Privacy policy

01Who we are

Crestgrove Lennox Estate Management Ltd is a company registered in England and Wales (company no. 17246472), with its registered office at First Floor, Office A06, 33 Haymarket, London, SW1Y 4HA. We run short-stay and holiday accommodation, act as a lettings and estate agent, and manage residential buildings.

For most of the information described here we are the controller under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Where we manage a block for a residents' management company, Right to Manage company or freeholder, that client may also be a controller of leaseholders' information, and we act on its instructions for those records.

Questions about this policy or your information: info@crestgrovelennox.co.uk, 07469 515146, or by post to the address above, marked "Data protection".

02What we collect and why

We don't ask for special category information (such as health). If someone tells us about a disability or health need so that we can make an adjustment — a ground-floor flat, help with access, a vulnerable resident in an emergency — we record only what is needed, with their agreement, and keep it restricted.

03Checks the law requires

Right to rent. Before a tenancy begins in England we must check that every adult occupier has the right to rent, and keep a copy of the evidence for the tenancy and one year after it ends.

Anti-money laundering. As an estate agent, and as a letting agent for higher-value lets, we must check the identity of our clients and, for sales, of buyers. We may use an electronic identity service. These records are kept for five years after the relationship or transaction ends, as the Money Laundering Regulations 2017 require.

Referencing. With your permission we ask a referencing agency to check identity, credit history, income and previous tenancies. The agency acts as a controller in its own right and will give you its own privacy notice.

04In the buildings we manage

• Inspections. We photograph common parts, gardens and plant during inspections. We try not to photograph people; if someone appears in an inspection photo, it isn't used for anything else.
• CCTV and door entry. Some buildings have cameras in entrances and common parts, or door-entry and fob systems. Where they do, signs say so; footage is kept for up to 30 days unless needed for an incident, and is viewed only for security, safety or to deal with a claim.
• Keys and access. We keep a register of keys, fobs and codes we hold, and of who has borrowed them.
• Contractor access. We give contractors the name and number of a resident only when they need it to get into a flat, and only for that job.

05This website

crestgrovelennox.co.uk sets no cookies, runs no analytics or tracking, and loads no fonts, scripts or maps from other companies. The page uses your browser's session storage for two small markers — cl-intro (so the opening animation plays once) and cl-gust (for the transition between pages) — which hold no personal information and are cleared when you close the tab.

The enquiry form doesn't send anything to us by itself: it opens your own email app with a message you can read and edit before sending. What reaches us is your email.

Our web host keeps standard server logs (IP address, the page requested, time and browser type) for security, for up to 30 days.

06Who we share it with

Only where it's needed, and only what's needed:

• contractors and suppliers doing work at a property;
• government-approved tenancy deposit schemes, referencing and identity-check providers;
• booking platforms that a guest booked through, and the property's owner;
• the residents' management company, Right to Manage company or freeholder whose building it is, and its accountants or auditors;
• insurers, loss adjusters, solicitors and surveyors acting on a property or a claim;
• our bank, accountants and IT and email providers, under contracts that protect your data;
• an incoming managing agent at the end of our appointment, so the building can carry on;
• a redress scheme, the police, a local authority, HMRC or a court, where the law requires or allows it.

We never sell personal information or share it for marketing.

07Transfers outside the UK

Some of the services we use, such as email and booking platforms, may store data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, so your information keeps the same protection.

08How long we keep it

09Keeping it safe

Access to personal information is limited to the people who need it. Our systems use encryption and two-factor sign-in; paper files and keys are kept locked. If something goes wrong that puts your information at risk, we'll tell you and, where the law requires, the Information Commissioner.

10Your rights

You can ask us to:

• give you a copy of the personal information we hold about you;
• correct anything that's wrong or incomplete;
• delete it, where we no longer need it or have no legal reason to keep it;
• restrict how we use it, or object to a use based on legitimate interests;
• send it to you or another organisation in a usable format, where that applies.

There's no charge. We'll reply within one month, and tell you if we need longer or can't do what you ask — for example, because a record must be kept by law.

11Complaints

Please tell us first, so we can put it right: info@crestgrovelennox.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

12Changes

We'll update this policy when the way we use information changes. The version and date at the top tell you which one you're reading.