Privacy Policy

1. Introduction

Vegner Group ("we", "us", "our") and its subsidiaries are committed to protecting your personal data. We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable laws.

We aim to handle personal data:

• Fairly, lawfully, and transparently;
• Only for legitimate, defined purposes;
• With integrity, accountability, and security;
• While respecting your rights as a data subject.

This Privacy Policy explains how we collect, use, share, and protect your personal data when you interact with Vegner Group or our services.

2. Who We Are

Our clients are the data controllers for the personal data we process about residents and leaseholders. This means they determine the purposes and means of processing your personal data in accordance with UK GDPR and the Data Protection Act 2018.

There are limited exceptions where we are the data controller in our own right, rather than on behalf of our clients. This applies to the contractor and supplier due diligence data described in Section 7, where we determine the purposes and means of processing ourselves.

3. The Data We Collect

We collect data from you to provide property management and related services. This may include:

• Identity and contact information: Your name, date of birth, property address, correspondence address, email, and phone number;
• Financial information: Bank account details, payment history, and credit information (for rent, service charges, or AML checks);
• Property and maintenance information: Repair history, access arrangements, communications regarding your property, and any maintenance records;
• Security and monitoring: CCTV footage of properties we manage, where we view or request footage from the third-party provider that operates the system, such as to investigate a dispute or incident. We do not store or manage this footage ourselves;
• Criminal offence data: Results of anti-money laundering (AML) and sanctions checks, where required by law;
• Technical and online data: IP address, browser type, device information, and cookies when you use our website.

4. How We Collect Your Data

• Directly from you (e.g. forms, emails, phone calls)
• From third parties, including solicitors, developers, AML/sanctions providers, Land Registry, and Companies House
• From contractors or service providers acting on our behalf
• Automatically through our website (cookies and tracking technologies)
• When you complete one of our communication preference forms
• When you register with our online portal, sign up for one of our newsletters or visit our website
• When you engage with us on social media
• When you contact us by any means with queries, complaints etc
• When you choose to complete any surveys we send you
• When you comment on or review our services
• When you've given a third party permission to share with us the information they hold about you
• Information, or where the information is made public as a matter of law

5. Why We Process Your Data

We process personal data under the following lawful bases:

• Contractual necessity: To manage your property, lease, or other services.
• Legal obligation: To comply with laws, including AML and sanctions screening.
• Legitimate interests: To manage properties effectively, prevent fraud, ensure safety, and oversee compliance.
• Consent: For optional marketing communications or other situations requiring your agreement.

Information on how we process criminal offence data can be found in our Privacy Notice: AML and Sanctions Screening, which can be found on our Policies page.

6. Who We Share Your Data With

We may share personal data with:

• Legal and professional service providers;
• Credit reference and background check agencies;
• Maintenance contractors and service providers;
• Security and CCTV system providers, who operate and hold this footage on our clients' behalf;
• Local authorities, utility providers, and government agencies (where required);
• IT and data hosting providers;
• Property management system providers;
• Affiliated companies within our group;
• Emergency services or law enforcement if necessary.

We ensure all third parties adhere to data protection laws and implement adequate safeguards.

We generally aim to process your personal data within the UK. However, some of our third-party service providers may process your personal data elsewhere. When this occurs, we will ensure that a safeguard recognised by the applicable laws is used to enable the transfer. We use the following safeguards:

• Transfers to countries that the UK authorities recognise as providing an adequate level of data protection: we rely on the decision of the UK authorities that these countries have equivalent protections to the UK GDPR; or
• Other countries, where we ensure recipients enter into contractual clauses to ensure UK GDPR-level protections continue to apply to your personal data.

7. Contractor and Supplier Due Diligence

For the processing described in this section, Vegner Group is the data controller in its own right, rather than the clients referred to in Section 2, as we determine the purposes and means of vetting the contractors and suppliers we engage.

To meet our obligations to the leasehold blocks we manage, we vet the contractors and suppliers we engage, including checks on company status, financial standing, and accreditation.

• Data collected: Company registration details and confirmation the company is not dissolved, in liquidation, or insolvent; financial standing and bank account verification; trade certifications, insurance, and health and safety accreditation; and contact details of directors, partners, or sole traders;
• Sources: Directly from contractors during onboarding and periodic review, and from credit reference and business verification agencies, Companies House, and accreditation bodies;
• Lawful basis: Legitimate interests, to ensure contractors are competent, solvent, and properly credentialed; and legal and contractual obligation, to meet our management agreement requirements;
• Sharing: With credit reference agencies and similar agencies, who act as our data processors for these checks; relevant internal teams; and clients or RMC/RTM boards, where they request evidence a contractor has been vetted;
• Retention and rights: Retained for the duration of our relationship with the contractor, plus any period needed for legal, accounting, or audit purposes. Contractors have the same rights set out in Section 11 (Your Rights) of this Policy.

8. Use of AI Tools and Database Providers

We use selected database providers and AI-based tools to support the delivery of our services and how we manage customer communications, including data contained in cases, requests, emails, and related communications.

• Role: These providers act as data processors or sub-processors, and may only process personal data in accordance with our instructions and applicable data protection legislation;
• Location and transfers: Where AI-based tools are used, the AI models are hosted within the European Economic Area (EEA); the UK's adequacy regulations recognise the EEA as offering an equivalent standard of protection, so no additional transfer safeguards are required;
• Training: We do not allow personal data processed on our behalf to be used to train general AI models;
• Data processed: Contact details, information about your case, and other information contained in the relevant case, email, request, or communication;
• Special category data: If you choose to include special category personal data (as defined in Article 9 UK GDPR) in your communications with us, we will treat this as your explicit consent to our processing that data solely for the purpose of handling, analysing, or summarising the matter to which it relates. We do not request this information, and we take steps to minimise the storage of any such data that is not necessary for that purpose. You can withdraw your consent at any time by contacting us at privacy@vegnergroup.com; this will not affect the lawfulness of processing carried out before you withdrew it, and we will delete or stop using the data once notified, unless we need to retain it for another lawful reason.

9. Direct Marketing

We want to provide you with the best possible service and from time to time may send you information about other services that may be of interest to you. You have the right to stop the use of your personal data for direct marketing through all channels, or selected channels. We will always comply with your request. You can stop direct marketing communications from us by:

• Clicking the "unsubscribe" link in any email we send you;
• Logging in to our online portal and changing your communication preferences;
• Writing to us at 9-11 The Quadrant, Richmond, Surrey, TW9 1BP;
• Emailing privacy@vegnergroup.com.

You may continue to receive communications for a short period after changing your preferences while our systems are fully updated.

10. Data Retention

We retain personal data only for as long as necessary for the purposes we collected it, including legal, accounting, or regulatory obligations.

11. Your Rights

Under UK data protection law, you have the right to:

• Access: Request a copy of your personal data we hold.
• Rectification or erasure: Correct inaccurate information or request deletion where legally permitted.
• Restriction or objection: Limit or object to certain processing activities.
• Data portability: Receive your data in a structured, machine-readable format, and transmit it to another controller where feasible.
• Withdraw consent: At any time for processing based on consent (without affecting prior lawful processing).
• Lodge a complaint with the ICO: www.ico.org.uk or you can call the ICO on 0303 123 1113.

To exercise any of these rights, contact us at privacy@vegnergroup.com.

How to Make a Data Protection Complaint to Us

If you have any concerns about how we use your personal data, you have the right to make a data protection complaint to us. You can contact us using the details set out above.

We will:

1. acknowledge your complaint within 30 days;
2. investigate the matter;
3. keep you informed where appropriate; and
4. provide you with a response, including the outcome of our investigation, without undue delay.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

12. Security of Your Data

We implement technical, physical, and organisational measures to protect your data, including:

• Password-protected and encrypted IT systems;
• ISO/IEC 27001-compliant cloud storage and backups;
• Access controls and employee confidentiality obligations;
• Staff training on data protection;
• Secure handling by third-party processors.

13. Cookies and Website Technologies

We use cookies and similar technologies to enhance your experience, analyse traffic, and support website functionality. These include:

• Strictly necessary cookies: Essential for website operation;
• Analytical / performance cookies: Track visitor interactions for performance insights;
• Functionality cookies: Remember your preferences and personalise content;
• Targeting / advertising cookies: Build interest profiles for relevant advertising.

You can manage or disable cookies via your browser settings. Disabling certain cookies may affect website functionality.

14. Changes to Our Business

Should a corporate restructure involve the transfer of divisions or the whole business to new owners, any of your personal data that is transferred will continue to be protected to the new owner or controlling party under the terms of this Privacy Policy.

15. Updates to This Privacy Policy

We may update this Policy to reflect changes in law, guidance, or our practices. The latest version will be published on our website with the "Last updated" date.

16. Contact Us

For questions or concerns about this Policy or your data, please email privacy@vegnergroup.com, or write to the Data Protection Officer, 9-11 The Quadrant, Richmond, Surrey, TW9 1BP.

You also have the right to contact the Information Commissioner's Office (ICO) at www.ico.org.uk.

17. Vegner Group Companies

Vegner Group Ltd, 9-11 The Quadrant, Richmond, Surrey, TW9 1BP. Registered in England and Wales No. 05728008.