Record of Revisions

Data Protection Policy

Content and Overview

Key Details

• Policy prepared by: Jennifer Cross (updated June 2026)
• Approved by: John Davidson
• Policy became operational on: 19th June 2026
• Next Review date: February 2027 or sooner if needed

Introduction

SouthSide Property Management needs to gather and use certain information about individuals.

This includes landlords, tenants, contractors, business contacts, team members of SouthSide Property Management and other individuals and businesses that SouthSide Property Management has a relationship with or may need to contact.

This policy explains how personal data must be collected, handled, stored and shared in compliance with UK data protection legislation, specifically the UK GDPR, the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act 2025 (DUA).

Why this policy exists

This data protection policy ensures that SouthSide Property Management:

• Complies with data protection law and follows good practice
• Protects the rights of team members, customers and partners
• Is open about how it stores and processes individuals’ data
• Protects itself from the risk of a data breach

Data Protection Law

The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025 sets out how organisations must collect, handle and store personal information. These laws apply regardless of whether personal data is processed electronically, on paper or in any other format.

The 7 Core Data Protection Principles

To comply with the law Southside Property Management ensures all personal data is managed in strict accordance with the second core principles of the UK data protection framework:

1. Lawfulness, fairness and transparency: Data must be processed lawfully, fairly, and in a transparent manner.
2. Purpose limitation: Data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly. Under the Data (Use and Access) Act 2025, compatible further processing includes specific public interest tasks such as crime prevention or local authority reporting.
3. Data minimisation: Data must be adequate, relevant, and limited to what is necessary for its purposes
4. Accuracy: Data must be accurate and kept up to date; inaccurate data must be erased or rectified without delay.
5. Storage limitation: Data must not be kept longer than is necessary for the purposes for which it is processed.
6. Integrity and confidentiality (Security): Data must be processed securely using appropriate technical or organisational measures.
7. Accountability: SouthSide Property Management is responsible for, and must be able to demonstrate compliance with, all the principles above.

Lawful Bases for Processing Property Data

SouthSide Property Management does not rely broadly on customer consent to process operational data. Instead, the company processes data under the following valid lawful bases:

• Performance of a Contract: To process applications, run references, manage tenancies, collect rent, and instruct maintenance contractors on behalf of landlords and tenants.
• Legal Obligation: To comply with mandatory statutory duties, including Tenancy Deposit Scheme registrations, and HMRC tax reporting.
• Legitimate Interests: To protect property assets, ensure workplace safety, manage corporate business-to-business relationships, and utilize pre-approved “recognised legitimate interests” under the Data (Use and Access) Act 2025.

People, risks and responsibilities

Policy Scope

This policy applies to the offices of SouthSide Property Management, all team members, and all contractors, suppliers, and third parties working on behalf of SouthSide Property Management. It covers all data relating to identifiable individuals, including names, addresses, emails, telephone numbers, National Insurance Numbers, employment statuses, and bank details.

Data Protection Risks

This policy protects SouthSide Property Management from critical data security risks, including:

• Breaches of confidentiality: Unauthorised or inappropriate disclosure of sensitive client, tenant, or team member data.
• Regulatory Non-Compliance: Processing data without an established lawful basis or failing to fulfil legal data subject requests.
• Reputational and Financial Damage: Severe regulatory fines. Under modern laws, Privacy and Electronic Communications Regulations (PECR) breaches – such as marketing errors or negligent massive data leaks via email d – carry increased penalties matching the UK GDPR cap of up to £17.5 million or 4% of global turnover.

Responsibilities

Everyone who works for or with SouthSide Property Management has responsibility for ensuring data is collected, stored and handled appropriately. Each Team Member that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles.

However, these people have key areas of responsibilities’ for ensuring that SouthSide Property Management meets its legal obligations.

The following individuals hold key areas of responsibility for ensuring SouthSide Property Management meets its legal obligations:

• John Davidson (Proprietor): Holds ultimate corporate accountability for ensuring the business meets its legal obligations.
• Leah Dougan (Operations Director & Data Protection Lead): Responsible for checking third-party contracts, managing IT security frameworks, updating consent registers, and overriding privacy procedures in accordance with legislative shifts.
• Catherine Dalrymple (Head of People): Manages internal team member SARs, maintains secure records for team members and ensures all team members; HR compliance.
• Danny Briggs, Victoria Little, Derek Dougan and Martin Bell (Departmental Heads): Responsible for ensuring day-to-day data hygiene, team training, clean-desk compliance, and secure remote working within their respective Lettings, Accounts, Visits and Projects teams.
• Jennifer Cross (Data Controller): Responsible for handling data protection questions from team members and anyone else covered by the policy, reviewing all data protection procedures and related policies, in line with an agreed schedule, reviewing policies annually or sooner if required to ensure compliance with GDPR. Coordinates and fulfils formal Subject Access Requests (SARs) from clients, landlords, and tenants, ensuring statutory response times are met.

Mandatory Internal Complaints Procedure (June 2026 Requirement)

In strict compliance with the Data (Use and Access) Act 2025, SouthSide Property Management operates a formal, transparent internal data protection complaints procedure.

1. Right to Complain: Any tenant, landlord, contractor or team member who believes SouthSide Property Management has mishandled their personal data or breached their privacy rights may lodge a formal complaint to the Data Protection Lead via jc@southsidemanagement.com. SouthSide facilitates this by providing clear, electronic, and physical methods for submitting complaints.
2. 30 Day: We will formally acknowledge receipt of your complaint within 30 days. We will then take appropriate steps to investigate and respond to your concerns without undue delay, keeping you informed of any progress. Once our investigation is complete, we will provide a clear and comprehensive response outlining our findings, conclusions and any actions taken.

General Team Member Guidelines & Device Security

• Access Control: Only team members who strictly require data access to perform their specific operational work duties are permitted to view individual client files.
• Data Minimisation and Disposal: Physical documents must be securely disposed of using on-site confidential was facilities as soon as they are no longer required.
• Workstation Hygiene: Team members must lock their computer screens (Win + L) every time they step away from their desks.
• Password Integrity: Passwords must remain strictly confidential and must never be shared, written down, or stored insecurely.
• Personal Devices (BYOD Ban): No team member of SouthSide Property Management is permitted to use a personal device (including personal smartphones, tablets, laptops, or desktop computers) to access, store, or interact with company or client data.
• Secure Access Framework: All company data, emails, software portals, and client tenancy networks must be accessed exclusively via encrypted, company-issued devices or through protected connections within the authorized company network.
• Accessing Data: Data should not be accessed on any device other than on an encrypted company device or within the company network. This includes individual email accounts, SAM, SAL, Intellisoft, Google Calendar, Jotform or any other programme or webpage that contains or has access to any company data.

GDPR – Multiple Recipient Emails

Please note that this policy update is effective IMMEDIATELY.

If an email is being sent out to tenants who do not reside in the same property, it must be verified by a second team member to ensure that all recipient email addresses are placed strictly in the BCC field.

The second verifying team member must be placed in the ‘To’ box of the email. This provides an audit trail showing who verified the compliance check in the event of an inquiry.

Example: Property Manager 1 sends an email to multiple properties with tenant addresses BCC’d. Property Manager 2 checks and approves the format. Property Manager 2’s email address is added to the ‘To’ field, and the email is sent.

Data Storage & Security

These rules describe how and where data should be safely stored. Questions relating to data storage should be directed to the Support Team.

Physical/Paper Storage

When data is stored on paper, it must be kept in a secure place where unauthorised people cannot see it.

These guidelines apply equally to electronic data that has been printed out:

• When not actively required, papers and files must be stored off desks.
• Printed or handwritten data must never be left unattended where unauthorised persons could view it (e.g., on printers or desks).
• Any data on paper should be shredded or disposed of securely using confidential waste bins when no longer required.

Electronic Storage

When data is stored electronically, it must be protected from unauthorised access, accidental deletion or malicious hacking attempts:

• Strong passwords should be used and should also be changed regularly
• If data is kept on removable media (e.g., USB drives), these must be encrypted and kept locked away when not in use.
• Data must only be stored on designated corporate drives and secure servers. Shortcuts may be saved to local desktops, but actual documents must reside on shared networks.
• Short cuts to documents may be stored on desktops but actual documents should only be stored on shared drives.
• Servers containing personal data must be situated in a secure, restricted-access location.
• Data must be backed up frequently, and backups must be tested regularly.
• Data must never be saved directly to local laptop hard drives or unencrypted mobile devices.
• All servers and workstation computers containing data must be protected by approved security software and a robust corporate firewall.

Data Use

Personal data is of no value to SouthSide Property Management unless the business can make use of it.

• Team Members should ensure their computers are locked when left unattended
• Personal data must never be transferred outside of the United Kingdom or the European Economic Area (EEA) unless appropriate legal safeguards (such as adequacy decisions or standard contractual clauses) are in place.
• Team members must not save copies of personal data to personal storage areas.
• When booking viewings at the office or attending to visitors, customers must remain in the reception area and not proceed beyond front desks to protect the privacy of data on display.

Data Accuracy

The law requires SouthSide Property Management to take reasonable steps to ensure data is kept accurate and up to date. This is the responsibility of all Team Members who work with personal data.

• Data will be held in as few places as possible.
• Team members must take every opportunity to verify that client data is current (e.g., confirming phone numbers and emails during inbound/outbound calls).
• SouthSide Property Management makes it simple for data subjects to update their information. For tenants and landlords, this is managed directly through their dedicated Property Manager.
• Data must be updated across all internal systems as soon as an inaccuracy is identified.

Subject Access Requests (SARs)

All individuals who are the subject of personal data held by SouthSide Property Management are entitled to ask what information the company holds on them and why, request access to it, and be informed how the company meets its data protection obligations.

• Handling Requests: Jennifer Cross will handle external data subject requests, and Catherine Dalrymple will deal with SARs from current and former Team Members.
• Verification of Identity: The identity of the data subject must be verified using photo ID or official documentation before any data is disclosed. SouthSide Property Management provides a Subject Access Request form to streamline identity verification and clarify the scope of the request.
• Proportionate Search Framework: In line with UK statutory guidance, SouthSide Property Management will conduct a reasonable and proportionate search for personal data, evaluating the nature of the request against our filing systems.
• The “Stop-The-Clock” Clarification Rule: If a request is broad or unclear, SouthSide Property Management may request specific clarification from the data subject. Such requests will not be made routinely or on a blanket basis. In accordance with the Data (Use and Access) Act, the statutory response period pauses upon issuing a request for clarification and resumes once the required details are received.
• Fees & Timeline: There is no charge for a standard Subject Access Request. The statutory response period begins once identity is verified and necessary clarification is received. The company will respond without undue delay and strictly within one calendar month, unless an extension is legally permissible due to extreme complexity.
• Audit Trail: All searches undertaken and responses provided will be internally documented to demonstrate compliance under the Accountability principle.

Disclosing data for other reasons

In specific circumstances, SouthSide Property Management may be approached by law enforcement or statutory agencies (such as Police Scotland, HMRC or local authorities) requesting personal data.

If this occurs, SouthSide Property Management may disclose the required data without the consent of the data subject utilising the Recognised Legitimate Interests or compatible further processing frameworks where relevant (e.g., for the detection, investigation, or prevention of crime). The Data Controller will rigorously verify that the request is legitimate and legal, and will seek explicit authorisation from the Proprietor before any data is released.

Right to Complain (Before ICO)

Under current UK data protection law, individuals must raise data protection concerns with SouthSide Property Management before escalating the matter to the Information Commission (ICO). Any individual who is dissatisfied with how their personal data has been handled may submit a complaint directly to us. We will acknowledge receipt of the complaint within 30 days and respond without undue delay, setting out the outcome of our investigation and any actions taken. We will ensure that clear and accessible methods are available for submitting complaints. If the individual remains dissatisfied after receiving our response, they retain the right to escalate the matter to the Information Commission.

Providing Information

SouthSide Property Management ensures that individuals are fully aware that their data is being processed, understanding exactly how their data is used and how to exercise their rights.

The company maintains a comprehensive, accessible Privacy Statement setting out these dynamics. A copy is available upon request to any client, and the most up-to-date version is continuously hosted on the company’s website.

Data Protection Complaints and External Escalation

In accordance with current data protection legislation, we operate an internal complaints procedure to ensure that any concerns regarding the handling of personal data are investigated and addressed appropriately.

We encourage individuals to raise any concerns with us in the first instance, allowing us the opportunity to investigate the matter and seek to resolve it directly.

However, you are entitled to contact the Information Commissioner’s Office (ICO) at any stage if you believe we have not complied with our data protection obligations. You are not required to exhaust our internal complaints procedure before doing so.

Regulatory Authority: Information Commissioner’s Office (ICO)

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/