Data Protection Policy

Who we are

SureStay Housing (Surestay Housing Ltd, company number 12994450) is a property management company based in Exeter. We specialise in connecting property owners with local authorities, councils, charities and community support organisations to provide safe, stable housing for vulnerable individuals.

For the purposes of UK data protection law, SureStay Housing is the data controller responsible for the personal information collected through this website and in the course of our services.

Our data protection principles

We process all personal data in accordance with the seven principles of UK GDPR:

What data we hold and why

Property owners and landlords

When a property owner approaches us about our management services, we collect their name, contact details, property address and relevant financial information such as bank details for rental income payments. This data is used to assess the property, set up management arrangements, issue payments and maintain our ongoing relationship with the owner.

Local authority, council and charity partners

We work closely with local authorities, councils and support organisations to source suitable housing for the individuals they support. We hold contact details for the relevant staff or representatives within those organisations, and use this information to coordinate referrals, manage tenancies and communicate about the properties we manage on their behalf.

Tenant referral data

Tenants placed in our managed properties are typically referred to us by partner organisations such as councils or charities. We may receive and hold basic information about referred individuals — such as name, contact details and housing need — where this is necessary to arrange and manage accommodation. This data is received from and shared with the referring organisation under appropriate agreements.

Vulnerable persons data

Property inspection and maintenance records

As part of our property management service, we maintain records relating to property inspections, repairs, maintenance visits and compliance checks. These records may include details of the property, the nature of work carried out and relevant dates. Where a maintenance visit involves access to an occupied property, we keep a record of that visit.

Website enquiries

When you contact us through our website, we collect the information you provide — typically your name, email address, phone number and the nature of your enquiry. This is used solely to respond to you.

Lawful bases for processing

• Contract performance — to manage properties and fulfil our obligations to landlords and partner organisations
• Legitimate interests — to respond to enquiries, maintain business relationships and improve our services
• Legal obligation — to meet our obligations under landlord and tenant law, housing regulations and financial record-keeping requirements
• Vital interests — in exceptional circumstances, where processing is necessary to protect the safety or welfare of a vulnerable individual
• Explicit consent — for sensitive personal data relating to vulnerable individuals, where no other lawful basis applies

How long we keep data

• Landlord and property owner records — for the duration of the management agreement and up to 6 years after it ends
• Tenancy and housing records — up to 6 years after the end of a tenancy
• Financial and payment records — up to 7 years (HMRC requirement)
• Vulnerable person and referral data — for the duration of the housing arrangement, then securely deleted or returned to the referring organisation
• Property inspection and maintenance records — up to 6 years
• General website enquiry data — up to 2 years

All data is securely deleted or anonymised once it is no longer needed.

Who we share data with

We do not sell personal data. We may share it in limited and necessary circumstances with:

• Local authorities, councils and charity partners, to coordinate housing placements and tenancy management
• Property owners and landlords, where relevant to the management of their property
• Maintenance contractors and tradespeople, where access to a property or relevant details are required to carry out repairs
• Our IT and administrative service providers, under appropriate data processing agreements
• Regulatory bodies or authorities, where required by law

We do not transfer personal data outside the UK or European Economic Area without appropriate safeguards in place.

Data security

We take the security of personal data seriously, particularly given the sensitive nature of some of the information we handle. We use appropriate technical and organisational measures to protect data from loss, misuse or unauthorised access, including restricted access controls, secure communications and regular review of our practices.

In the unlikely event of a personal data breach that poses a risk to individuals, we will notify the ICO within 72 hours as required by law, and will inform affected individuals where necessary.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us via the details on our website. We will respond within one calendar month.

ICO registration and complaints

Changes to this policy

We may update this policy from time to time to reflect changes in the law or the way we work. The date at the top of this page will always show when it was last reviewed.