Company Registration Number: 05437166
Registered Office: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX
January 2026. Version 1.0

1. Privacy Notice

1.1 Who are we?

ThamesWey Housing Ltd. We can be contacted directly here:
Email: gdprregister@thamesweygroup.co.uk
Tel: 01483 600652

1.2 How we use your information

This privacy notice tells you what to expect when Thameswey Housing Ltd, or its subsidiaries (“Thameswey Housing”), collects personal information. It applies to information we collect about:
• visitors to our websites; and
• applicants for or tenants of our rental/leasehold properties.

2. People who email us

We use Microsoft 365 as our email platform and Transport Layer Security (TLS) to encrypt and protect email traffic wherever possible. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

3. Applicants for, or tenants of, our rental properties and tenants/owners in Thameswey Housing communities

We collect and use personal information about you in the course of providing letting, community and property management services (“the Services”), including our online tenant portal (“the Portal”).

3.1 What information do we collect?

We collect and process the following categories of personal information:

• Identity information: name, date of birth, gender, title, marital status, photograph.
• Contact information: postal address, email address, telephone numbers.
• Financial information: bank account details, payment history, income verification, affordability assessments, credit references.
• Tenancy information: tenancy agreement details, rental payment records, property condition records, maintenance requests, complaints.
• Right to rent information: documentation verifying your right to rent in the UK, including passport details, visa information, or share codes.
• Emergency contact information: details of nominated emergency contacts.
• Household information: details of other occupants, dependents, pets.
• Employment information: employer details, employment status, references.
• Special category data (where necessary and with your explicit consent): information about disabilities or health conditions relevant to property adaptations or emergency evacuation procedures.
• CCTV footage: where CCTV systems are installed and operational at our properties.
• Communication records: records of correspondence, telephone calls, emails, and meetings.

3.2 How do we collect your information?

We collect personal information:

• Directly from you through application forms, tenancy agreements, correspondence, and the Portal.
• From your referees and previous landlords.
• From tenant referencing agencies.
• From credit reference agencies.
• From employers providing references or income verification.
• From the Home Office for right to rent checks.
• From local authorities regarding housing benefit or Universal Credit payments.
• From contractors and service providers managing repairs and maintenance.
• From CCTV systems where installed and operational at our properties.
• From other residents or members of the public who contact us.

3.3 Why do we process your personal information?

We process your personal information for the following purposes:

Pre-tenancy assessment

• To assess your suitability as a tenant.
• To verify your identity and right to rent in the UK.
• To conduct credit and affordability checks.
• To obtain references from previous landlords and employers.
• To comply with our legal obligations under immigration law.

Tenancy management

• To manage your tenancy agreement.
• To collect rent and service charges.
• To respond to repair and maintenance requests.
• To manage anti-social behaviour and tenancy breaches.
• To arrange property inspections.
• To communicate with you about your tenancy.
• To arrange end of tenancy procedures including check-out and deposit return.

Property and community management

• To maintain the building and common areas.
• To ensure health and safety compliance.
• To arrange utilities, metering, and billing (where applicable).
• To manage communal facilities and services.
• To operate and monitor CCTV systems where installed and operational.
• To respond to emergencies affecting the property.

Financial management

• To process rental payments.
• To pursue arrears and recover debts.
• To manage deposit protection through our scheme provider.
• To process housing benefit or Universal Credit payments with local authorities.
• To maintain financial records.

Legal compliance and rights

• To comply with our legal and regulatory obligations.
• To respond to requests from law enforcement or regulatory bodies.
• To defend or pursue legal claims.
• To comply with health and safety legislation.
• To meet tax and accounting requirements.

Service improvement

• To monitor and improve our Services.
• To conduct customer satisfaction surveys.
• To analyse trends and patterns in service delivery.

3.4 What is the legal basis for processing your information?

We process your personal information on the following legal bases:

• Contract: processing necessary for the performance of your tenancy agreement or to take steps at your request before entering into a tenancy.
• Legal obligation: processing necessary to comply with legal obligations, including right to rent checks, deposit protection, health and safety requirements, and responding to court orders.
• Legitimate interests: processing necessary for our legitimate interests in managing our properties, protecting our assets, recovering debts, preventing fraud, and ensuring the safety and security of our properties and residents, provided these interests are not overridden by your rights and interests.
• Vital interests: processing necessary to protect someone’s life, such as in emergency situations.
• Explicit consent: where we process special category data (such as health information for property adaptations), we will obtain your explicit consent.

You have the right to object to processing based on legitimate interests. Please contact us using the details in section 11 if you wish to object.

3.5 Who do we share your information with?

We may share your personal information with:

Service providers and contractors

• Akiko Design Ltd (website design and hosting).
• Buildimage Ltd and other maintenance contractors.
• Evinox Residential (energy metering and billing).
• Thameswey Energy Ltd (energy supply).
• Utility companies (water, electricity, gas, telecommunications providers).
• Worldpay (payment processing).
• The Deposit Protection Service (deposit protection).
• Rightmove (tenant referencing).
• Martin & Co, Bridges Estate Agency, Seymours (letting agents).

Professional advisors

• Shoosmiths and other solicitors providing legal services.
• Accountants and auditors.
• Insurance providers and loss adjusters.
• Surveyors and property consultants.

Public authorities and regulators

• Woking Borough Council, Guildford Borough Council, Spelthorne Borough Council, and any other local authority linked to your tenancy (for housing benefit, Council Tax, planning, licensing, and regulatory matters).
• The Home Office (for right to rent verification).
• HM Revenue & Customs.
• The police and law enforcement agencies.
• The courts and tribunals.
• The Housing Ombudsman and other dispute resolution services.
• The Information Commissioner’s Office.

Other parties

• Prospective landlords (where you provide us as a reference).
• Freeholders (where we do not own the freehold of the property).
• Lenders and financial institutions.
• Debt collection agencies.
• Emergency services.
• Next of kin or emergency contacts in appropriate circumstances.

We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We only permit third parties to process your personal information for specified purposes and in accordance with our instructions.

4. How do we protect your information?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, accessed, altered, or disclosed in an unauthorised manner. We limit access to your personal information to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our website hosting and security infrastructure is managed through Akiko Design Ltd, using Kinsta Inc. for hosting services and Cloudflare integrated into the core infrastructure for security and performance.

5. How long do we keep your information?

We will retain your personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and the applicable legal requirements.

In general, we retain personal information relating to tenancies for a period of 12 years from the end of the tenancy. This reflects the limitation period for claims relating to property and tenancy matters and enables us to defend any legal claims that may arise.

Some information may be retained for longer periods where required by law or where we have a legitimate interest in doing so (for example, in relation to ongoing legal proceedings).

CCTV footage is typically retained for 31 days unless required for a longer period in connection with an incident or investigation.

6. What are your rights?

Under UK data protection law, you have the following rights:

Right of access: You can request a copy of the personal information we hold about you.

Right to rectification: You can ask us to correct any inaccurate or incomplete personal information.

Right to erasure: You can ask us to delete your personal information in certain circumstances, such as where it is no longer necessary for the purposes for which it was collected.

Right to restriction of processing: You can ask us to restrict how we use your personal information in certain circumstances.

Right to data portability: You can ask us to provide your personal information in a structured, commonly used, and machine-readable format, or to transmit it directly to another organisation, in certain circumstances.

Right to object: You can object to our processing of your personal information where we are relying on legitimate interests, direct marketing, or processing for research or statistical purposes.

Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects you. We do not currently use automated decision-making processes.

If you wish to exercise any of these rights, please contact us using the details in section 11. You will not have to pay a fee to access your personal information (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

7. How to complain

If you are unhappy with the way we have used your personal information, you can complain to us by:

Email: gdprregister@thamesweygroup.co.uk

Post: Thameswey Housing Ltd, 27 Old Gloucester Street, London, WC1N 3AX

Telephone: 01483 600652

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can contact the ICO at:

Website: https://ico.org.uk/concerns/

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8. Access to personal information

Individuals can find out if we hold any personal information by exercising their ‘right of access’ under the Data Protection legislation. If we do hold information about you, we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

You also have other rights under the UK GDPR and more information can be found on the website of the Information Commissioner’s Office: ico.org.uk.

To make a request to Thameswey Housing for any personal information we may hold you need to put the request in writing or email to the addresses provided below.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting us using the details below.

9. Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated in January 2026.

Any changes we make to our privacy notice will be posted on this page. Where appropriate, we will notify you by email or through the Portal of any significant changes.

10. How to contact us

If you have any questions regarding this Privacy Policy or the way we use your personal information, you can contact us:

By email: gdprregister@thamesweygroup.co.uk

By post:

Thameswey Housing Ltd
27 Old Gloucester Street
London
WC1N 3AX

By telephone: 01483 600652

You also have the right to complain to the Information Commissioner’s Office. Find out on their website ico.org.uk/concerns

11. Agreement

By continuing to engage with us you are giving us permission to process your personal data specifically for the purposes identified in this privacy notice. Where we are asking you for sensitive personal data we will always seek your consent for this and tell you why and how the information will be used.

You may withdraw consent at any time by contacting us using the details above.