Context and overview

O&C Lettings hereinafter referred to as OCL needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact. This policy describes how this personal data will be collected, handled and stored to meet the company’s data protection standards and to comply with the law.

Why this policy exists

This privacy policy ensures OCL:

Data protection law

The General Data Protection Regulation (GDPR), is an EU Regulation intended to strengthen and unify data protection for all individuals within the European Union. It applies to ‘personal data’ and is step on from The Data Protection Act 1998 (DPA) and describes how organisations – including OCL – must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The Data Protection Act is underpinned by eight important principles. These say that personal data must:

  1. Be processed fairly and lawfully
  2. Be obtained only for specific, lawful purposes
  3. Be adequate, relevant and not excessive
  4. Be accurate and kept up to date
  5. Not be held for any longer than necessary
  6. Processed in accordance with the rights of data subjects
  7. Be protected in appropriate ways
  8. Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection

Further information about GDPR

For further information about General Data Protection Regulations (GDPR) please visit

Policy scope

This policy applies to:

What personal information do we collect?

Information will generally be collected directly via the use of any of our standard forms, over the internet, via email or through a telephone conversation with you. We may also collect personal information through our affiliates or suppliers. If you wish to rent a residential or commercial property through us, we will typically collect the following information:

If you are a tenant renting under the ‘Right to Rent’ scheme, we will collect details of your Biometric residence card, your immigration status document and/or your birth certificate to carry out our required checks under this scheme. In order to process an application to rent a property, we will provide details to third parties to undertake necessary credit and personal referencing.

What is the legal basis of our data processing?

Under data protection legislation we are only permitted to use your personal information if we have a legal basis for doing so. We rely on the following legal bases to use your information:

What happens if you do not provide information that we request?

We need some of your personal information to perform the services you have requested from us.

We also need some information so that we can comply with our legal obligations. For example, we may need identity documents from you to meet our obligations to prevent fraud and money laundering.

If you do not provide the information required for these purposes, we will not be able to perform our contract with you and may not be able to provide services to you or continue to provide certain services to you. We will explain when this is the case at the point where we collect information from you.

Visitors to our website

If we need to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Use of cookies

The OCL website uses cookies, which is standard practice on most websites. Without them we cannot deliver a high quality online experience.

Some cookies collect anonymous information about your visit eg Google Analytics, which we use for monitoring purposes and to help us with future developments by understanding how our visitors use our website.

By using the OCL website you consent to cookies being used. If you do not consent you must disable cookies via your browser but accept that your visit will be restricted to only browsing the public pages, and certain features will not work correctly.

For more information about cookies together with a full list of cookies used on our website, please visit

Security and performance

OCL uses a third-party service to help maintain the security and performance of our websites. Appropriate technologies are used to safeguard your data, and rigorous security standards are maintained to prevent any unauthorised access to it.

External links

Our website contains external links to other websites. This privacy policy only applies to this website. We therefore advise visitors to read the privacy statement of any site they move to, especially those which collect personal information. OCL does not accept responsibility, or liability, for the consequential actions of a user choosing to access any third party website listed.


We use a third-party provider, Mailchimp, to deliver our e-marketing. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-marketing. For more information, please see Mailchimps’ privacy notice.

We keep the personal details of anyone receiving our email newsletter for as long as they are subscribed. Once a customer chooses to unsubscribe, their details are deleted with six months. You can unsubscribe by clicking on the link at the bottom of every email newsletter. Alternatively email

People who make a complaint to us

When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for six years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

How long do we keep your personal information

The period for which we will keep your personal information will depend on the type of service you have requested from us. The retention period may be longer than the period for which we are providing services to you where we have statutory or regulatory obligations to retain personal information for a longer period, or where we may need to retain the information in case of a legal claim.

Data accuracy

OCL takes all reasonable steps to ensure data is kept accurate and up to date. If you believe that the information we hold about you is out of date or incorrect, please email

Anti-Money Laundering

To help you with a property related service, we must comply with certain regulations for example the “Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (referred to as “the Regulations).” OCL is required to obtain certain information from you to comply with these regulations. The information provided will only be used by OCL in relation to comply with the Regulations and will not be shared with any other party outside of the companies wholly owned by OCL unless we are required to do so under law.

If you decide to enter in to a business relationship with OCL or any wholly owned subsidiary, to comply with certain regulations. We will require two separate identification documents, one primary and one secondary document, even if it appears on both lists. The information may be required at various stages of the process depending whether you are purchasing or selling:

Proof of identity – primary documents:

Proof of residence (home) – secondary documents:

Your rights in relation to your personal information

You have a number of rights in relation to your personal information, these include the right to:

For any of the above request you can contact us at any time by writing to us or by emailing

Disclosing data for other reasons

In certain circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement agencies without the consent of the data subject. Under these circumstances, OCL will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

Data Protection Officer

You can contact our data protection officer by emailing