Bricklane Privacy Notice

1. About this notice

Bricklane Technologies Limited (Bricklane, we, us or our) is committed to protecting and respecting your privacy. This notice explains how Bricklane collects, uses, shares and protects personal data when you interact with us as a tenant applicant, tenant, household member, guarantor, referee, counterparty to a property transaction, or other counterparty in our business activities.

Bricklane provides asset management services to a number of property-owning entities (each, a Property Owner) which together own residential property in the United Kingdom. Where you are a tenant or applicant, the Property Owner of your property is a separate, independent controller of certain of your personal data and is responsible for its own privacy notice and its own processing. This notice covers Bricklane's processing only.

A separate privacy policy applies to retail investors in Bricklane Investment Services Limited products, available at https://bricklaneretail.com/privacy-policy. This notice does not cover that processing.

2. Who this notice applies to

This notice applies to you if you are:

• a current, former or prospective tenant of a property managed by Bricklane;
• an applicant for a tenancy of such a property, and any other occupant or household member named in your application;
• a guarantor or referee in connection with such a tenancy or application;
• a vendor, buyer or other counterparty in a property transaction in which a Property Owner is involved;
• a supplier, contractor or professional adviser to Bricklane; or
• a visitor to our website or a recipient of our communications.

3. Who is the controller?

The controller of personal data described in this notice is Bricklane Technologies Limited (company number 09170265), registered at 19-23 Ironmonger Row, London, EC1V 3QN.

You can contact Bricklane at any time about this notice or your personal data:

• By email: data@bricklane.com
• By post: Bricklane Technologies Limited, 19-23 Ironmonger Row, London, EC1V 3QN

We have appointed a data protection officer (DPO), David Dixon, who can be contacted by emailing data@bricklane.com.

4. Information we collect about you

Depending on your relationship with us, we may collect or receive the following categories of personal data:

Special category and criminal offence data

We do not seek to collect special category data (information about racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health, sexual life or orientation, or genetic or biometric data). We may incidentally receive such information - for example, in a reference from a previous landlord, or as a result of sanctions or PEP checks. Where this happens we rely on the substantial public interest condition in paragraph 10 (preventing or detecting unlawful acts) and/or paragraph 14 (preventing fraud) of Schedule 1 to the Data Protection Act 2018, and we hold an Appropriate Policy Document setting out how we handle such data.

We do not seek to collect data about criminal convictions and offences. We do, however, process information about County Court Judgments (which are civil) as part of the credit and affordability checks carried out on tenancy applicants. Where any criminal-offence data is incidentally collected (for example, via a sanctions hit), we process it under the conditions above.

Some tenants and applicants choose to share information about a disability, a medical condition, or receipt of disability-related benefits - for example, to support their application, to evidence income, or to request modifications to the property or other reasonable adjustments. Where you share this information with us, we will use it only for the purpose you tell us about, and we will rely on your explicit consent (UK GDPR Article 9(2)(a)) and, where applicable, the substantial public interest condition in paragraph 16 of Schedule 1 to the Data Protection Act 2018 (support for individuals with a particular disability or medical condition). You can withdraw your consent at any time, although doing so may affect our ability to arrange or maintain the relevant modifications.

If you do not provide your information

Where we collect your information as part of a tenancy application or property transaction, providing the information is required so that we can process the application or transaction. If you do not provide it, we will be unable to take your application or transaction forward.

5. Where we get your information

We may collect your personal data from the following sources:

• From you directly - when you submit an application (including by uploading information or documents to a tenancy application platform such as Residently), communicate with us, complete an application form, sign a tenancy, or otherwise interact with us.
• From tenancy application platforms - such as Residently, used by us, your letting agent or the property manager to collect application information and coordinate referencing checks. These platforms may also process data for their own purposes as independent controllers; please refer to the relevant platform's own privacy notice.
• From the property manager acting for the Property Owner -  who manages day-to-day tenancy matters and shares tenant data with us in connection with our asset management role.
• From letting agents - where they are involved in marketing a property or directing you to a tenancy application platform
• From credit reference, identity verification, sanctions and PEP screening providers - such as Let Alliance, and any equivalent providers we engage from time to time.
• From guarantors, referees and previous landlords or employers - who supply information to support your application or tenancy.
• From counterparties' advisers - such as your estate agent, conveyancer or other appointed representative in a property transaction.
• From publicly available sources - such as Companies House, the Land Registry, electoral roll and online searches, where relevant to a property transaction or due-diligence check.

6. How and why we use your information

We are only permitted to use your personal data where we have a lawful basis under UK data-protection law. We use your information for the following purposes and on the following bases.

Where we rely on our legitimate interests as a lawful basis below, we have carried out a balancing test and concluded that those interests are not outweighed by your rights and freedoms, taking account of the safeguards described in this notice.

Tenancy applications and asset management

Where you are an applicant, tenant, occupant, guarantor or referee, we use your personal data to:

• assess your application and contribute, with the Property Owner and its property manager, to the decision on whether to grant a tenancy;
• carry out or arrange credit, affordability, identity, right-to-rent, sanctions and PEP checks;
• communicate with you about your application and tenancy;
• liaise with the Property Owner's property manager in connection with the management of the tenancy, including rent, repairs, complaints, disputes and renewals;
• assess and, where appropriate, arrange property modifications or other reasonable adjustments, in line with our and the Property Owner’s duties under the Equality Act 2010, where you have shared relevant disability or health information with us;
• monitor the performance of the property portfolio and make asset management decisions, recommendations and reports for the relevant Property Owner;
• meet our legal, regulatory, accounting, tax and audit obligations (including in relation to anti-money laundering, sanctions and right to rent);
• establish, exercise or defend legal claims.

Our lawful bases for this processing are: (i) taking steps prior to entering into a contract with you, and performance of a contract once a tenancy is in place (UK GDPR Article 6(1)(b)); (ii) compliance with legal obligations (Article 6(1)(c)); and (iii) our legitimate interests under Article 6(1)(f), in particular selecting suitable tenants, performing our asset management role responsibly, preventing fraud, operating our business prudently and reporting to our clients and stakeholders.

Property transactions

Where you are a vendor, buyer or other counterparty in a property transaction involving a Property Owner, we use your personal data to:

• negotiate and complete the transaction;
• verify your identity and complete KYC, AML and sanctions checks;
• communicate with you and your appointed representatives;
• maintain records of the transaction; and
• establish, exercise or defend legal claims arising from the transaction.

Our lawful bases are: (i) taking steps prior to entering into a contract and performance of a contract (Article 6(1)(b)); (ii) compliance with legal obligations, in particular under the Money Laundering Regulations 2017 (Article 6(1)(c)); and (iii) our legitimate interests in completing transactions and preventing fraud (Article 6(1)(f)).

Suppliers, contractors and advisers

Where you act for a supplier, contractor or adviser, we use your personal data to engage and manage the relationship, pay invoices, meet our records and tax obligations, and exercise or defend our legal rights. The lawful bases are Article 6(1)(b), 6(1)(c) and our legitimate interests under Article 6(1)(f).

Website visitors and recipients of communications

Where you visit our website or receive communications from us, we may collect device and analytics data for the purposes of operating, securing and improving our services. The lawful basis is our legitimate interests under Article 6(1)(f) or, where applicable, your consent (Article 6(1)(a)) which you can withdraw at any time.

Automated decision-making

We do not make decisions producing legal effects or similarly significant effects on you solely by automated means. Credit and affordability checks may produce automated scoring or recommendations, but the final decision on any tenancy application is made by a human.

7. Who we share your information with

We share personal data only where it is necessary for the purposes described above, and only with categories of recipient set out below. We do not sell your personal data.

• The owner of your property - in its capacity as legal landlord and as a separate, independent controller of your personal data, together with its parent companies, managers, lenders and their respective advisers, in connection with the ownership and management of the property and related transactions.
• Property managers acting for a Property Owner - Touchstone Corporate Property Services Limited.
• Letting agents - where they are involved in marketing a property or collecting initial application information.
• Credit reference, identity verification, sanctions and PEP screening providers - including Let Alliance and Smart Search.
• Tenancy application platforms - such as Residently, which act as independent controllers of data submitted to them.
• Housebuilders, repair contractors and property inspectors - where they are engaged to carry out inspections, repairs, warranty works or other maintenance at the property.
• Our professional advisers - including lawyers, accountants, auditors, surveyors and tax advisers of Bricklane and a Property Owner.
• Service providers to Bricklane - including providers of email, document management, IT support, hosting, CRM and similar services. These providers act as our processors.
• Authorities and bodies - including tax authorities (HMRC), regulators, law enforcement bodies, government agencies and courts, where we have a duty to share or where it is necessary to establish, exercise or defend legal claims or protect the rights, property or safety of Bricklane, our staff or others.
• On a corporate transaction - if Bricklane, a Property Owner, or any of the properties (or substantially all of the assets of any of them) is acquired or is the subject of a contemplated acquisition by a third party, personal data may be transferred to the prospective buyer and its advisers, subject to appropriate confidentiality arrangements.
• Other recipients with your consent - where you have asked us to share data with a specific third party.

8. International transfers

Bricklane is based in the United Kingdom and most of our processing takes place in the UK. From time to time, our service providers may process personal data outside the UK. Where this involves a transfer of personal data to a country that is not the subject of UK adequacy regulations, we rely on an appropriate safeguard recognised under Article 46 of the UK GDPR - such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another mechanism approved under that Article. Where neither adequacy nor an Article 46 safeguard is available, we will only transfer personal data in reliance on a specific derogation under Article 49 of the UK GDPR. We carry out a transfer risk assessment where required.

You can ask us for further details of any specific transfer by contacting us at data@bricklane.com.

9. How long we keep your information

We keep personal data only for as long as is reasonably necessary for the purposes described in this notice and to comply with our legal, regulatory, accounting and reporting obligations. The indicative periods below apply unless a longer retention period is required by law or is necessary in connection with an open matter (e.g. a complaint or dispute).

At the end of the relevant period, we will securely delete or anonymise the data, or continue to hold it in a restricted form where required by law.

10. Your rights

Under UK data-protection law, you have the following rights in respect of personal data Bricklane holds about you. You can exercise these rights free of charge in most cases by contacting us at data@bricklane.com:

• Right to be informed - you have the right to be told how we collect and use your personal data; this notice fulfils that right.‍
• Right of access - you have the right to ask for a copy of the personal data we hold about you.
• Right to rectification - you have the right to ask us to correct personal data that is inaccurate or incomplete.
• Right to erasure - you have the right, in some circumstances, to ask us to delete personal data we hold about you.
• Right to restriction - you have the right, in some circumstances, to ask us to limit how we use your personal data.
• Right to data portability - in limited cases (broadly, where we process data based on consent or contract and by automated means), you have the right to receive it in a structured, commonly used and machine-readable format.
• Right to object - you have the right to object to certain processing, including processing based on legitimate interests.
• Right to withdraw consent - where we rely on your consent for processing, you can withdraw it at any time; that will not affect the lawfulness of any processing carried out before withdrawal.

These rights are subject to limitations and exemptions under data protection law. We will respond to a valid request within one month, although we may extend that period by up to two further months where requests are complex or numerous. We may need to verify your identity before responding.

To exercise rights against the Property Owner of your property (a separate controller), please contact the Property Owner directly. We can direct you to them on request.

11. How to complain

If you have any concerns about how Bricklane has handled your personal data, please contact us first at data@bricklane.com so that we can try to resolve them. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

• Online: https://ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Cookies and other website tracking

Our website uses cookies and similar technologies for analytics and to make the site work. Full details, including how to manage your preferences, are set out in our separate Cookies notice available on our website.

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites, and we recommend you read their own privacy notices before submitting any personal data to them.

13. Changes to this notice

We may amend this notice from time to time. The version and effective date are shown at the top of this document. The latest version is always available on our website. Where changes are material, we will take reasonable steps to bring them to your attention.

14. Contact us

Questions, comments or requests regarding this notice are welcome and should be addressed to:

• Email: data@bricklane.com
• Data Protection Officer: David Dixon, data@bricklane.com
• Post: Bricklane Technologies Limited, 19-23 Ironmonger Row, London, EC1V 3QN