Privacy notice

1. Scope and controller

This notice applies to MCR Property Group, its subsidiaries, special purpose vehicles, operating brands and other group companies that refer to this notice. It also applies where a group company manages a property or service on behalf of another owner, unless a separate privacy notice is provided.

The company that decides how and why your information is used is the controller. Depending on your relationship with the group, this may be one MCR company or more than one company acting as joint controllers. Information about the relevant legal entity is available on request.

This notice covers website visitors, property and acquisition enquiries, buyers, sellers, tenants, residents, occupiers, guarantors, investors, lenders, agents, suppliers, contractors, professional advisers, job applicants, visitors to our buildings and other people who interact with the group.

2. Information collected

The information collected depends on the nature of the relationship and may include:

• Identity and contact information, including names, addresses, email addresses, telephone numbers, dates of birth, identification documents and signatures.
• Property and occupancy information, including tenancy, licence, booking, viewing, guarantor, household, maintenance, utility, access and correspondence records.
• Financial and transaction information, including payment details, rent, deposits, charges, invoices, credit information and details connected with property acquisitions or disposals.
• Business and professional information, including job title, employer, company, professional history, ownership information and communications with agents, advisers, investors and suppliers.
• Recruitment and employment information, including applications, CVs, references, right to work information, interview notes and employment records.
• Technical and usage information, including IP address, device, browser, approximate location, website activity, form submissions and communication preferences.
• Security information, including CCTV images, access records, visitor logs, vehicle registration details, incident reports and building security records.
• Marketing and communications information, including interests, preferences, campaign engagement and opt out records.

Where necessary and lawful, sensitive information may also be processed, including health information, information required for reasonable adjustments, safeguarding, insurance, legal claims, employment obligations, fraud prevention or criminal offence information. Additional safeguards are applied to this information.

3. How information is collected

Information may be collected directly from you, through forms, emails, telephone calls, applications, contracts, viewings, property visits, payments and other interactions. It may also be collected automatically through websites, building systems, cookies, analytics, CCTV and access controls.

Information may be received from group companies, property owners, agents, universities, employers, guarantors, referencing providers, credit agencies, payment providers, public registers, Companies House, professional advisers, contractors, utilities, local authorities, law enforcement bodies and other organisations involved in a transaction or service.

4. How and why information is used

Personal information is only used where there is a lawful basis. These bases may include consent, taking steps before or performing a contract, compliance with a legal obligation, protecting vital interests, legitimate interests, or recognised legitimate interests where applicable.

Where information is required by law or for a contract and is not provided, the group may be unable to proceed with an enquiry, transaction, tenancy, service, application or other relationship.

5. Who information is shared with

Information may be shared only where necessary with:

• MCR Property Group companies, subsidiaries, operating brands and managed entities.
• Property owners, managing agents, letting agents, universities, employers, guarantors and organisations involved in providing accommodation or property services.
• Technology, hosting, CRM, analytics, communications, payment, referencing, security, maintenance and professional service providers.
• Lawyers, accountants, auditors, insurers, brokers, surveyors, consultants, banks, lenders, investors and joint venture partners.
• Potential or actual buyers, sellers, funders or advisers involved in a property or corporate transaction.
• Government departments, councils, regulators, courts, emergency services and law enforcement bodies where required or permitted by law.

The group does not sell personal information. Service providers are required to protect information and use it only for authorised purposes.

6. International transfers

Some service providers and group partners may process information outside the United Kingdom. Where this happens, appropriate safeguards are used, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful transfer mechanism. Further information about safeguards is available on request.

7. Retention and security

Information is retained only for as long as needed for the purpose for which it was collected, including legal, accounting, tax, regulatory, insurance, safety and claims requirements. Retention periods vary according to the relationship, the type and sensitivity of the information and the risk associated with keeping it.

Appropriate organisational and technical measures are used to protect information against loss, misuse, unauthorised access, alteration and disclosure. Access is limited to people who need the information for their work. Procedures are maintained to respond to suspected personal data breaches and notifications are made where legally required.

8. Cookies and marketing

Websites may use essential cookies and similar technologies to operate securely. Analytics, experience and advertising technologies may also be used. Where consent is required, these technologies are used only after consent has been given. Cookie choices can be managed through the controls made available on the website and through browser settings.

Marketing communications may be sent where consent has been provided or where another lawful basis is available and electronic marketing rules permit it. You can opt out at any time by using an unsubscribe link or emailing enquiries@mcrproperty.com. Opting out of marketing does not prevent service, safety or contractual communications.

9. Automated decisions and children

The group does not generally make decisions based solely on automated processing that produce legal or similarly significant effects. If this changes, relevant information about the logic, significance and available safeguards will be provided.

The corporate website is not directed at children. Some group businesses, including student and residential operations, may process information about people under 18 where necessary to provide accommodation, manage safeguarding or comply with law. Appropriate safeguards will be applied.

10. Your rights

Depending on the circumstances, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request erasure of information where there is no lawful reason to keep it.
• Request restriction of processing.
• Object to processing based on legitimate interests and object at any time to direct marketing.
• Request transfer of information where the right to portability applies.
• Withdraw consent at any time, without affecting earlier lawful processing.
• Ask for information about relevant automated decision making.

There is normally no fee for exercising these rights. Reasonable identification may be requested and additional time may be needed for complex or repeated requests. Legitimate requests will usually be answered within one month.

11. Contact and complaints

You may also complain to the Information Commissioner’s Office. The group would appreciate the opportunity to address concerns first, but this does not affect your right to contact the regulator.

12. Other websites and changes

Websites and communications may contain links to services operated by other organisations. Those organisations are responsible for their own privacy practices.

This notice may be updated to reflect changes in law, technology or group operations. The latest version will be published on this page and significant changes may also be communicated directly where appropriate.