top of page

Privacy Notice

How personal information is used when Bovellan manages a residential building, and in running our business

Version 4.4  |  Effective 30 June 2026  |  Replaces the Privacy Statement issued in 2025  |  Next review June 2027

In summary

  • Your building's landlord, residents' management company or right to manage company is responsible for (the of) the information used to manage your building. We hold and use that information on its behalf, as its managing agent and .

  • We are responsible in our own right only for information we use to run our business: checks on our clients, complaints about our service, and our regulatory, insurance and accounting records.

  • Building information is used to administer leases and service charges, keep buildings safe and insured, arrange repairs and recover sums owed. It is not sold, and we do not use it to market to leaseholders or residents.

  • Records belong to the building, and pass to the client or its new agent if our appointment ends.

  • You can ask for a copy of your information, have it corrected, object to some uses, and complain to us (we acknowledge within 30 days) or to the Information Commission's Office.

 

1.  About this notice

This notice explains how personal information is used when Bovellan Limited (“Bovellan”, “we”, “us”) manages a residential building, and when we run our own business. It applies to you if you are:

  • a leaseholder of a flat in a building we manage, a joint leaseholder, or a guarantor under a lease;

  • a resident or occupier of such a building, including a sub-tenant, family member or lodger;

  • a director, officer, member or beneficial owner of a client company (a landlord, residents' management company or right to manage company);

  • a freeholder or landlord client who is an individual;

  • a contractor, supplier or consultant, or an individual working for one;

  • a visitor to a building we manage, for example where CCTV or access control is in use;

  • someone who contacts us, visits our website or enquires about our services.

It does not cover our own employees or people who apply to work for us, who receive a separate notice. Site staff employed by a client company are covered by that company's staff privacy notice.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (each as amended, including by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003, together “data protection law”.

2.  Who is responsible for your information

Data protection law distinguishes between a controller, who decides why and how personal information is used, and a processor, who uses it on the controller's behalf and instructions. We act in both capacities, and it matters which applies.

2.1  When we manage your building

Every building we manage has a client that has appointed us as managing agent: the landlord or freeholder, a residents' management company or a right to manage company (the “Client”). The Client is the controller of personal information about leaseholders, residents, occupiers and visitors that is used to manage the building. We are the Client's processor and managing agent: we hold and use that information on the Client's behalf and under the instructions set out in our management agreement with the Client, and the records belong to the Client.

The Client for your building is named in your welcome letter and in the Building Information Sheet for your building, which is available from us on request. If you are not sure who the Client is, ask us.

Because we carry out the day-to-day management, we provide this notice to you on the Client's behalf as well as our own, and we deal with requests, questions and complaints about building information on the Client's behalf (see sections 11 and 12).

2.2  Where Bovellan is the controller

We are the controller, in our own right, of personal information we use for our own purposes. These are:

  • meeting our regulatory and professional obligations, including under the codes of practice that apply to managing agents and our membership of a redress scheme;

  • identity, anti-money-laundering and sanctions checks on our clients and their officers and beneficial owners;

  • our insurance, accounting, tax and legal obligations, including record-keeping and establishing, exercising or defending legal claims;

  • handling complaints about our service;

  • managing our relationship with our clients, including correspondence with their directors and officers;

  • running our business and our website, and marketing our services to prospective clients.

2.3  CCTV and access control

Where a building has CCTV or an electronic access control system, the Client is the controller of that system. We may administer it on the Client's behalf, as its agent, in accordance with the Client's CCTV policy. Signage at the building tells you whether CCTV is in use.

2.4  Not joint controllers

We and our Clients are separate controllers for our respective purposes, and the Client's processor in relation to building information. We are not joint controllers.

3.  The information we hold

Who you are

What we may hold

Leaseholders, joint leaseholders and guarantors

Name, correspondence and property addresses, email address and telephone numbers; a copy of your lease and title details; ownership history and date of purchase; your service charge and ground rent account, payment history and the bank details you give us for payments (we do not store card details); correspondence and call notes; details of alterations, sub-letting and consents; insurance claims; complaints and disputes; details of any legal proceedings; information about your flat needed for repairs, major works and safety.

Residents and occupiers, including sub-tenants, family members and lodgers

Name and contact details; dates of occupation; emergency contact details; vehicle registration where parking is managed; key, fob or access-control records; information you give us about repairs, incidents or complaints.

Directors, officers, members and beneficial owners of client companies

Name, role and contact details; company and register details; the identity and beneficial-ownership information we are required to verify; correspondence, reports and meeting records.

Contractors, suppliers and consultants

Contact details; qualifications, insurance and accreditation details; right-to-work confirmation where relevant; invoices and payment details; performance, incident and site-attendance records.

Visitors

CCTV images where CCTV is installed; visitor and concierge logs; access-control records.

Website visitors and enquirers

Contact details and enquiry details you give us; technical information collected by cookies (section 14).

 

Health, disability and other special category information, and information about criminal offences, is covered in section 6.

4.  Where we get your information from

Most of your information comes from you. We also receive information from:

  • the Client and, when we take over a building, the previous managing agent;

  • your solicitor or conveyancer when you buy or sell, for example notices of assignment and replies to pre-contract enquiries (LPE1);

  • HM Land Registry and Companies House;

  • other leaseholders, residents and site staff, for example reports of repairs, incidents or nuisance;

  • contractors, surveyors and consultants working at the building;

  • insurers, brokers and loss adjusters;

  • the Building Safety Regulator, the fire and rescue service, the local authority, the police, and courts and tribunals;

  • tracing agents, where correspondence is returned and sums are owed;

  • publicly available sources.

5.  How and why we use your information

The tables below set out the purposes for which information is used and the lawful basis for each. Part A covers the management of your building, where the Client is the controller and we act as its processor. Part B covers our own purposes, where we are the controller.

Part A – Managing your building (Client as controller; Bovellan as processor)

Purpose

Lawful basis

Keeping the register of leaseholders, residents and occupiers, and corresponding with you about the building

Performance of your lease, where the Client is your landlord or a party to your lease; the legitimate interests of the Client and of leaseholders collectively in the building being properly managed

Preparing, issuing and collecting service charge, ground rent, reserve fund and other demands; accounting; preparing budgets and year-end accounts and certificates

Performance of your lease; legal obligations (Landlord and Tenant Acts 1985 and 1987, Commonhold and Leasehold Reform Act 2002, Companies Act 2006); legitimate interests

Recovering arrears, including tracing, instructing solicitors or debt recovery agents, and court or tribunal proceedings

Performance of your lease; legitimate interests in recovering sums due to the building

Arranging repairs, maintenance and major works, statutory consultation (section 20), and giving contractors access

Performance of your lease; legal obligations; legitimate interests

Health, fire and building safety: risk assessments and compliance records, resident engagement, fire safety information to residents, and evacuation planning

Legal obligations (Regulatory Reform (Fire Safety) Order 2005; Fire Safety (England) Regulations 2022; Fire Safety (Residential Evacuation Plans) (England) Regulations 2025; Building Safety Act 2022; Health and Safety at Work etc. Act 1974); vital interests in an emergency

Arranging buildings insurance and handling claims

Performance of your lease; legitimate interests

Lease matters: consents for alterations and sub-letting, deeds of variation, enfranchisement and right to manage notices, and replies to pre-contract enquiries on a sale

Performance of your lease; legal obligations (Leasehold Reform, Housing and Urban Development Act 1993; Commonhold and Leasehold Reform Act 2002); legitimate interests

Security of the building: CCTV, access control, visitor logs, concierge records and investigating incidents

Legitimate interests, including the recognised legitimate interests of preventing and detecting crime and safeguarding

Handling complaints, nuisance and disputes between residents, and breaches of lease

Performance of your lease; legitimate interests

Administering site staff on the Client's behalf, where the Client employs staff, including payroll

The Client's employment contracts and legal obligations as employer

Handing over records to the Client or a successor managing agent when our appointment ends

Legal obligations and the codes of practice; legitimate interests of the Client

Anything the Client has asked your consent for, for example sharing your contact details with other residents or a residents' association

Consent, which you may withdraw at any time

 

Part B – Our own purposes (Bovellan as controller)

Purpose

Lawful basis

Client due diligence: identity, beneficial-ownership and sanctions checks on clients and their officers

Legal obligations; legitimate interests in preventing financial crime

Managing our relationship with clients and their directors: correspondence, meetings, reporting and fees

Performance of our management agreement; legitimate interests

Meeting our regulatory, professional, redress scheme, insurance, accounting and tax obligations, and establishing, exercising or defending legal claims

Legal obligations; legitimate interests

Handling complaints about our service

Legal obligations; legitimate interests

Running our website and responding to enquiries

Legitimate interests

Marketing our services to prospective and existing clients

Legitimate interests (business to business); consent where required by the Privacy and Electronic Communications Regulations

 

Legitimate interests. Where we or the Client rely on legitimate interests, the interest has been weighed against your rights and freedoms and we are satisfied that it is not overridden by them. You can ask us for details of that assessment, and you can object (section 11).

If you do not provide information. Some information is needed to administer your lease and to keep the building safe. If you do not provide it (for example a current correspondence address or an emergency contact), the Client may be unable to meet its obligations to you, demands will be served at the flat, and safety information may not reach you.

Automated decisions. Neither we nor the Client make decisions about you based solely on automated processing.

6.  Special category and criminal offence information

Special category information includes information about health, disability, racial or ethnic origin, religion, sexual orientation and biometrics. It is used only where there is a lawful basis in section 5 and an additional condition under data protection law. In practice this arises in the following situations.

Evacuation and accessibility needs. Where a building is within the Fire Safety (Residential Evacuation Plans) (England) Regulations 2025, the Client, as responsible person, must use reasonable endeavours to identify residents who may need help to evacuate, offer each of them a person-centred fire risk assessment, and keep any resulting emergency evacuation statement under review. In other buildings, residents may tell us about a mobility or health need for access or safety reasons. This information is held with your explicit consent, and in an emergency to protect your vital interests. It is seen only by those who need it, such as site staff and the fire and rescue service. You can withdraw consent at any time, in which case the Client may not be able to plan for your evacuation.

Safeguarding and welfare. Where a resident appears to be at risk of harm, information may be shared with the local authority, health services or the emergency services on the basis of substantial public interest (safeguarding) or vital interests.

Reasonable adjustments. Where you ask for an adjustment in how we communicate with you, we record what you have asked for in order to meet the Client's obligations under the Equality Act 2010.

Incidents and anti-social behaviour. Reports of criminal behaviour, nuisance or breach of lease may include information about criminal offences. This is used on the basis of the Client's legitimate interests in managing the building and enforcing the lease, and is shared with the police where necessary. Where a condition under the Data Protection Act 2018 requires an appropriate policy document, one is maintained.

7.  Who we share your information with

We do not sell personal information. Information is shared only where necessary, with:

  • the Client – your landlord, residents' management company or right to manage company – and its directors and officers, auditors and accountants;

  • contractors, consultants and professionals working at or for the building: builders, engineers, surveyors, fire risk assessors, cleaners, security and concierge providers, insurers, brokers and loss adjusters, who receive the information they need to do their job (for example your name, flat number and contact details to arrange access);

  • service providers who process information as our sub-processors, as our management agreement permits: property management software and resident-portal providers; IT, cloud, email and document-storage providers; payment, banking, printing and mailing services; our out-of-hours call-handling service; payroll providers, where the Client employs site staff; and CCTV and access-control maintainers. Each is bound by a written contract giving equivalent protection, and a current list is available on request;

  • solicitors, barristers, debt recovery agents, tracing agents, the courts and the First-tier Tribunal (Property Chamber), where sums are owed or there is a dispute;

  • public bodies and regulators: HM Land Registry, Companies House, HMRC, the local authority, the Building Safety Regulator, the fire and rescue service and the police, where the law requires or permits;

  • other leaseholders, where the lease or the law requires, for example inspection of accounts and receipts under section 22 of the Landlord and Tenant Act 1985, or service of notices under right to manage and enfranchisement legislation;

  • a successor managing agent, or the Client, when our appointment ends (section 9);

  • our professional advisers, insurers and redress scheme, and any prospective buyer of our business, under obligations of confidentiality;

  • anyone else with your consent.

8.  International transfers

Information is stored in the United Kingdom. Some of our service providers (for example cloud, email and website platforms) may store or support information from outside the UK. Where that happens, the transfer is made only in compliance with data protection law: to a country covered by UK adequacy regulations, or under the UK International Data Transfer Agreement or Addendum, or under another safeguard the law permits. You can ask us for details of the safeguards that apply to you.

9.  How long we keep your information

Client records. Documents and data relating to the building, the leases and the leaseholders are the Client's records. If our appointment ends they are returned to the Client or passed to its new managing agent in a commonly used electronic format, in accordance with our management agreement and the codes of practice. We then delete our working copies, keeping only what our own legal, regulatory and insurance obligations require us to keep as controller (section 2.2): generally six years after the end of our appointment, or twelve years for matters under deed or where a claim remains possible.

While we are the managing agent, information is kept in line with the following schedule.

Record

Kept for

Leases, title and ownership records; deeds of variation, licences and consents

The life of the lease. These belong to the building and pass to the Client or its successor agent.

Service charge accounts, demands, receipts, invoices and payment records

Seven years after the end of the accounting year to which they relate.

General correspondence, complaints and management records

Six years after you sell your flat or the matter closes, whichever is later.

Legal proceedings, tribunal matters and disputes

Twelve years after the matter concludes, or longer while a claim remains possible.

Health, fire and building safety records, including person-centred fire risk assessments and emergency evacuation statements

Compliance records are kept for the life of the building. Personal information about individual residents is kept only while the resident lives at the building and the assessment is current (reviewed at least every twelve months), and for twelve months after they leave.

Bank details given for payment

Until you tell us they have changed or your account with the building is closed. Card details are not retained.

CCTV images

Thirty days, unless retained for an incident, claim or investigation, when they are kept until that matter concludes.

Access-control, visitor and concierge logs

Twelve months.

Client due diligence (identity and anti-money-laundering) records

Five years after the end of our appointment.

Enquiries and prospective client records

Two years after our last contact with you.

 

10.  Security

We keep personal information secure using appropriate technical and organisational measures: access is limited to staff and sub-processors who need it; staff are bound by confidentiality; systems are protected by access controls, encryption in transit and backups; and sub-processors are bound by written contracts. Paper records are kept securely and disposed of confidentially.

Payment fraud. We will never ask you to change the account into which you pay service charges by email alone. We verify any change to bank details by telephone to a known number before acting on it, and we ask you to do the same: if you receive an email or letter telling you to pay into a new account, call us on a number you already have before paying.

If something goes wrong. If a personal data breach affects building information, we notify the Client without undue delay and in any event within 48 hours, and we help the Client to notify the Information Commission's Office within 72 hours where required and to tell you where the breach is likely to put you at high risk. Breaches affecting information we control are assessed and reported by us in the same way.

11.  Your rights

You have the right to:

  • the personal information held about you, and be given a copy;

  • have inaccurate information and incomplete information completed;

  • have information where there is no longer a good reason to keep it;

  • how information is used in certain circumstances;

  • to processing based on legitimate interests, and at any time to direct marketing;

  • receive information you have provided in a electronic format, where processing is based on consent or contract and carried out by automated means;

  • withdraw consent at any time, where consent is the basis for processing, without affecting what was done before;

  • not be subject to decisions based solely on that significantly affect you;

  • (section 12).

Some of these rights have limits. For example, information that is needed to administer your lease, to collect sums due or to comply with the law cannot be erased on request.

How to exercise your rights. Contact us using the details in section 16. Where your request concerns building information, we handle it on the Client's behalf under our management agreement and will inform the Client. Requests are free of charge in most cases. We may ask you to confirm your identity, and to clarify what you are looking for; the time for responding pauses while we wait for that. We respond within one month, which can be extended by up to two further months for complex or multiple requests, in which case we will tell you within the first month. Our search for information is reasonable and proportionate, as data protection law provides.

12.  Complaints

Complaining to us. If you believe your information has been used in breach of data protection law, you have the right to complain to us. Use the contact details in section 16 and mark your complaint “data protection complaint”, although we will treat a complaint as such however it reaches us. We will acknowledge it within 30 days, make appropriate enquiries, keep you informed of progress and tell you the outcome without undue delay. This is separate from, and does not affect, our service complaints procedure and your right to refer a service complaint to our redress scheme. Where a complaint concerns building information, we handle it on behalf of the Client; you may also complain to the Client directly.

Complaining to the regulator. You can complain at any time to the Information Commission's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113, although the ICO will usually expect you to have raised the matter with us first.

13.  Communications and marketing

Demands, statutory notices, safety information and updates about your building, including newsletters about the building, are service messages, not marketing. You cannot opt out of them, although you can tell us how you prefer to receive them, subject to any requirements in your lease for the service of formal notices.

We do not send marketing to leaseholders or residents. If we ever wish to, we will ask for your consent first, and you will be able to withdraw it at any time. Marketing to prospective and existing clients is sent on a business-to-business basis, and every message includes a means of opting out.

14.  Website and cookies

Our website, www.bovellan.co.uk, is hosted on a third-party platform. It uses strictly necessary cookies to operate and, where the law requires consent, sets analytics or other cookies only with your consent through the cookie banner. Details are in the cookie notice on the website. Information you submit through an enquiry form is used to respond to you and, if you become a client, as described in Part B of section 5.

15.  Changes to this notice

We review this notice at least once a year and whenever the law or our arrangements change. The current version, with its date, is published on our website and is available from us on request. If we make a change that significantly affects you, we will tell you.

16.  How to contact us

Data Protection Lead, Bovellan Limited

Post: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ

Email: info@bovellan.co.uk 

Telephone: 0203 835 5858

Bovellan Limited is registered in England and Wales, company number 13831887, and is registered with the Information Commission's Office under number ZB543031.

 

 

Appendix – Building Information Sheet

A completed copy of this sheet is issued with the welcome letter for each building and is available on request. It identifies the Client that is the controller of building information and records the building-specific matters referred to in this notice.

Item

Details

Building

[Name and address of building]

Client and controller of building information

[Full name of landlord / residents' management company / right to manage company], company number [number], registered office [address]

Managing agent and processor

Bovellan Limited, company number 13831887

Contact for all data protection requests, questions and complaints about the building

Data Protection Lead, Bovellan Limited – info@bovellan.co.uk – handled on the Client's behalf under the management agreement

CCTV

[Installed / not installed]. Where installed: images kept for [30] days; administered by Bovellan on the Client's behalf; the Client's CCTV policy is available on request

Electronic access control / fob system

[Yes / no]. Where yes: logs kept for [12] months

Building within the Fire Safety (Residential Evacuation Plans) (England) Regulations 2025

[Yes / no]. Where yes: residents who may need help to evacuate are invited to request a person-centred fire risk assessment

Site staff employed by the Client

[Yes / no]

Recognised residents' association

[Yes / no – name]

Out-of-hours emergency service

Calls are handled by our out-of-hours call-handling provider on the Client's behalf

Date issued / version

[Date] / [version]

bottom of page