify you. We use the term “Sensitive data” to mean ‘special categories of personal data’ (such as personal data revealing details of health, race, or union membership) and/or personal data which amounts to ‘criminal offence/records’ data (such as criminal allegations, charges or outcomes) both terms as being defined in data protection law.

The term “process” means any activity relating to personal data, including, by way of example, its collection, storage, use, transmission and deletion.

We are a "controller" of your personal data. This means that we make decisions about how and why we process your personal data in relation to the operation of our Website and, because of this, we are responsible for making sure it is used in accordance with data protection laws.

Annington Buyer Privacy Notice

Annington Buyer Privacy Notice

What is this document and why should you read it?

The Annington company:
you have purchased or will purchase a property from;
that built or developed a property you have purchased, will purchase, occupy and/or have access to;
that is named on a contract with you; and/or
you are otherwise interacting with,

is a controller of your personal data (and is referred to in this privacy notice as “we”, “us”, “our”).

This privacy notice explains how and why this Annington company, part of the Annington Group of companies (each such company and all such companies together referred to as “Annington”), uses personal data collected about potential, actual and previous buyers of properties owned and/or built or redeveloped by Annington (“Annington Properties”) (including potential, actual and previous buyers of properties built or developed by Annington that did not buy properties directly from Annington), potential, actual or previous occupiers of such properties or individuals who have access to such properties (“you”, “your”).
You should read this notice, so that you know what we are doing with your personal data.
Please note that this privacy notice supplements Annington’s website privacy notice (https://www.annington.co.uk/privacy-policy/) which also sets out how Annington uses your personal data when you use Annington’s website (the “Website”). You should read the Website privacy notice in conjunction with this notice.
This notice explains how we use your personal data when you register an interest or request details about an Annington Property, purchase an Annington Property, occupy or access an Annington Property or when you otherwise communicate or engage with us in relation to an Annington Property. Depending on your relationship with us, or Annington more widely, we or Annington may use your personal data for other purposes and one or more other Annington privacy notices may then also apply to such specific uses of your personal data.
Please also read any such other privacy notices from us or Annington.

Annington’s data protection responsibilities

Please refer to section entitled ‘Annington’s data protection responsibilities’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/

What types of personal data do we collect, and where do we get it from?

We collect and process different types of personal data about you when you use the Website, register an interest or request information about an Annington Property, purchase an Annington Property, occupy or access an Annington Property or where you otherwise communicate or engage with us. We also obtain some personal data from other sources, and create some personal data ourselves.

It is your responsibility to make sure the personal data you provide to us is complete and accurate and you must help us to keep it accurate and up to date. If you have a current or ongoing relationship with us and any of the personal information you have given to us changes, such as your contact details, please inform us without delay by contacting mailto: dataprotection@annington.co.uk.

The table below sets out the different types of personal information that we collect. The details will be collected directly from you but sometimes may be obtained from other sources, such as from other individuals who may or have purchased an Annington Property with you and/or occupy the property with you, from CCTV on site, from the Land Registry or from credit agencies/lenders and/or retained estate agents.
Occasionally, we will use your personal data when it has been provided by a person on your behalf, such as your spouse, partner, a relative, or your other representative e.g. your agent, solicitor or other professional adviser (your “Representative”).

Types of personal data

Prospective, current and previous buyers

Name and Title
Date of birth
Address, Telephone and Email address
Responses to surveys
Purchasing budget (if provided) and whether funds are held for the reservation fee/deposit
Bedroom & furnishing requirements and any other property requirements (if provided)
Preferred method of contact
Reasons for moving
Current housing situation (e.g. if already a homeowner)
Timescales for moving
Job title and working location
Names of potential occupiers
Any pets
Viewing availability and details
Correspondence history, details of queries, complaints and disputes
Party profile (e.g. sharers, couple etc.)
Where you heard about us
Any feedback you provide
Deposit details (requested, paid and/or returned)
Ownership start and end dates
Copy of contracts and agreements
Your testimonial if you provide one
Photographs of you
CCTV images
Vehicle registration
Financial situation and history
Public (electoral register) information
Information on shared credit, financial situation and history and fraud prevention
Data relating to any vulnerability (as defined by the Financial Conduct Authority) which you (or occupiers of the property, which may include persons under the age of 18) may have
If you voluntarily disclose the following types of Sensitive Information (see section 5 below):
Racial or Ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Health Data (which may relate to vulnerability or access)
Your attendance at events arranged by or on behalf of us, and other events which we notify you of (“Events”)
Communications we may have with you, whether relating to an Event or not
Any additional information that you provide to us voluntarily, including (for example) requirements for attendance at Events
Status as a management company member, director and/or company secretary
Information relating to the progression of our sale to you including date of mortgage offer and chain details

Prospective, current or previous occupiers/those that have property access

Name and Title
Address, Telephone and Email address
Availability
Property occupied, responsible tenant and related information about their tenancy
Your testimonial if you provide one
Photographs of you
CCTV images
Vehicle registration
Data relating to any vulnerability (as defined by the Financial Conduct Authority) which you (or other occupiers of the property, which may include persons under the age of 18) may have
If you voluntarily disclose the following types of special category data:

Racial or Ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Health Data (which may relate to vulnerability or access)
Your attendance at events arranged by or on behalf of us, and other events which we notify you of (“Events”)
Communications we may have with you, whether relating to an Event or not
Any additional information that you provide to us voluntarily, including (for example) requirements for attendance at Events
Meter readings at time of moving in

What do we do with your personal data, and why?

We process your personal data for particular purposes in connection with your purchase and/or occupation of or access to one of our Annington Properties and, dependent on such use and your relationship with us, to deal with your enquiry or your communication or other engagement with us, and the management and administration of our business.
We are required by law to always have a “lawful basis” (i.e. a permitted reason or justification) for processing your personal data. The table below sets out the purposes for which we process your personal data and the relevant lawful basis on which we rely for that processing.
Please note that where we have indicated below that our processing of your personal data is either:
necessary for us to comply with a legal obligation; or
necessary for us to take steps, at your request, to potentially enter into a contract with you, or to perform it,
and you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our contract or engagement with you.

		Lawful basis
	Purposes of processing	Your consent	To perform a contract with you	To comply with a legal obligation	For our legitimate interests
	Communications with you
a)	Responding to your requests, enquiries and/or customer complaints, including sending you details of properties you have requested		✔	✔ (where mandatory for us to do so by law)	✔ (to respond to you in relation to such matters)
b)	Confirming and processing property purchases or other orders for goods or services that you may make with us		✔ (for property sales to you)		✔ (to conclude property sales involving other buyers)
c)	Sending you information (including direct marketing) as set out in the section “How do we communicate with you?”, below	✔ (direct marketing information where we need your consent)	✔ (keeping you updated on the transaction)		✔ (to keep you updated on transactions, orders and with other helpful updates and direct marketing in other cases)
	Background and Identity Check Information
d)	Performing know your client and anti-money laundering checks in relation to transactions			✔	✔ (to ensure compliance with anti-money laundering requirements and good governance)
e)	Performing identity checks in relation to certain transactions			✔	✔ (to ensure that the identity of our customers is verified)
f)	Performing credit checks in relation to transactions	✔			✔ (to make sure that those purchasing from us have the necessary funds and commitment to pay, to ensure we are paid)
	The property
g)	To find the right property for you		✔ (if you contract with us as an individual)		✔(where you represent your employer or organisation, or a buyer who contracts with us)
h)	To deal with your requested or agreed property purchase to complete the transaction with you		✔ (if you contract with us as an individual)		✔ (where you represent your employer or organisation, or a buyer who contracts with us)
i)	To deliver goods or services to you or the business you represent, to deal with any complaints or any after sales services		✔ (if you contract with us as an individual)		✔ (where you represent your employer or organisation, or a buyer who contracts with us)
j)	Arranging appointments and organising access to property for maintenance and repair purposes, including obtaining and using occupier details		✔ (if you contract with us as an individual)		✔ (where the occupier has not purchased the property from us)
k)	To carry out checks to identify potential fraudulent transactions, to prevent and detect crime and protect genuine customers and our business from fraud to minimise the risk of false details being used, and abuse of card / other details by fraudsters		✔		✔ (to protect our business, other buyers and the public from fraud and crime – this is also in the public interest)
l)	To administer your membership and/or status as a director/company secretary of a management company and work with you in your capacity as a member/ director/ company secretary				✔ (to ensure the smooth running of management companies and our relationship with them and you)
All categories
m)	To host Events	✔ (where Sensitive Information (see section 5 below) is provided by you voluntarily e.g. dietary or access requirements)			✔ (to host prospective/current tenants/occupiers to discuss property interests)
n)	Establishing and enforcing our legal rights and obligations and monitoring to identify and record fraudulent activity			✔	✔ (to protect our business, other buyers and the public from fraud and crime – this is also in the public interest and may be needed to deal with legal claims)
o)	Complying with requests, orders and instructions from law enforcement agencies, regulators, any court, parties to proceedings or otherwise deal with obligations required by law or regulators and to ensure good governance and compliance			✔ (where binding)	✔ (where not binding but good governance and in the public interest)
p)	For our general record-keeping and relationship management		✔ (if you contract with us as an individual)		✔ (where you represent your employer or organisation, or a buyer who contracts with us and we need this to run our business properly)
q)	Managing the proposed sale, restructuring or merging of any or all part(s) of our business, including to respond to queries from the prospective buyer or merging organisation				✔ (to sell any part of our business)
r)	To keep records required by law or to evidence our compliance with laws, including tax laws, consumer protection laws and data protection laws.			✔	✔ (including compliance with related regulatory guidance and best practice)
s)	Resolving any complaints from or disputes with you		✔ (if with you as an individual)		✔ (to try and resolve any complaint or dispute you might raise with us and to deal with legal claims)
t)	Personal safety and security and to safeguard the property			✔	✔ (CCTV in operation, for personal safety and security purposes)
u)	For our marketing purposes			✔	✔ (to showcase our properties and/or your experience with us)

We may also convert your personal data into statistical or aggregated form to better protect your privacy, or so that you are not identified or identifiable from it. Anonymised data cannot be linked back to you. We may use it to conduct research and analysis, including to produce statistical research and reports.

Sensitive Information
- Please see the section entitled ‘sensitive information collected through the website’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/.
- Some of the processing described in the above table will include the processing of ‘special categories of personal data’ and/or sensitive personal data (together, “Sensitive Information” – as set out in the table at paragraph 3, above). This refers to sensitive or special categories of personal data which we are required to process with more care, according to applicable laws.
- We will only process Sensitive Information in relation to you:

in respect of access to property or reasonable adjustments, where this is required by law or with your explicit consent;

in respect of Events, with your explicit consent;

in relation to any vulnerability (as defined by the Financial Conduct Authority) which an individual (or occupiers of the property, which may include persons under the age of 18) may have; or

in relation to right to rent checks, some information you provide (for example, a copy of your passport) may include Sensitive Information, such as information that reveals your race and/or ethnic origin.

Who do we share your personal data with, and why?

Sometimes we need to disclose your personal data to other people.
From time to time we may ask third parties or other Annington Group companies to carry out certain business functions for us, such as property management, property maintenance, agency services and IT support. These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties so that they can perform those functions. Before we disclose your personal data to these third parties, we will seek to ensure that they have appropriate security standards in place to protect your personal data. Examples of these third party service providers include our providers of IT systems software and maintenance, back up, and hosting services.

In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right (for the purposes set out above). Please see the section entitled ‘who do we share your personal data with, and why?’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/. In addition, we may also share your personal data with the following third parties:

to Event organisers in relation to your attendance (or apologies) for an Event;
utilities companies or other entities who provide utilities services to the relevant property or other public bodies, where required for utilities payment arrangements or confirming change of ownership;
management companies

Where in the world is your personal data transferred to?

Please see the section entitled ‘where in the world is your personal data transferred to?’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/.

How do we keep your personal data secure?

We will adopt security measures to provide appropriate protection for your personal data from unlawful or unauthorised processing and accidental loss, destruction or damage.

How long do we keep your personal data for?

Please see the section entitled ‘how long do we keep your personal data for?’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, and any applicable laws or regulations.

We may in the future implement retention guidelines (and include a link to them here) which will set out further details about the period for which we keep records of your personal data. Please check back here from time to time if you would like to know more about retention.

How do we communicate with you

Please see the section entitled ‘how do we communicate with you’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/.

What are your rights in relation to your personal data and how can you exercise them?

Please see the section entitled ‘what are your rights in relation to your personal data and how can you exercise them?’ in the Website privacy notice: https://www.annington.co.uk/privacy-policy/.

Updates to this notice

We may update this notice from time to time to reflect changes to the type of personal data that we process and/or the purposes for which and/or the way in which it is processed. We encourage you to check this notice on a regular basis.

Where can you find out more?

If you want more information about any of the subjects covered in this privacy notice or if you would like to discuss any issues or concerns with us, you can contact us in any of the following ways:

By email at: Dataprotection@annington.co.uk

By telephone at: 020 7960 7500

By post at: The Data Protection Lead, Hays Lane House
1 Hays Lane, SE1 2HB, London

July 2023

What types of personal data do we collect through our Website and where do we get it from?

We collect and process different types of personal data about you when you visit our Website, or where you otherwise communicate or engage with us.

The table below sets out the different types of personal information that we collect when you visit or use our Website. The details will be collected directly from you but sometimes through the device you use to access our Website and/or your browser (such as the details of your device, its IP address and screen size) and where explained in our cookies policy below (subject, where relevant, to your prior consent), from cookies deposited on your device when you visit our Website.

Occasionally, we will use your personal data when it has been provided by a person on your behalf when using our Website, such as your spouse, partner, a relative, or your other representative e.g. your agent, solicitor or other professional adviser (your “Representative”).

Website collection of types of personal data

IP address, other online identifiers and details about your browser and device (“Communication Data”)
User names, passwords and other log-in information (as applicable)
Subject to our cookies policy and, where relevant, your consent to cookies, details of your online browsing activities on our Website, such as the pages or areas of our Website that you visit
Your account settings including any default preferences and any preferences we have observed.
Any Sensitive Information you or your Representative chooses to share with us.

What do we do with your personal data collected through the Website and why?

We process your personal data for particular purposes in connection with your use of our Website and, dependent on such use and your relationship with us, to deal with your enquiry or your communication or other engagement with us, and the management and administration of our business.

We are required by law to always have a “lawful basis” (i.e. a permitted reason or justification) for processing your personal data. The table below sets out the purposes for which we process your personal data and the relevant lawful basis on which we rely for that processing.

Please note that where we have indicated below that our processing of your personal data is either:

necessary for us to comply with a legal obligation; or

necessary for us to take steps, at your request, to potentially enter into a contract with you, or to perform it,

and you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our contract or engagement with you.

		Lawful basis
	Purposes of processing	Your consent	To perform a contract with you	To comply with a legal obligation	For our legitimate interests
	Communications with you
a)	Responding to your requests, enquiries and/or customer complaints, including sending you details of properties you have requested		✔	✔ (where mandatory for us to do so by law)	✔ (to respond to you in relation to such matters)

b)	Sending you information (including direct marketing) as set out in the section “How do we communicate with you?”, below	✔ (direct marketing information where we need your consent)	✔ (keeping you updated)		✔ (to keep you updated on transactions, orders and with other helpful updates and direct marketing in other cases)

	Website Information
c)	Ensure the proper operation and performance of the Website (please also see our Cookies Policy)	✔	✔	(to record cookie consent state)	✔ (to ensure the Website functions correctly)
d)	To improve the functionality of the Website				✔ (to keep the Website up to date and improve its functionality for your benefit )
e)	To enable you to create accounts and log-in to them via the Website		✔		✔ (to grant you access to a private log-in where you can securely and easily access information relevant to you)





	All categories
f)	Establishing and enforcing our legal rights and obligations and monitoring to identify and record fraudulent activity			✔	✔ (to protect our business, other buyers and the public from fraud and crime – this is also in the public interest and may be needed to deal with legal claims)
g)	Complying with requests, orders and instructions from law enforcement agencies, regulators, any court, parties to proceedings or otherwise deal with obligations required by law or regulators and to ensure good governance and compliance			✔ (where binding)	✔ (where not binding but good governance and in the public interest)
h)	For our general record-keeping and relationship management		✔ (if you contract with us as an individual)		✔ (where you represent your employer or organisation, or a buyer or tenant who contracts with us and we need this to run our business properly)
i)	Managing the proposed sale, restructuring or merging of any or all part(s) of our business, including to respond to queries from the prospective buyer or merging organisation				✔ (to sell any part of our business)
j)	To keep records required by law or to evidence our compliance with laws, including tax laws, consumer protection laws and data protection laws.			✔	✔ (including compliance with related regulatory guidance and best practice)
k)	Resolving any complaints from or disputes with you		✔ (if with you as an individual)		✔ (to try and resolve any complaint or dispute you might raise with us and to deal with legal claims)

Twitter

Annington has a Twitter feed on its Website, which displays tweets posted by Annington, and tweets that Annington has retweeted. These tweets may contain individuals’ personal data.

If a tweet on the Website Twitter feed contains your personal data and you are not happy with it appearing on the Website’s Twitter feed, please contact us using the contact details at the end of this privacy notice, and we will remove the retweet (subject to any Twitter limitations that prevent us from doing so).

Sensitive Information collected through the Website

If volunteered by you or your Representative, some of the processing described in the above table will include the processing of Sensitive Information, which we are required to process with more care in order to meet our legal obligations.

We will only process your Sensitive Information for the reasons explained above and either with your explicit consent or for meeting our legal obligations, such as making reasonable adjustments to how we deal with you.

Who do we share your personal data with, and why?

Sometimes we need to disclose your personal data to other people.

From time to time we may ask third parties or other Annington Group companies to carry out certain business functions for us, such as the administration of our Website and IT support. These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties so that they can perform those functions. Before we disclose your personal data to these third parties, we will seek to ensure that they have appropriate security standards in place to protect your personal data. Examples of these third party service providers include our providers of IT systems software and maintenance, back up, and hosting services.

if we buy or sell our business (or part of it) in connection with a share or asset sale, we may disclose or transfer your personal data to the prospective seller or buyer and their advisors; and
if we need to disclose your personal data in order to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our employees, customers or others.

We have set out below a list of the categories of recipients with whom we are likely to share your personal data:

IT support, Website and data hosting providers and administrators;
your Representative, or (if you are a Representative) the individual(s) you represent;
consultants and professional advisors including legal advisors, auditors and accountants;
courts, court-appointed persons/entities, receivers and liquidators;
business partners and joint ventures;
insurers; and/or
governmental departments, statutory and regulatory bodies including (in the UK) the Information Commissioner’s Office, the police and Her Majesty’s Revenue and Customs.

Where in the world is your personal data transferred to?

Annington is UK based and the majority of our processing of your personal data takes place within the UK. However, some of our service providers (please see above) may have processing operations in other jurisdictions and in those cases your personal data can be transferred to recipients outside the UK.

Although data protection laws in some jurisdictions may not provide the same level of protection for your personal data as is provided under the laws in the United Kingdom, we will only transfer your personal data abroad as permitted by law. This includes allowing transfers:

to a country which is recognised as already ensuring an adequate level of protection applies to personal data;
where appropriate safeguards are put in place with the recipient to protect your personal data, such by use of the official approved standard contractual clauses used for this purpose (called the International Data Transfer Agreement, or the UK Addendum) - please contact enquiries@annington.co.uk if you wish to obtain a copy of these;
where the transfer is necessary for a permitted reason specified in data protection law; or
where you consent to the transfer.

How do we keep your personal data secure?

We will adopt security measures to provide appropriate protection for your personal data from unlawful or unauthorised processing and accidental loss, destruction or damage.

How long do we keep your personal data for?

We will only retain your personal data for a limited period of time and for no longer than is necessary for the purposes for which we are processing it.

Your personal data may be retained following completion of such processing where permitted by law, including:

to comply with any applicable laws or regulations;
to deal with any legal or other type of dispute; and
where we are asked by you or a regulatory authority to keep your personal data for a valid reason.

How do we communicate with you

We may use your personal data in order to contact you in relation to your interactions with us, services, promotions and/or offers which may be of interest.

In each case, such communications will be based on our legitimate interest and you will have the right to opt-out of receiving marketing communications from us at any time.

To the extent that we send any other direct marketing to you (on a business to consumer basis), we will ensure that we have a lawful basis and provide you with the opportunity to opt-out of receiving such communications where we rely on legitimate interest, or (where necessary) obtain your explicit consent.

Cookies

Please see our separate Cookies Policy.

What are your rights in relation to your personal data and how can you exercise them?

Where our processing of your personal data is based on your consent (please see above), you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we are relying on – in which case, we will let you know.

Where our processing of your personal data is based on the legitimate interests (please see above), you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Where we are processing your personal data for direct marketing purposes, you have the right to object to that processing. This will not affect our need to keep in touch with you for non-marketing reasons, such as when we are dealing with a request by you or query from you.

You have the right (subject to applicable laws and certain limitations) to:

access your personal data and to be provided with certain information in relation to it, such as the purpose for which it is processed, the persons to whom it is disclosed and the period for which it will be stored;
require us to correct any inaccuracies in your personal data without undue delay;
require us to erase your personal data;
require us to restrict processing of your personal data;
receive the personal data which you have provided to us, in a machine readable format, where we are processing it on the basis of your consent or because it is necessary for your contract with us (please see the tables above) and where the processing is automated; and
object to a decision that we make which is based solely on automated processing of your personal data (however, we do not currently conduct any such decision making).

You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK’s data protection regulator. More information can be found on the Information Commissioner’s Office website at https://ico.org.uk/.

Updates to this notice

We may update this notice from time to time to reflect changes to the type of personal data that we process and/or the purposes for which and/or the way in which it is processed. We encourage you to check this notice on a regular basis.

Where can you find out more?

If you want more information about any of the subjects covered in this privacy notice or if you would like to discuss any issues or concerns with us, you can contact us at 1 James Street, London, W1U 1DR or via enquiries@annington.co.uk.

1 July 2022

Add-On Privacy Policies

For specific details information explaining how and why Annington Management Limited (also referred to as “Annington”, “we”, “our” and “us”) uses personal data about different type of stakeholders, please refer to the add-on privacy notices below.

Add On Privacy Notice Buyers (July 2023)

Add On Privacy Notice Candidates (Final June 2023)

Add On Privacy Notice Employees (Final June 2023)

Add On Privacy Notice External Partners (July 2023)

Add On Privacy Notice Investors (Final June 2023)

Add On Privacy Notice Other (July 2023)

Add On Privacy Notice Sole Trader (Final July 2023)

Add On Privacy Notice Tenants (Final October 2023)