Island Lettings Ltd | Effective September 2026

This Privacy Notice explains how Island Lettings Ltd collects, uses, shares, stores and protects personal information. It applies to tenants and prospective tenants, guarantors, landlords and prospective landlords, contractors and suppliers, property occupants, website users and other individuals whose personal information we process in connection with our lettings and property-management services.

1. Who we are

Island Lettings Ltd is the data controller for the personal information covered by this notice.

• Company number: 06929524
• Address: The Observatory, Westridge Business Park, Ryde, Isle of Wight PO33 1FX
• Telephone: 01983 521112
• Privacy contact: Mark Burton, Managing Director
• Email: mark@islandlettings.co.uk

We process personal information in accordance with applicable UK data-protection law, including the UK GDPR and the Data Protection Act 2018, as amended.

2. The personal information we collect

• Identity and contact information, including names, addresses, telephone numbers, email addresses and dates of birth.
• Identification, right-to-rent, referencing, affordability, employment and income information where relevant.
• Banking and payment information required to administer rent, deposits, fees and payments.
• Landlord and property information, including ownership, insurance, mortgage or consent-to-let information where relevant.
• Tenancy and property-management records, including agreements, correspondence, maintenance reports, inspection records, inventories, check-in and check-out records and photographs.
• Information provided in complaints, disputes, insurance matters, legal proceedings or communications with regulators and public authorities.
• Contractor and supplier information, including contact, payment, insurance and professional or compliance information.
• Technical and website information where collected through our website, systems or service providers.
• Special-category or other sensitive information only where it is necessary and we have an appropriate lawful basis and, where required, an additional condition for processing.

3. Where we obtain personal information

We may obtain personal information directly from you and, where appropriate, from other sources. These may include landlords, tenants or other occupants, guarantors, referencing and identity-verification providers, previous landlords or agents, employers or accountants, contractors and professional advisers, deposit protection schemes, local authorities, utility providers, publicly available sources and other organisations where the disclosure is lawful and relevant to our services.

4. Why we use personal information and our lawful bases

We only process personal information where we have a lawful basis. Depending on the circumstances, this may include performance of a contract or steps taken before entering into a contract, compliance with a legal obligation, legitimate interests, consent where appropriate, protection of vital interests, or another basis permitted by law.

Purpose	Examples	Typical lawful basis
Letting and tenancy administration	Applications, referencing, right-to-rent checks, agreements, communication and tenancy administration	Contract; legal obligation; legitimate interests
Rent, deposits and accounts	Collecting and distributing rent, deposit administration, statements, fees and payment records	Contract; legal obligation; legitimate interests
Property management, repairs and safety	Access arrangements, maintenance, safety checks, contractor instruction and property records	Contract; legal obligation; legitimate interests
Property inspections and condition records	Inspection reports, observations and still photographs	Legitimate interests; contract or legal obligation where applicable
Landlord and contractor administration	Client instructions, ownership/compliance information, contractor records and payments	Contract; legal obligation; legitimate interests
Complaints, disputes, insurance and legal claims	Correspondence, property/tenancy records and relevant evidence	Legitimate interests; legal obligation; establishment, exercise or defence of legal claims where applicable
Fraud prevention and regulatory compliance	Identity, transaction and relevant property or tenancy records	Legal obligation; legitimate interests
Service and business administration	Operational records, systems administration and service improvement	Legitimate interests
Marketing	Relevant contact and preference information	Consent where required; legitimate interests where permitted by law

5. Our legitimate interests

Where we rely on legitimate interests, these may include managing and protecting properties and tenancies; maintaining accurate business and property records; identifying and resolving repairs, safety concerns and deterioration; communicating with landlords, tenants and contractors; preventing fraud, loss or misuse; improving and administering our services; resolving complaints and disputes; and establishing, exercising or defending legal claims.

We consider whether the processing is necessary and balance our interests, and those of relevant third parties such as landlords, against the rights and interests of the people affected. We apply safeguards and data-minimisation measures where appropriate.

6. Property inspections, reports and photography

Where we manage a property, we may carry out periodic property inspections and prepare inspection reports. Still photographs may be taken where reasonably necessary to provide an objective record of the property’s condition, identify maintenance or repair requirements, record deterioration or other relevant matters, compare condition over time and support the proper management of the tenancy and property.

Our lawful basis for this processing will generally be our legitimate interests and/or the legitimate interests of the landlord in effectively managing, maintaining and protecting the property and maintaining appropriate records of its condition.

Because photographs are taken within occupied homes, they may incidentally include personal possessions or other information relating to occupants. We take reasonable steps to minimise unnecessary capture of personal or sensitive information. Photography is not undertaken for the purpose of monitoring a tenant’s private life. Where reasonably practicable, we avoid readable correspondence, financial or medical information, screens, private documents and unnecessary close-up images of personal possessions.

Inspection reports and relevant photographs may be shared with the landlord and, where necessary and proportionate, with contractors, professional advisers, insurers, deposit schemes, courts, regulators or other parties involved in the management, maintenance or protection of the property or the resolution of a dispute.

7. Who we may share personal information with

• Landlords and, where relevant, their authorised representatives.
• Referencing, identity and right-to-rent verification providers and deposit protection schemes.
• Inventory clerks, maintenance contractors, surveyors, safety contractors and other professional service providers.
• Accountants, insurers, solicitors, debt-recovery providers and other professional advisers.
• Utility providers and local authorities where relevant to tenancy administration.
• Courts, law-enforcement bodies, regulators and other public authorities where required or permitted by law.
• IT, property-management, communications, payment and document-storage providers acting under appropriate contractual and security arrangements.

We do not sell personal information.

8. International transfers

Some of our service providers may process personal information outside the UK. Where personal information is transferred internationally, we use an appropriate transfer mechanism and safeguards required by UK data-protection law. Further information about the safeguards applicable to a particular transfer can be requested from us.

9. How long we keep personal information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected, to meet legal or regulatory obligations and to establish, exercise or defend legal claims.

Most core tenancy and property-management records are normally retained for up to six years after the relevant tenancy or management relationship ends. Some records may be retained for a shorter or longer period where the nature of the record, a statutory requirement, an ongoing dispute, complaint or legal claim, or another justified reason requires this.

Inspection reports and photographs are treated as part of the relevant tenancy and property-management record and are retained in accordance with the same principles.

10. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful access, use, alteration, disclosure, loss or destruction. Access is restricted to staff and service providers who need the information for legitimate business purposes and who are subject to appropriate obligations.

11. Your data-protection rights

Depending on the circumstances and the lawful basis relied upon, you may have the right to:

• ask for access to your personal information and receive a copy of it;
• ask us to correct inaccurate or incomplete personal information;
• ask us to erase personal information in circumstances where the right to erasure applies;
• ask us to restrict processing in circumstances where the right to restriction applies;
• object to certain processing, including processing based on legitimate interests;
• receive certain personal information in a portable format where the right to data portability applies;
• withdraw consent at any time where we rely on consent, without affecting processing already carried out lawfully; and
• complain to the Information Commissioner’s Office.

Your right to object

Where we process your personal information on the basis of legitimate interests, you have the right to object on grounds relating to your particular situation. This right is not always absolute. We will consider the circumstances of your objection and may continue processing where the law permits us to do so, including where there are compelling legitimate grounds which override your interests, rights and freedoms or where processing is required for the establishment, exercise or defence of legal claims.

You have an absolute right to object to the use of your personal information for direct marketing.

12. Subject access requests

You may ask whether we process personal information about you and request a copy of that information together with the supplementary information required by law. You do not need to use a particular form or refer to ‘Article 15’ or a ‘subject access request’ for us to recognise a valid request.

We will respond without undue delay and normally within one month of receiving a request. In circumstances permitted by law, the response period may be extended and we will explain this to you. We will not normally charge a fee, although the law permits a reasonable fee or refusal in certain circumstances, including where a request is manifestly unfounded or excessive.

13. Automated decision-making and profiling

We may use third-party referencing or verification services as part of assessing tenancy applications. Where we use solely automated decision-making that produces legal or similarly significant effects, we will provide the information and safeguards required by law, including any applicable right to obtain human intervention, express your point of view and challenge the decision. We do not assume that all referencing activity constitutes solely automated decision-making.

14. If you do not provide information

Some personal information is required so that we can enter into or perform a contract, carry out statutory checks or provide our services. If required information is not provided, we may be unable to progress an application, enter into or administer an agreement, make a payment, instruct work or provide the relevant service. We will explain this where it applies.

15. Complaints and contacting us

If you have a question about this notice, wish to exercise a data-protection right or have a concern about how we have used your personal information, please contact:

Mark Burton, Managing Director

Island Lettings Ltd

The Observatory, Westridge Business Park, Ryde, Isle of Wight PO33 1FX

01983 521112

mark@islandlettings.co.uk

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

16. Changes to this Privacy Notice

We review this Privacy Notice regularly and may update it to reflect changes in law, regulatory guidance, our systems or our business practices. The current version will be published on our website. Where a change involves a new or materially different use of personal information, we will take appropriate steps to bring that change to the attention of affected individuals before the new processing begins where required.

---

This Policy has been approved and authorised by:

Name:	Mark Burton
Position:	Managing Director
Date:	01 September 2026
Due for Review by:	01 September 2027