Privacy Policy
GCM Management Limited – Privacy Notice (Rentals)
How GCM Management Limited uses your personal data when you rent a property from us
Last updated: 12 May 2026
1. Introduction
This Privacy Notice explains how GCM Management Ltd collects, uses, shares and protects personal data about individuals who are, or may become, tenants, occupiers, guarantors, referees, applicants or visitors to our website in connection with our residential rental services.
We are committed to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Please read this notice carefully so you understand what we do with your information and your rights.
2. Who We Are and How to Contact Us
GCM Management Ltd is the “controller” of your personal data. Our details are:
| Company name | GCM Management Limited |
|---|---|
| Trading address | Cobham House, High Street 380, Cobham, KT11 9EE |
| Companies House number | 09526679 |
| ICO registration number | ZA380949 |
| Admin@greencm.co.uk | |
| Telephone | 07774 234 072 |
| Data protection contact | Admin@greencm.co.uk |
If you have any questions about this notice or how we use your data, please contact us using the details above.
3. The Personal Data We Collect About You
Depending on your relationship with us, we may collect and process the following categories of personal data:
3.1 Identity data
- Full name, title, date of birth, gender, photograph, signature, marital status, nationality, and place of birth.
- Identification documents such as passport, driving licence, biometric residence permit and visa, as required for Right to Rent and anti-money laundering checks.
3.2 Contact data
- Current and previous home addresses, correspondence address, email addresses, and telephone numbers. The information you provide on your application forms.
- Emergency contact details that you provide to us.
3.3 Financial data
- Bank account and payment details, salary, employer, employment status, source of funds, credit reference history, county court judgments, bankruptcies and insolvency information.
- Records of rent payments, arrears, deposits and any debts owed.
3.4 Tenancy and property data
- Details of your application, tenancy agreement, guarantor, references, occupancy details, property condition reports, inventories and check-in/check-out reports.
- Maintenance and repair requests, complaints, correspondence with us and our contractors, CCTV footage where installed (subject to a separate notice), and details of any incidents at the property.
3.5 Right to Rent data
- Copies of immigration documents and follow-up check information required under the Immigration Act 2014.
3.6 Special category data and criminal records data
In limited circumstances we may process “special category” data (for example, information about disability or health where you need reasonable adjustments to the property) and information about criminal convictions (for example, unspent convictions disclosed by a referencing provider). We only process this data where we are required or permitted to do so by law and with appropriate safeguards in place.
3.7 Marketing and communications data
- Your preferences for receiving marketing from us and your communication preferences.
3.8 Technical and website data
- IP address, device type, browser type and version, time zone setting, operating system, location data, and details of how you use our website.
- Cookies and similar technologies.
4. How We Collect Your Personal Data
We collect personal data in the following ways:
- Directly from you, when you enquire about a property, submit an application, complete forms, provide identification, sign a tenancy agreement, communicate with us, or report a maintenance issue.
- From third parties acting on your behalf, such as a relocation agent, employer or family member.
- From third-party providers we instruct, such as referencing agencies, credit reference agencies, fraud prevention agencies, previous landlords or letting agents, accountants, and identity verification providers.
- From publicly available sources such as Companies House, the electoral roll, the Land Registry, and online searches.
5. Why We Use Your Personal Data and Our Lawful Basis
We use your personal data only where we have a lawful basis to do so. The main purposes and bases are summarised below.
| Purpose | Lawful basis |
|---|---|
| To assess your rental application, including referencing, credit checks and affordability checks. | Steps prior to entering a contract; legitimate interests (assessing applicants and protecting our business and property). |
| To enter into and perform the tenancy agreement (or guarantor agreement). | Performance of a contract. |
| To meet our legal obligations, including Right to Rent checks, anti-money laundering, tax reporting, gas safety, electrical safety, fire safety, and tenancy deposit protection. | Compliance with a legal obligation. |
| To collect rent, manage arrears, instruct debt collection agencies and bring or defend legal claims. | Performance of a contract; legitimate interests (collecting sums due and protecting our legal rights); legal obligation. |
| To manage the property, arrange repairs and maintenance, respond to complaints and communicate with you about the tenancy. | Performance of a contract; legitimate interests (managing our properties effectively). |
| To prevent and detect fraud, money laundering and other crime. | Legitimate interests; compliance with a legal obligation. |
| To administer our business, including IT systems, accounting and record-keeping. | Legitimate interests (running our business efficiently). |
| To send you marketing communications about similar properties or services. | Consent (where required) or legitimate interests (where you are an existing tenant or applicant and have not objected). |
| To monitor and improve our website and services. | Legitimate interests. |
| To process special category data (e.g. health) where required for reasonable adjustments. | Explicit consent or another applicable Article 9 condition. |
Where we rely on “legitimate interests”, we have carried out a balancing assessment and consider that our interests are not overridden by your rights and freedoms. You can ask us for a copy of that assessment at any time.
6. Who We Share Your Personal Data With
We share your personal data with the following categories of recipient only where it is necessary for the purposes set out above:
- Referencing and credit reference agencies (e.g. Equifax and letmojo) and fraud prevention agencies.
- Government-authorised tenancy deposit protection schemes (such as the Deposit Protection Service, MyDeposits or the Tenancy Deposit Scheme).
- The landlord of the property and any joint tenants or guarantors.
- Contractors, tradespeople and service providers carrying out maintenance, inspections, inventories, cleaning and similar services at the property.
- Utility companies and the local authority for council tax purposes.
- Our professional advisers, including solicitors, accountants, auditors and insurers.
- Debt collection agencies and the courts where we need to recover sums owed.
- Regulators and authorities, including HM Revenue & Customs, the Information Commissioner’s Office, the Home Office (for Right to Rent), and law enforcement.
- IT and cloud service providers that host our systems.
- Prospective buyers of our business or properties (with appropriate confidentiality protections).
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with our instructions.
7. International Transfers
We primarily store and process personal data within the United Kingdom. Where we transfer personal data outside the UK (for example, to a cloud provider with servers overseas), we ensure that an appropriate safeguard is in place, such as a UK adequacy decision, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. You can request a copy of these safeguards by contacting us.
8. How Long We Keep Your Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements. Our standard retention periods are:
| Type of record | Retention period |
|---|---|
| Unsuccessful application data | Up to 12 months after the application decision. |
| Tenancy agreement and related records (including referencing) | 6 years after the end of the tenancy (in line with the Limitation Act 1980). |
| Right to Rent check records | At least 1 year after the end of the tenancy, in line with Home Office guidance. |
| Anti-money laundering records | 5 years after the end of the business relationship. |
| Financial and accounting records | 6 years plus the current financial year (HMRC requirement). |
| Health and safety records (e.g. gas and electrical certificates) | Minimum 2 years; longer where required by regulation. |
| Complaints and correspondence | 6 years after closure. |
| CCTV footage (where installed) | Typically 30 days, unless required for an incident. |
| Marketing data | Until you withdraw consent or object, or after 3 years of inactivity. |
We may anonymise personal data for statistical or research purposes, in which case we may use it indefinitely without further notice to you.
9. Your Rights
Under data protection law you have the following rights in relation to your personal data. These rights are not absolute and there are exceptions which may apply.
- Right to be informed: to know how we use your personal data – this notice provides that information.
- Right of access: to obtain a copy of your personal data and certain related information.
- Right to rectification: to have inaccurate personal data corrected or incomplete data completed.
- Right to erasure (“right to be forgotten”): to have your personal data deleted in certain circumstances.
- Right to restriction of processing: to limit the way we use your personal data.
- Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format.
- Right to object: to object to our processing where we rely on legitimate interests, and to object to direct marketing at any time.
- Rights in relation to automated decision-making and profiling: we do not currently carry out solely automated decision-making that produces legal or similarly significant effects. Some referencing checks may include automated elements, in which case you have the right to request human review.
- Right to withdraw consent: where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us using the details in section 2. We will respond within one month. There is usually no charge, but we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.
10. Marketing
We may send you information about properties or services we believe will interest you. You can ask us, or any third party we share data with for marketing, to stop sending marketing communications at any time by following the unsubscribe link in any communication or by contacting us. Opting out of marketing will not prevent us from sending you communications relating to the management of your tenancy.
12. How We Keep Your Data Secure
We have put in place appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, encryption in transit, secure storage, staff training, and supplier due diligence. We also have procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner’s Office where we are legally required to do so.
13. Children
Our services are not directed at children. Where a tenancy includes children as occupiers, we may collect limited identifying information (such as name, date of birth and gender) from the tenant or guarantor for the purposes of administering the tenancy.
14. Changes to This Notice
We may update this notice from time to time. The latest version will always be available on our website. Where the changes are material, we will draw them to your attention by email or at the property where appropriate.
15. How to Complain
If you are unhappy with how we have handled your personal data, please contact us first using the details in section 2 so we have an opportunity to resolve the matter. You also have the right to lodge a complaint with the UK supervisory authority:
| Authority | Information Commissioner’s Office (ICO) |
|---|---|
| Address | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
| Helpline | 0303 123 1113 |
| Website | ico.org.uk |
