Privacy Policy
How we collect, use, and protect your personal data
Last updated: 3 January 2026
Contents
1Introduction & Data Controller
This Privacy Policy explains how Nest Homes & Interiors Limited ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our services, website, or interact with us in any way.
We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
This policy is designed to support UK GDPR compliance. Our systems are hosted on ISO 27001-certified infrastructure.
Data Controller Details
Company Name: Nest Homes & Interiors Limited
Company Number: 08955619
Registered Address: 3 Buckingham Close, Lisvane, Cardiff, CF14 0EY, United Kingdom
ICO Registration Reference: ZA169965
Data Protection Officer: Jonathan Davies
Data Protection Contact: admin@nest-homes.co.uk
As a Data Controller, we determine the purposes and means of processing your personal data. We are registered with the Information Commissioner's Office (ICO) and comply with all applicable data protection legislation.
Data Protection Officer
Jonathan Davies is our appointed Data Protection Officer. For any data protection queries or concerns, please contact us at admin@nest-homes.co.uk.
2Personal Data We Collect
We only collect personal data that is necessary for the purposes described in this policy. We collect data directly from you when you provide it to us through our application forms, enquiries, and communications.
2.1 Identity & Contact Information
- Full name, title, and date of birth
- Email address and telephone number(s)
- Current and previous residential addresses
- Postcode and length of time at address
2.2 Residency History
- Previous addresses and duration at each
- Previous landlord or letting agency contact details
- Reasons for leaving previous accommodation
2.3 Employment & Financial Information
- Employment status and employer details
- Job title and length of employment
- Annual income and employment history
- Bank name, account holder name, sort code, and account number
2.4 Student Information (where applicable)
- University or educational institution name
- Course of study and year
- Student ID number
2.5 Household & Lifestyle Information
- Number of proposed occupants
- Pet ownership details
- Smoking status
2.6 Guarantor Information
- Guarantor's full name, contact details, and address
- Guarantor's employment and income details
- Relationship to applicant
2.7 Identity Documents & Verification
- Copies of passport or driving licence (for Right to Rent checks)
- Proof of income documentation
- Proof of address documentation
- Student confirmation letters
- Selfie photographs for identity verification
2.8 Property & Tenancy Information
- Property of interest and application type
- Desired move-in date and tenancy length
- Group application status
- Assigned agent details
2.9 Enquiry & Communication Data
- Messages and enquiries submitted via our website
- Email correspondence
- Telephone conversation records (where applicable)
Data Minimisation: We only collect data that is necessary for the specific purpose. We do not collect excessive or irrelevant personal information.
2.10 Special Category & Criminal Offence Data
In the course of tenant referencing, we may receive information relating to criminal offence data through our referencing partners. Such data is processed only where:
- It is necessary for reasons of substantial public interest
- It is carried out by or on behalf of a competent authority
- Appropriate safeguards are in place to protect data subject rights
We do not routinely collect special category data (such as health information, racial or ethnic origin, religious beliefs, or sexual orientation). Where such data is provided voluntarily or is necessary for specific purposes, we will process it only with explicit consent or where another lawful basis applies under UK GDPR Article 9.
3Lawful Basis for Processing
Under UK GDPR Article 6, we must have a valid lawful basis to process your personal data. We rely on the following bases depending on the nature of processing:
Contract Performance (Article 6(1)(b))
Processing necessary to perform a contract with you or to take pre-contractual steps at your request. This includes processing tenancy applications, rental agreements, property sales, and property management services.
Legal Obligation (Article 6(1)(c))
Processing necessary to comply with legal obligations, including Right to Rent checks under the Immigration Act 2014, Anti-Money Laundering (AML) regulations, tax and accounting requirements, and regulatory obligations to professional bodies.
Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate business interests, where those interests are not overridden by your rights. This includes responding to enquiries, improving our services, fraud prevention, and maintaining business records.
Consent (Article 6(1)(a))
Where we rely on consent, such as for marketing communications, you have the right to withdraw consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
4How We Use Your Data
We use your personal data for the following purposes:
4.1 Lettings Services
- Processing rental applications and tenant referencing
- Conducting Right to Rent checks as required by law
- Creating and managing tenancy agreements
- Collecting rent and managing deposits
- Arranging property viewings and inspections
- Coordinating maintenance and repairs
4.2 Sales Services
- Property valuations and marketing
- Managing property viewings and offers
- Conducting Anti-Money Laundering checks
- Liaising with solicitors and other parties
- Completing property transactions
4.3 Property Management
- Managing landlord and tenant relationships
- Coordinating maintenance and contractors
- Conducting property inspections
- Managing utility and service charge accounts
4.4 General Business Operations
- Responding to enquiries and providing customer service
- Maintaining accurate business records
- Complying with legal and regulatory obligations
- Preventing fraud and protecting our business
- Training staff and improving services
4.5 Marketing (with your consent)
- Sending property alerts and updates
- Newsletter communications
- Information about our services and offers
5Data Sharing & Third Parties
We will always inform you and, where required, obtain your consent before sharing your personal data with third parties. We never sell your personal data to third parties.
5.1 Third Parties We May Share Data With
Tenant Referencing Services
We use Rightmove Referencing to conduct tenant reference checks on our behalf. This includes credit checks through credit reference agencies (such as Experian, Equifax, or TransUnion), employment verification, and previous landlord references.
Deposit Protection Schemes
Tenant deposits are protected with authorised deposit protection schemes as required by law, specifically the Deposit Protection Service (DPS).
Landlords
Where we act as letting agents, we share relevant tenant information with property landlords to enable them to make informed decisions and manage their properties.
Legal & Professional Advisers
Solicitors, accountants, and other professional advisers where necessary for transactions or legal matters.
Regulatory Bodies
We may share data with regulatory bodies including Rent Smart Wales, The Property Ombudsman, Propertymark, HMRC, and law enforcement where required by law.
Service Providers
Third-party service providers who process data on our behalf, such as our customer relationship management system and IT service providers. These providers act as Data Processors and are bound by contractual obligations to protect your data.
5.3 Customer Relationship Management System
We use a customer relationship management system to manage client relationships, property records, and business operations.
This system is hosted on third-party infrastructure provided by our technology partner, who acts as a Data Processor on our behalf. We remain the Data Controller for all personal data processed through the system.
Appropriate contractual safeguards are in place, including a Data Processing Agreement that ensures compliance with UK GDPR requirements, including provisions for data security, confidentiality, sub-processor management, and data subject rights assistance.
The infrastructure is built on SOC 2 Type II and ISO 27001 certified platforms.
5.2 Data Processors
Where third parties process personal data on our behalf (as Data Processors), we ensure appropriate contracts are in place that require them to:
- Process data only on our documented instructions
- Implement appropriate security measures
- Not sub-contract without our authorisation
- Assist us with data subject rights requests
- Delete or return data at the end of the contract
6International Data Transfers
Some of the third-party service providers we use may process your personal data outside the United Kingdom, including in the United States.
Some of our systems, including our customer relationship management system, are hosted on infrastructure located in the United States, with supporting services in Germany and the United Kingdom. These transfers are protected by the UK International Data Transfer Agreement (UK IDTA) and the EU-US Data Privacy Framework.
Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place to protect your data, including:
- UK Adequacy Decisions: Transfers to countries the UK government has deemed to provide adequate data protection.
- International Data Transfer Agreement (IDTA): The UK equivalent of Standard Contractual Clauses approved by the ICO.
- UK Addendum to EU SCCs: Where EU Standard Contractual Clauses are supplemented with the UK Addendum.
Our infrastructure provider maintains appropriate international data transfer mechanisms, including Standard Contractual Clauses and compliance with relevant data protection frameworks. Our infrastructure is built on ISO 27001-certified systems designed to support UK GDPR compliance.
You may request further information about the specific safeguards applied to international transfers of your data by contacting us at admin@nest-homes.co.uk.
7Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements.
| Data Category | Retention Period | Reason |
|---|---|---|
| General enquiries | 2 years | Business records and follow-up |
| Unsuccessful applications | 6 months | Dispute resolution period |
| Tenancy records | 6 years after tenancy ends | Limitation Act 1980, regulatory requirements |
| Landlord records | 6 years after relationship ends | Tax, accounting, and legal requirements |
| Property sale records | 6 years after completion | Legal and regulatory requirements |
| AML records | 5 years after relationship ends | Money Laundering Regulations 2017 |
| Right to Rent records | 2 years after tenancy ends | Immigration Act 2014 |
| CCTV footage | 30 days (unless incident) | Security purposes |
| Marketing consent records | Duration of consent + 2 years | Evidence of consent |
Where we are required to retain certain data for legal or regulatory purposes but no longer need it for operational purposes, we may anonymise the data so it can no longer be associated with you.
8Your Rights Under UK GDPR
Under UK GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at admin@nest-homes.co.uk.
Right of Access (Article 15)
You have the right to request a copy of the personal data we hold about you and information about how we process it. We will respond within one month of receiving your request.
Right to Rectification (Article 16)
You have the right to request correction of inaccurate personal data or completion of incomplete data we hold about you.
Right to Erasure (Article 17)
You have the right to request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purpose it was collected. This right does not apply where we need to retain data for legal or regulatory compliance.
Right to Restrict Processing (Article 18)
You have the right to request restriction of processing in certain circumstances, such as while we verify the accuracy of data you've contested.
Right to Data Portability (Article 20)
Where processing is based on consent or contract and is automated, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object (Article 21)
You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to marketing, we will stop immediately.
Right to Withdraw Consent
Where we process data based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
Rights Related to Automated Decision-Making (Article 22)
You have rights in relation to automated decision-making, including profiling. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
Data Subject Access Requests (DSARs)
To submit a data subject access request, please email admin@nest-homes.co.uk with the subject line "Data Subject Access Request". We may need to verify your identity before processing your request. We will respond within one calendar month, though this may be extended by up to two additional months for complex requests.
9Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction.
Security Measures Include:
- Encryption of data in transit and at rest
- Secure access controls and authentication
- Role-based access permissions limiting data access to authorised personnel
- Regular security assessments and monitoring
- Staff training on data protection and security
- Secure disposal of data when no longer needed
- Incident response procedures for potential data breaches
Our systems are built on infrastructure that is designed to support UK GDPR compliance and maintains ISO 27001 certification for information security management.
Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
11CCTV
We operate CCTV at our registered office for security purposes. This includes the prevention and detection of crime and the protection of staff, visitors, and property.
CCTV Usage:
- Purpose: Security and crime prevention
- Lawful Basis: Legitimate interests (security of premises and individuals)
- Retention: Footage is retained for 30 days unless an incident requires longer retention
- Access: Access to footage is restricted to authorised personnel and law enforcement where required
- Signage: Appropriate signage is displayed to notify visitors of CCTV operation
You have the right to request access to CCTV footage featuring you. Such requests should be made in writing to admin@nest-homes.co.uk.
12Marketing Communications
We will only send you marketing communications where you have provided your explicit consent to receive them. We comply with the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR.
Types of Marketing:
- Property alerts matching your search criteria
- Newsletter updates about our services
- Information about new properties, services, and offers
- Market updates and property insights
Your Choices:
- You can opt-in to marketing when you submit an enquiry or application
- You can unsubscribe at any time using the link in our emails
- You can contact us to update your preferences
- Opting out of marketing will not affect service-related communications
Note: We may still send you important service-related communications (such as tenancy updates, maintenance notices, or contract information) even if you have opted out of marketing, as these are necessary for the performance of our contract with you.
13Children's Privacy
Our services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. Where we collect information about children as occupants of a property (for example, household composition), this is limited to the minimum necessary and is processed with appropriate safeguards.
If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that information as quickly as possible.
14Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons.
When we make material changes, we will:
- Update the "Last updated" date at the top of this policy
- Where appropriate, notify you by email or through our website
- Where changes relate to processing based on consent, seek fresh consent where required
We encourage you to review this policy periodically to stay informed about how we protect your data.
15Complaints
If you have concerns about how we handle your personal data, we encourage you to contact us first so we can try to resolve your concerns.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:
Information Commissioner's Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
For complaints specifically about our property services, you may also contact The Property Ombudsman at www.tpos.co.uk.
16Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have any concerns about how we handle your personal data, please contact us:
For data protection queries, please include "Privacy" or "DSAR" in the subject line.
Postal Address
Nest Homes & Interiors Limited
3 Buckingham Close
Lisvane, Cardiff
CF14 0EY
United Kingdom
Telephone
0730 400 6532
Company Information
Company No: 08955619
ICO Registration: ZA169965
Regulatory & Professional Memberships
Nest Homes & Interiors Limited is a member of or registered with the following bodies: