Privacy Notice

Privacy at a glance

This notice explains how ARC Property & Lettings Management Ltd uses personal information when providing lettings and property management services. It is written for the people we deal with in practice, including applicants, tenants, permitted occupiers, guarantors, landlords, prospective landlords, contractors and other people connected with a property or tenancy.

Who controls your information. ARC is responsible for the personal information it uses for its own lettings and management functions. A landlord will usually be a separate data controller for information they use for their own landlord purposes. We share information between ARC and a landlord only where there is a lawful and relevant reason to do so.

Why we use it. We use information to handle enquiries and viewings, assess applications and references, carry out Right to Rent and other compliance checks, prepare and manage tenancies, administer rent and deposits, arrange repairs and inspections, communicate with landlords and tenants, deal with complaints, prevent fraud and meet legal or regulatory duties.

What we do not do. Signing a tenancy agreement is not blanket consent for ARC to use information however it wishes. We do not sell personal information. We do not use health, disability or other sensitive information for unrelated marketing or to make unfair tenancy decisions.

Your rights. You can ask us about the personal information we hold, request corrections and exercise other data protection rights where they apply. You can also make a data protection complaint directly to ARC and complain to the Information Commissioner's Office (ICO).

1. Who we are and how to contact us

ARC Property & Lettings Management Ltd, company number 17387187, trading as ARC Lettings & Property Management (ARC, we, us or our), is the data controller for the personal information covered by this notice where ARC decides why and how that information is used.

Where ARC acts for a landlord, the landlord and ARC will normally be separate controllers for their respective functions rather than one organisation controlling all information together. If a particular arrangement is different, we will explain that where required.

2. Who this notice covers

This notice applies where we process personal information about:

• prospective tenants, applicants, tenants, permitted occupiers and other adult residents;
• guarantors and people who pay money or provide information on another person's behalf;
• landlords, prospective landlords and property owners;
• contractors, cleaners, inventory providers, tradespeople and other suppliers;
• people who contact us about a property, repair, complaint, enquiry or other lettings matter.

Children may be recorded as permitted occupiers where this is relevant to occupancy, housing, licensing, safety or tenancy administration. We do not collect more information about children than we reasonably need for those purposes.

3. The personal information we use

3.1 Identity and contact information

Names, addresses, dates of birth where needed, email addresses, telephone numbers, signatures, identification documents, proof of address and information needed for Right to Rent or other identity checks.

3.2 Application, referencing and affordability information

Employment and income information, affordability information, previous addresses, landlord or employer references, credit or referencing outcomes, guarantor details and information supplied to explain an application or reference result.

3.3 Tenancy, property and management information

Tenancy terms, permitted occupiers, pet information, rent and deposit records, keys and access records, meter readings, inventory and checkout records, repair reports, contractor visits, complaints, notices and correspondence. Inspection or repair photographs may incidentally show personal belongings; ARC will try to limit photographs to relevant property-condition or management evidence.

3.4 Financial and payment information

Bank or payment details, rent and deposit payment records, arrears information, landlord payment details, invoices and transaction records. We do not ask tenants to send full card details by ordinary email or message.

3.5 Compliance, legal and safety information

Right to Rent evidence and check results, property-safety and licensing records, deposit-protection information, tax or Non-Resident Landlord Scheme information where relevant, fraud-prevention records, complaint and redress records, and information needed to establish, exercise or defend legal rights. We do not routinely collect criminal-offence data. If we need to process it, we will only do so where UK data protection law permits and any additional condition required by the Data Protection Act 2018 is met.

3.6 Health, disability and other sensitive information

You may tell us about a disability, health condition, accessibility need, vulnerability or emergency circumstance so that we can consider an adjustment, communicate appropriately, arrange safe access or respond to an urgent situation. Health and some disability information is special category data. Our Article 6 basis will usually be legitimate interests or a legal obligation where applicable. For the additional Article 9 condition, we will normally rely on your explicit consent where that is appropriate and freely given; in a genuine emergency where you are physically or legally incapable of giving consent, vital interests may apply; and information may be used where necessary to establish, exercise or defend legal claims. We do not use special category data for unrelated marketing.

4. Where we get personal information from

We may receive information:

• directly from you, including through enquiries, forms, email, telephone, electronic signature or in-person contact;
• from a joint applicant, joint tenant, guarantor, landlord, previous agent, employer or referee where they are legitimately involved;
• from referencing, identity and Right to Rent providers and from the Home Office checking route where used;
• from the Deposit Protection Service (DPS) or another approved tenancy deposit scheme used for a tenancy;
• from contractors, inventory providers, utilities, councils, insurers, professional advisers, courts, regulators or law enforcement where relevant and lawful;
• from public or official sources, such as Companies House, HM Land Registry or other property and ownership records, where ARC needs to verify a property, owner or business contact or where we lawfully contact prospective landlords.

If we obtain your information from somewhere other than you, we will provide the required privacy information within the applicable timeframe unless an exemption applies. Where ARC uses public property or company records to identify a prospective landlord, our first direct contact will explain why we are contacting you, identify the source or category of source, tell you how to access this notice and provide a clear way to opt out of further marketing.

5. Why we use personal information and our lawful bases

ARC only uses personal information where it has a lawful basis. Consent is not the basis for ordinary tenancy administration simply because somebody signs a tenancy agreement.

5.1 Our legitimate interests

Where we rely on legitimate interests, those interests include running a responsible lettings and property management business, protecting people and property, maintaining accurate records, preventing fraud, managing disputes and communicating effectively with people involved in a tenancy or property. We consider whether those interests are outweighed by your rights and reasonable expectations before relying on this basis.

5.2 Consent

Where we genuinely rely on consent, you may withdraw it at any time by contacting us. Withdrawing consent does not make earlier lawful processing invalid and does not affect processing carried out under another lawful basis.

5.3 When you need to provide information

Some information is needed to take steps towards a tenancy or management arrangement, to perform an agreement, or to comply with legal duties. For example, adults who require a Right to Rent check must provide or enable the prescribed evidence or checking route, and we need enough identity, contact, payment and property information to administer a tenancy or management service. If required information is not provided, we may be unable to assess an application, proceed with a tenancy or provide the relevant service. We will not require information that is not reasonably necessary for the stated purpose.

6. Who we share personal information with

We only share information that is reasonably necessary for the relevant purpose. Depending on the matter, recipients may include:

• the landlord or property owner, and where necessary a joint tenant, applicant or guarantor; one joint tenant is not automatically entitled to every piece of another person's private information;
• referencing, affordability, identity and Right to Rent service providers;
• the Deposit Protection Service (DPS) or another approved deposit scheme;
• banks, client-money account providers, Client Money Protection providers and payment providers where ARC is authorised to use them;
• contractors, cleaners, inventory clerks, locksmiths and other property-service providers where access or work needs to be arranged;
• local authorities, utilities, HMRC, the Home Office, regulators, redress schemes, courts, tribunals or law-enforcement bodies where there is a lawful reason;
• insurers, solicitors, accountants, debt-recovery providers and other professional advisers where needed;
• email, cloud-storage, electronic-signature, telephony and other IT providers that support ARC's operations.

Some organisations will process information on ARC's instructions as service providers. Others, such as a landlord, deposit scheme, council, utility supplier, bank or regulator, may be independent controllers with their own legal duties and privacy information. ARC does not sell personal information.

7. International transfers

ARC is based in the United Kingdom. Some technology or service providers may store or process information outside the UK. Where a restricted international transfer occurs, ARC will use a lawful transfer mechanism and appropriate safeguards, such as UK adequacy regulations or approved contractual safeguards. You can ask us for further information about the safeguards relevant to your data.

8. How long we keep information

We keep information only for as long as we reasonably need it for the purpose for which it was collected, to comply with legal or regulatory duties, and to deal with complaints or claims. Our normal approach is:

These periods are guides rather than promises to keep every record for the full period. We may delete information sooner when it is no longer needed, or keep particular information longer where law, litigation, a regulatory matter, fraud prevention or an unresolved dispute reasonably requires it.

9. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• ask for access to your personal information and a copy of it;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in circumstances where the right to erasure applies;
• ask us to restrict how information is used in certain circumstances;
• object to processing based on legitimate interests or to direct marketing;
• receive or transfer certain information in a portable format where the right to data portability applies;
• withdraw consent at any time where consent is the lawful basis;
• raise concerns about solely automated decisions with legal or similarly significant effects, if such processing applies.

These rights are not absolute. For example, ARC may need to keep information to comply with a legal obligation, protect another person's rights or deal with a legal claim. We may ask for reasonable evidence of identity before releasing personal information. To exercise a right, email lettings@arcpm.co.uk or write to our registered office.

10. Your right to object

Where ARC relies on legitimate interests, you have the right to object to that processing in certain circumstances. If you object, we will consider your reasons and stop the processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

You may object to direct marketing at any time. If you do, ARC will stop using your personal information for that marketing. We may keep a minimal record of the opt-out so that we do not contact you again by mistake.

11. Referencing and automated decision-making

ARC does not ordinarily make tenancy or property-management decisions based solely on automated processing that produces legal or similarly significant effects. Referencing, identity or fraud-prevention providers may use automated tools as part of their service and should provide their own privacy information. ARC may use their results as evidence, but will consider relevant information and context when making a decision for which ARC is responsible.

12. Keeping information secure

ARC uses proportionate technical and organisational measures to protect personal information against loss, misuse, unauthorised access or disclosure. Access is limited to people and service providers who need the information for their role. We also use verification steps for payment instructions and will not knowingly disclose information simply because a caller or sender claims to be entitled to it.

No method of storage or communication can be guaranteed completely secure. If a personal-data breach occurs, ARC will assess it and notify the ICO and affected individuals where the law requires.

13. Questions and complaints about privacy

You can make a data protection complaint directly to ARC by email, telephone or post using the contact details below. You do not need to use legal terminology or a particular form. Please tell us what you are concerned about and, if possible, what outcome you are seeking. We will acknowledge a data protection complaint within 30 days, investigate it appropriately and respond without undue delay. This data protection complaints process is separate from the timetable for an ordinary lettings or property-management complaint.

You can also complain to the ICO. You do not have to complete ARC's general lettings complaints or redress process before raising a data protection concern with the ICO. A privacy complaint to the ICO is separate from a tenancy-deposit dispute or a complaint to a property redress scheme.

14. Changes to this notice

We will review this notice when our services, systems, suppliers or legal obligations materially change. If we intend to use personal information for a new purpose that is not compatible with the purpose for which it was obtained, we will provide further privacy information before starting that use where required.

Current version. Version 1.1, dated 18 September 2026. We review this notice regularly and will update it sooner if our services, systems, suppliers or legal obligations change materially.

How we provide this notice

We may provide this notice by email, through our electronic document process, on our website or in paper form. If you need it in another accessible format, please contact us. Providing this notice does not remove or reduce any statutory right.