1. Who we are and what this notice covers

Essential Living (“we”, “us”, “our”) is committed to protecting the privacy and security of the personal data of our residents and applicants (“you”, “your”). This Resident Privacy Notice (the “Notice”) explains how we handle your personal data when you apply to rent a home with us, while you are a resident, and after your tenancy ends. It applies to homes let under both the Essential Living and HomeQuarters brands.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025) (“Data Protection Law”), the data controllers are: Essential Living Management Limited (“ELM”), registered company number 08034947, registered address 11th Floor, 33 Cavendish Square, London, W1G 0PW; and the Essential Living group company with which you sign your tenancy agreement. Please consult your tenancy agreement for details of the relevant group company. In the first instance, please direct any queries to ELM using the details in section 16.

This Notice should be read together with your tenancy agreement and our Website Privacy Notice, which explains how we handle personal data collected through our websites at www.essentialliving.co.uk and www.homequarters.co.uk before you become a resident. If you visited one of our websites before applying, information you provided there may be associated with your resident record. Because both brands are operated by the same company, information may be held in shared systems (including our customer relationship management platform) and used across both brands as described in the Website Privacy Notice; your marketing preferences are always respected on a per-brand basis.

Data Protection Law requires that personal data is: used lawfully, fairly and transparently; collected only for valid purposes that we have clearly explained to you and not used in ways incompatible with those purposes; relevant and limited to those purposes; accurate and kept up to date; kept only as long as necessary; and kept secure. This Notice reflects those principles.

Information about other people

If you provide us with personal data about other people — for example other occupants, guarantors, emergency contacts, or visitors you register through the resident app — you must make sure you are entitled to share it and that the person concerned is aware of this Notice. Where there are multiple occupants on a tenancy agreement, the lead resident usually provides details of the other occupants, and other residents you live with may also provide information about you.

2. Information we collect about you

2.1 If you are a prospective resident

When you enquire about renting with us we collect information such as your name, email address, mobile number, previous landlord details, budget, preferred apartment type, employment status and salary. We may also collect this information about your guarantor(s) and the people you will share with. We use it to help you find a suitable home in one of our buildings, and — in line with your preferences and the rules described in section 7 — to send you marketing.

2.2 In the steps taken before you become a resident

Appendix 1 sets out the documents and information we collect during the application process (including referencing and right to rent checks), why we collect each, and our lawful basis.

2.3 Once your tenancy has started

Appendix 2 sets out the information we collect during your tenancy — for example in connection with building access, internet, utilities, parking, pets, amenity bookings and complaints — why we collect each, and our lawful basis.

2.4 From our websites and the resident app

Our resident app (the Active Building App, provided by RealPage) is available to you once you become a resident. Through it you can access billing information, purchase add-ons, manage your personal details and grant access permissions. Information collected through our websites before you become a resident is handled as described in our Website Privacy Notice and may be associated with your resident record.

2.5 From other sources

We work with third parties who help deliver resident services and who may collect information directly from you and share it with us. These currently include our tenant application and referencing providers (see section 4), RealPage (resident services and management), Curve IT (IT and internet services in our buildings), Stripe (payment services including rent collection), the Tenancy Deposit Scheme (deposit registration), and Align Fitness (gym services). If you found us through a letting agent, we may receive your name and contact details from that agent. We also liaise with the relevant local council about council tax and may receive information from them, and in appropriate circumstances we may receive information from government or other public authorities (for example, HMRC).

During your tenancy we may also collect personal data verbally or via the resident app on day-to-day matters such as maintenance requests, cleaner details or family visits, and may record this information. It is in our legitimate interests to do so — and at times required by law — so that we know who is in our buildings; we always balance this against your privacy rights. Our buildings are staffed overnight by a third-party security provider, whose team members also collect and handle information as described in section 5.

Section 5 explains the CCTV, electronic access control and visitor records that operate in our residential buildings and apply to residents, guests, contractors and other visitors.

3. How we use your information and our lawful bases

Appendices 1 and 2 set out, item by item, what we collect, why, and the lawful basis for each. In summary, we rely on the following lawful bases:

Without certain information we may not be able to progress your application or provide the services you have requested — for example, we cannot grant a tenancy without completing referencing and right to rent checks.

4. Tenant referencing, right to rent and fraud prevention

Before granting a tenancy we verify identity, immigration status (right to rent, as required by law), income, employment and rental history, and screen for fraud. We work with specialist providers to do this, who may collect information from you directly. Our current providers include:

We may update the providers we work with from time to time; an up-to-date list can be provided upon request. Some providers act as our processor, acting only on our instructions. Referencing and fraud prevention providers may act as independent controllers for parts of their work, such as maintaining fraud prevention records, and their own privacy notices (available on their websites) explain how they use your data. The information processed for these checks includes passports, identity cards or driving licences, previous addresses, employment and employer details (including salary), previous landlord details, immigration status and credit check information, and may involve checks against fraud prevention databases.

Where a referencing provider uses automated processing to help assess an application, a decision to decline your application will not be made solely by automated means without human review, unless we tell you otherwise at the time and provide the safeguards required by law, including the right to obtain human intervention, to express your point of view and to contest the decision.

5. CCTV, access control and building security

Our residential buildings operate security systems that process personal data about residents, guests, contractors and other visitors. We describe them here because they apply to everyone who enters our buildings.

CCTV

Internal and external CCTV operates 24 hours a day at each of our residential buildings, covering communal spaces (including kitchens, lounges, gyms, co-working spaces, playrooms and roof terraces), corridors, lifts and lobbies, building entrances and other access points, reception areas, car parks, basements and cycle stores, and plant and storage areas. Cameras are fixed, visible and never covert, and are not pointed at the inside of private dwellings or at sensitive neighbouring areas. Signage is displayed at every access point to each building.

We use CCTV to keep residents, staff and visitors safe; to protect our property and yours; to prevent, detect and investigate crime and unauthorised access; and to monitor health and safety (for example, keeping fire escape routes clear). Live footage is viewed by our Resident Services Teams and by our third-party overnight security provider; recorded footage is retained for up to 31 days (typically 30 days, and 20 days at Berkshire House, depending on system capacity) before being automatically overwritten, unless it is preserved in connection with an incident, a legal claim or a request from the police. We may share footage with the police and other law enforcement bodies, with our insurers and legal advisers in connection with claims, and in response to court orders. Our lawful bases are our legitimate interests in safety, security and the protection of property, and compliance with legal obligations where they apply. You can request a copy of footage of yourself using the contact details in section 16, and we treat any such request — however it is made — as a data subject access request.

Electronic access control and visitor records

Apartment and building doors operate on an electronic fob system. Each fob’s unique serial number is recorded against your name, and the system keeps logs of fob activity, which we use to manage building access, keep the buildings secure and investigate incidents. We also keep records of mechanical keys issued to you (for example for mailboxes and hired storage cupboards), a key logbook at each reception, and records of the access permissions you ask us to set up for other people (such as family members, cleaners or dog walkers).

Guest and contractor information is also recorded: contractors sign in and out at reception and may be issued a temporary pass or fob; guests collecting a fob or requiring access to your apartment in your absence are asked to show identification; and guests staying in the hireable guest apartment at Union Wharf must show identification before fobs are issued. These records are processed on the basis of our legitimate interests in building security and, where relevant, to perform our contract with you.

6. Our use of artificial intelligence

Our staff use enterprise-grade artificial intelligence (AI) tools to support everyday work such as drafting documents and correspondence, summarising information and answering general questions. We only permit the use of AI tools with which we hold enterprise agreements, under contracts that prohibit the provider from using our data to train their models. Our internal policies restrict what may be entered into these tools, and personal data may only be processed in them incidentally and under the same safeguards that apply to our other IT systems.

We do not use AI to make decisions that produce legal or similarly significant effects about you — such as whether to accept your tenancy application, whether to renew a tenancy, or enforcement action. If that ever changes, we will update this Notice first and provide the information and safeguards required by law.

7. Our communications with you

Service communications

We will send you communications from ELM or the group company which owns your development in connection with your tenancy — for example about utilities, maintenance, building management and matters relating to your tenancy specifically. We may also tell you about events or new services in your building as part of our service offering. These are service communications, not marketing, and we will send them even if you opt out of marketing; if there are particular service updates you do not want, let us know and we will accommodate this where we reasonably can.

Marketing communications

Separately, we may send you marketing by email about other Essential Living or HomeQuarters offerings — for example other developments, or invitations to refer a friend — either with your consent or, where permitted, under the “soft opt-in” rules because you have taken our services and were given a clear opportunity to opt out when we collected your details and in every message since. As explained in the Website Privacy Notice, we treat your marketing preferences separately for each brand. You can opt out at any time using the “unsubscribe” link in any marketing email or by contacting us (section 16), without detriment.

8. Who we share your information with

We share your personal data with:

• members of our corporate group (our subsidiaries, our ultimate holding company and its subsidiaries), including the group company which owns your development, who support our processing under this Notice;
• service providers who process personal data on our behalf and on our instructions — including providers of internet services, resident management systems, IT support, communications distribution, marketing list management, feedback and survey services, and our CRM/marketing platform (HubSpot);
• our tenant application, referencing, right to rent and fraud prevention providers (Residently, Homeppl, Let Alliance — see section 4);
• the Tenancy Deposit Scheme (TDS), to register your deposit as required by the Housing Act 2004;
• RealPage, who deliver resident management services (including the Active Building App) on our behalf;
• Curve IT, who deliver IT and internet services in our buildings and will process your name, email address, IP/MAC address and apartment number;
• Align Fitness, who provide gym services in our buildings;
• our third-party security provider, whose team members staff our buildings overnight and monitor CCTV and building access as described in section 5;
• our CCTV and door-entry system maintenance contractors, who service those systems on our behalf;
• Stripe, our payment processing provider (see section 10) — your full payment card details are not shared with us;
• AirCall, who provide our telecommunications solution;
• local authorities, for the purpose of administering your council tax — liability for council tax remains yours under your tenancy agreement, but where possible we will help set up your account by notifying the council of your move-in date, name and address;
• solicitors or lawyers, to enable us to perform and enforce the tenancy agreement;
• prospective sellers or buyers of any business or assets, if we sell or buy any business or assets, or if all or substantially all of our assets are acquired by a third party, in which case personal data will be one of the transferred assets, subject to the terms of this Notice; and
• courts, regulators, law enforcement and other third parties where we are under a duty to disclose your personal data to comply with a legal obligation, to enforce or apply our agreements with you, or to protect the rights, property or safety of ELM, the group company with which you contract, our residents or others — including for fraud protection, credit risk reduction and the prevention of cybercrime.

9. Where we store your information and international transfers

Your personal data is stored on secure servers operated by us or our service providers, located in the United Kingdom, the European Economic Area, the United States of America and Jersey. Some transfers outside the UK take place in order to store your data, to provide services to you and perform our contract with you (including payment processing and support services), to comply with legal requirements, or to facilitate the operation of our group of businesses.

Where your personal data is transferred outside the UK, we ensure it is protected by appropriate safeguards recognised under UK Data Protection Law. Depending on the destination and provider, this is one or more of: a UK adequacy decision (which covers the EEA and Jersey, and certified US organisations under the UK–US Data Bridge); the UK International Data Transfer Agreement (IDTA); or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed. You can contact us using the details in section 16 for more information about the safeguards that apply to a particular transfer.

10. Payment processing

Our payment provider is Stripe. You provide your payment card or bank details directly to Stripe when you make a payment; information you supply to Stripe is subject to Stripe’s own privacy policy. If at the end of your tenancy you are owed a balance greater than your deposit, we will ask you for bank details in order to refund that amount to you.

11. How we protect your information

We apply technical and organisational measures designed to protect your personal data, informed by recognised standards including guidance from the National Cyber Security Centre. These include encryption of data in transit, access controls, and strict procedures and security features designed to prevent unauthorised access. Our services may link to external sites or third-party services; we are not responsible for their privacy practices and encourage you to read their privacy notices.

12. How long we keep your information

We keep personal data only for as long as we need it, and then delete or anonymise it. Our standard retention periods are:

We may retain data for longer where the law requires or permits it, or where needed to establish, exercise or defend legal claims. We may also retain aggregated, anonymised information (from which you cannot be identified) for research and service improvement.

13. Your rights

Under UK Data Protection Law you have the right, in certain circumstances, to:

• request access to your personal data (a “data subject access request”) — to receive a copy of the personal data we hold about you and check we are processing it lawfully
• request rectification of incomplete or inaccurate personal data
• request erasure of your personal data where there is no good reason for us to continue processing it, including where you have successfully objected to processing
• object to processing based on our (or a third party’s) legitimate interests, where your particular situation makes you wish to object — and to object at any time to direct marketing (including profiling for marketing), in which case we will stop
• request the restriction of processing of your personal data, for example while we verify its accuracy or investigate a concern you have raised
• request the transfer of the personal data you provided to us to you or another party in a structured, commonly used, machine-readable format (data portability)
• not be subject to a decision based solely on automated processing which produces legal or similarly significant effects on you, except where the law allows and appropriate safeguards apply (see section 4)
• withdraw your consent at any time and without detriment, where our processing is based on consent — once you withdraw consent we will stop the processing concerned unless we have another lawful basis, which we will explain to you

Certain personal data may be exempt from access, correction or deletion requests under applicable law. You will not normally pay a fee to exercise your rights, but where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to comply. We may need to ask for further information to confirm your identity before responding.

To exercise any of these rights, contact us using the details in section 16. We will respond within the timescales required by law. If you have a concern or complaint about how we handle your personal data, please raise it with us first and we will investigate and respond. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

14. Changes to this Notice

Any substantive changes we make to this Notice in future — for example, changes that significantly affect your rights or, to the extent we are permitted, significantly change how or why we use personal data (including any change to how data is combined or used across the Essential Living and HomeQuarters brands) — will be communicated by email to residents who have signed a tenancy agreement and provided an email address, before the change takes effect where practicable. For non-substantive changes, we will make the updated Notice available on our websites and the resident app, and can supply a copy on request.

15. Other relevant documents

The following documents may also apply to you and are referred to in the appendices: Tenancy Agreement; Prescribed Information; Residents Handbook; Cancellation Policy; Check-out Procedure; Complaints Procedure; Inventory Report; Internet Access Form; Delivery Acceptance Form; Postal Returns Form; Parking Permit Form; Pet Permit Form; Gym Form (formerly the Exercise Facilities Form); Storage Cupboard Form; Private Event Bookings Form; and Notice of Community Violation.

16. Contact us

Questions, comments and requests regarding this Notice are welcomed and should be addressed to:

• Data Protection Lead, Essential Living Management Limited, 11th Floor, 33 Cavendish Square, London, W1G 0PW
• By email: [email protected]

17. Version control

Appendix 1 — Information you give us in the steps taken before becoming a resident

Appendix 2 — Information we collect from you once your tenancy has started