Allonby Capital Holdings Limited is committed to handling personal data lawfully, fairly, transparently and securely.
1. Who we are
Allonby Capital Holdings is a privately owned UK commercial property investment company. For the purposes of UK data protection law, we are normally the controller of the personal data described in this notice.
Office: Pennington House, Ulverston, LA12 7NY
Privacy contact: enquiries@allonbycapitalholdings.co.uk
Telephone: +44 (0)7957 241821
2. Who this notice applies to
This notice applies to website visitors and individuals who interact with us in connection with our commercial property investment, acquisition, ownership, financing, development, refurbishment, letting and asset-management activities.
This may include property owners and vendors, purchasers, agents and brokers, introducers, tenants and occupiers, guarantors, directors and beneficial owners of counterparties, lenders, investors, professional advisers, contractors, suppliers, neighbouring owners, planning consultees, job applicants and other business contacts.
3. Personal data we may collect
- Identity and business contact data: name, title, role, employer, business address, email address, telephone number and professional profile information.
- Property and transaction data: property details, ownership, occupational arrangements, lease information, proposed terms, transaction history, correspondence and information supplied for acquisitions, disposals, financing or management.
- Financial and payment data: bank details, invoices, payment records, rent, service-charge and account information where relevant.
- Due-diligence and verification data: identification documents, proof of address, ownership and control information, source-of-funds information, sanctions or politically exposed person screening results and information required to prevent fraud or support legal due diligence.
- Communications data: emails, telephone and meeting notes, form submissions, preferences, complaints and records of our relationship.
- Recruitment data: CVs, employment history, qualifications, application answers, interview notes, references, right-to-work information, adjustment requests and equality monitoring information where lawfully collected.
- Technical and website data: IP address, browser and device information, security logs, pages visited, referral data and cookie choices.
- Special category or criminal-offence data: only where necessary and lawful, for example health information connected with a reasonable-adjustment request or information identified during proportionate due diligence.
4. Where personal data comes from
We may collect personal data directly from you, from your organisation, from a person acting for you, or through our website, correspondence, meetings and transaction processes.
We may also receive data from property agents, introducers, tenants, professional advisers, lenders, insurers, contractors, public registers, Companies House, HM Land Registry, planning portals, credit-reference and fraud-prevention services, sanctions databases, public websites and other lawful sources.
5. Why we use personal data and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries and assessing property opportunities | Legitimate interests in operating and developing our business; steps requested before entering a contract. |
| Negotiating, completing and administering transactions, leases and contracts | Contract; legitimate interests; legal obligations. |
| Property, asset and supplier management | Contract; legitimate interests in owning, maintaining and improving assets. |
| Identity, ownership, fraud, sanctions and source-of-funds checks | Legal obligations where applicable; legitimate interests in protecting the company and counterparties. |
| Accounting, tax, audit, insurance and corporate administration | Legal obligations; legitimate interests. |
| Recruitment and reasonable adjustments | Steps before entering an employment contract; legal obligations; legitimate interests; explicit consent or employment-law conditions where required for special category data. |
| Website security, diagnostics and administration | Legitimate interests; legal obligations; consent where required for non-essential technologies. |
| Business-to-business communications and relationship management | Legitimate interests, subject to the right to object and applicable electronic-marketing rules. |
| Complaints, disputes and legal claims | Legal obligations; legitimate interests in resolving concerns and establishing, exercising or defending legal claims. |
Where we rely on legitimate interests, we consider whether our interests are necessary and balanced against the individual’s rights. Where we rely on consent, it may be withdrawn at any time without affecting earlier lawful processing.
6. When information is required
Some information is required by law or needed to enter into or perform a contract. If required information is not provided, we may be unable to assess an opportunity, complete a transaction, make a payment, enter into a lease, appoint a supplier or progress an application. We will explain where a particular request is mandatory.
8. International transfers
Some service providers or recipients may process personal data outside the United Kingdom. Where required, we will use an approved transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses or another lawful safeguard, and will complete any required risk assessment.
9. How long we keep personal data
| Record type | Indicative retention period |
|---|---|
| General enquiries and opportunities that do not progress | Normally up to 24 months after the last meaningful contact, unless a continuing business reason justifies longer. |
| Acquisition, disposal, lease, finance and property-management records | Normally for the relationship and at least seven years afterwards. Title, deed, capital-asset or legal records may be retained longer. |
| Accounting, tax, VAT and invoice records | Normally at least six years from the end of the relevant period, and longer where required. |
| Due-diligence and fraud-prevention records | Normally for the transaction or relationship and up to seven years afterwards, subject to applicable requirements. |
| Recruitment records for unsuccessful applicants | Normally 6 to 12 months after the process, unless consent or another lawful basis supports longer retention. |
| Marketing and relationship-management records | Until objection, opt-out, loss of relevance or the end of the relationship; a suppression record may be retained. |
| Website and security logs | For the period reasonably required for security, diagnostics and provider administration. |
10. Security
We use proportionate technical and organisational measures intended to protect personal data against accidental or unlawful loss, misuse, alteration, unauthorised access or disclosure. Access is restricted to people and providers who need the information and are subject to confidentiality or contractual duties.
No internet transmission or storage system can be guaranteed completely secure. Do not send unnecessary sensitive information through an ordinary website form or unencrypted email.
12. Your data protection rights
- ask for access to the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to erase data in certain circumstances;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain data in a portable format where the right applies;
- withdraw consent where processing relies on consent; and
- ask for safeguards relating to a significant solely automated decision, where applicable.
Rights are not absolute and legal exemptions may apply. We may need to verify identity before responding. To exercise a right, contact enquiries@allonbycapitalholdings.co.uk
13. Data protection complaints
You may complain directly to us if you believe we have infringed your data protection rights. Send the complaint to enquiries@allonbycapitalholdings.co.uk and identify the conduct, data and outcome you are concerned about.
We will provide a clear route for complaints, acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and communicate the outcome.
You also have the right to complain to the Information Commissioner’s Office. We encourage you to raise the concern with us first so that we have an opportunity to address it.
14. Automated decision-making
We do not currently make decisions that have legal or similarly significant effects on individuals solely by automated means. If this changes, we will provide the information, safeguards and review rights required by law.
15. Changes to this notice
We may update this notice to reflect changes in our activities, systems, providers or law. The latest version will be published here with a revised date. Material changes will be brought to affected individuals’ attention where appropriate.