Privacy Notice

The controller

Who controls your information

APHL is the controller for personal information it decides to collect and use in carrying out its letting, property-management and property-acquisition activities. Where we manage a property for somebody else, the property owner or client may separately be a controller for information they receive or use for their own legal, contractual, tax or property-owner purposes.

Information we may use

Depending on how you deal with us, we may use:

• identity and contact information, date of birth and address history;
• household and proposed occupancy information;
• application and guarantor information;
• property-sale enquiry information, including seller or authorised-representative contact details, property details, high-level occupancy information, proposed-sale information and files supplied to us;
• employment, income and affordability information;
• references and tenant-referencing or credit-check results;
• property, occupation-contract or tenancy, rent, deposit and payment information;
• communications and correspondence, including complaints and rights requests;
• repair, maintenance, access and contractor information;
• documents and evidence supplied to us;
• records needed for accounting, legal, regulatory, insurance or property-management purposes; and
• security and technical information generated when our websites or application system are used.

Records may be held electronically or on paper.

Where information comes from

We may obtain information, as relevant, from you; an applicant, guarantor or household member; a property owner or authorised representative; the property owner or client for a managed property; employers, accountants and other referees; current or previous landlords, letting agents or selling agents; tenant-referencing or credit-check providers; contractors and professional advisers; public authorities or regulators; and appropriate publicly available sources.

Purposes and lawful bases

Where we rely on consent for a specific activity, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before it was withdrawn, and consent is not the usual basis for our tenancy and property-management processing.

Special-category information

We do not routinely need to request special-category information. You may sometimes provide information such as health or accessibility information relevant to occupancy, communication, repairs, access or another legitimate request. We will use it only where there is both a lawful basis and an applicable additional condition under data-protection law. Please do not send special-category information unless it is relevant and reasonably necessary.

Whether information must be provided

We will make clear where information is required. If necessary information is not provided, we may be unable to consider an application or property-sale enquiry, complete referencing, arrange a requested service, manage a property effectively or comply with relevant requirements. This does not mean every item we request is required by law.

Sharing information

Where necessary and relevant, we may share personal information with:

• the property owner or client for the relevant property;
• tenant-referencing and credit-check providers, including services accessed through NRLA;
• employers, accountants, landlords, agents and other referees;
• tenancy-deposit schemes;
• contractors and other property-service providers;
• website, application, hosting, storage, email, communications, IT, accounting and other service providers;
• professional advisers, including accountants and solicitors;
• insurers and lenders where relevant;
• local authorities, utilities, regulators, courts and other public bodies where appropriate;
• debt-recovery, tracing or enforcement providers where reasonably necessary; and
• another organisation where required by law or in connection with a legitimate corporate or business transfer.

We do not sell personal information.

International processing

Some service providers may process information outside the UK. Where data-protection law requires it, we ensure an appropriate lawful transfer mechanism is used, such as an applicable UK adequacy regulation or approved contractual or transfer safeguards. You can ask us for further information about safeguards relevant to your information.

Security

We use appropriate technical and organisational measures designed to protect electronic and paper personal information from unauthorised access, loss, misuse, alteration or disclosure. Access is limited to people who reasonably need the information.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it is used. In deciding how long to retain information we take account of the nature of the record, the property-management, occupation or potential-acquisition relationship, applicable legal and regulatory requirements, accounting and tax requirements, limitation periods, insurance and safety requirements, complaints or disputes and the need to establish, exercise or defend legal rights. We periodically review retained information and delete or anonymise it when there is no longer a sufficient reason to keep it.

Unsuccessful application information is normally removed when the letting process has concluded and it is no longer reasonably required. Information relating to a successful applicant or contract-holder may be retained throughout the occupation relationship and for an appropriate period afterwards.

Application decisions

APHL does not make decisions about whether to accept or reject an applicant solely by automated means where that decision would have a legal or similarly significant effect. Referencing or credit-check providers may provide reports, scores or results, which APHL considers as part of its human assessment.

Your data-protection rights

Depending on the circumstances and the lawful basis, you may have rights to obtain access to your personal information; correct inaccurate information; request erasure or restriction; receive certain information in a portable form; object to certain processing; and withdraw consent where processing is based on consent. Not every right applies in every circumstance.

To exercise a right, contact us using the privacy contact details above.

Your right to object

Where we process your personal information on the basis of legitimate interests, you have the right to object to that processing. If you object, we will consider your particular circumstances and will stop the relevant processing unless we have compelling legitimate grounds to continue or the processing is required for the establishment, exercise or defence of legal claims.

Data-protection complaints

If you are concerned about how we have used your personal information, you can make a data-protection complaint using our contact details above.

We will acknowledge receipt of a data-protection complaint within 30 days. We will take appropriate steps to investigate and respond to the complaint without undue delay, keep you informed where appropriate and tell you the outcome of our investigation.

You also have the right to complain to the Information Commissioner’s Office. You can use the ICO’s current complaint service, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Websites, cookies and technical data

The public website does not use advertising or marketing trackers, non-essential analytics cookies or similar non-essential technologies. The application system uses only cookies or storage reasonably necessary for authentication, security, sessions and operation. We therefore do not display a consent banner for the current services.

Standard technical logs and security information may be processed to deliver the websites reliably, protect the services and investigate misuse.