GDPR Notice

KB Estate Management Ltd. Our registered office is 747 Barking Road, London, E13 9ER. We are authorised and regulated by the Financial Conduct Authority (FCA Registration Number 987654).

For the purposes of UK data protection law, KB Estate Management Ltd is the data controller in respect of the personal data we process in connection with our property and block management services. Our Data Protection Officer can be contacted at info@kbestatemanagement.com or by writing to the address above.

We process personal data for the following core purposes:

• Providing property and block management services under our management agreements.
• Communicating with leaseholders, directors, and freeholders about building operations.
• Collecting and accounting for service charges and other property-related payments.
• Managing maintenance, repairs, and compliance with building safety regulations.
• Arranging and administering buildings insurance through our FCA-regulated insurance mediation.
• Handling enquiries, complaints, and requests for information.
• Complying with legal and regulatory obligations, including fire safety and anti-money laundering requirements.

Under UK GDPR, we rely on the following lawful bases:

• Contract (Article 6(1)(b)): Processing is necessary to perform our management agreement or to take steps at the request of the data subject before entering into a contract.
• Legal obligation (Article 6(1)(c)): Processing is necessary to comply with legal obligations, including building safety regulations, FCA rules, and fire safety legislation.
• Legitimate interests (Article 6(1)(f)): Processing is necessary for our legitimate interests or those of a third party, provided these do not override the data subject's rights and interests. Our legitimate interests include operating our business effectively, maintaining client and resident relationships, and improving our services.
• Consent (Article 6(1)(a)): Where we rely on consent (for example, for direct marketing communications), you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We process the following categories of personal data:

• Identity data — names, titles, proof of identity, and (where necessary) dates of birth.
• Contact data — addresses, email addresses, and telephone numbers.
• Property data — leasehold or freehold interests, property addresses, and service charge histories.
• Financial data — bank account details, payment histories, and credit reference information for arrears management.
• Communication data — records of correspondence, phone calls, emails, and meeting notes.
• Technical data — IP addresses, browser types, and usage data from our website and KB Portal.

We do not process special category data (such as health, religious, or biometric data) unless specifically required for insurance or legal purposes, in which case we will obtain your explicit consent.

We may share personal data with the following recipients:

• Contractors, surveyors, and other property professionals engaged in building works.
• Insurance providers and brokers for the arrangement of buildings insurance.
• Regulatory bodies including the FCA, ICO, and Property Ombudsman where required by law.
• IT service providers who host our systems and provide the KB Portal.
• Professional advisers including solicitors, accountants, and auditors.
• Law enforcement agencies and courts where legally required.

We do not sell personal data to third parties. All data sharing is governed by data processing agreements that require recipients to protect data to the same standards as we do.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are as follows:

• Leaseholder data: Duration of management plus six years after the end of the financial year to which it relates.
• Employee and contractor data: Duration of engagement plus two years.
• Enquiry and complaint data: Six years from the date of resolution.
• Website analytics data: 26 months maximum.

After the retention period, data is securely deleted or anonymised for analytical purposes.

Under UK GDPR, you have the following rights:

• Right to be informed — you have the right to be told how your data is used (this notice fulfils that right).
• Right of access — you can request a copy of the personal data we hold about you (subject access request).
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can request deletion of your data where there is no compelling reason for its continued processing.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can request a copy of your data in a machine-readable format.
• Right to object — you can object to processing based on legitimate interests or for direct marketing.
• Rights relating to automated decision-making — you can request human intervention in automated decisions.

To exercise any of these rights, contact our Data Protection Officer at info@kbestatemanagement.com. We will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We primarily store and process personal data within the UK and European Economic Area (EEA). Where we use third-party service providers that may transfer data outside the UK or EEA, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or adequacy decisions by the UK Government.

To contact our Data Protection Officer about any matter relating to this GDPR notice or the processing of your personal data:

• Email: info@kbestatemanagement.com
• Phone: +44 7886 940327
• Post: Data Protection Officer, KB Estate Management Ltd, 747 Barking Road, London, E13 9ER