Data & Privacy Policy

Introduction

This data & privacy policy sets out how Legacie Group (‘Legacie’) uses and protects your personal data.

Important Information and Who We Are

This policy applies to all clients, customers, and tenants. It gives information about how Legacie collects and uses your personal data when you engage us for services, use our website (www.legacie.co.uk) or our apps, or interact with us in general.

Controller

Legacie Group Limited is made up of different legal entities. This policy applies to the relevant group company. For tenants, Legacie Management & Lettings Limited is the controller. For customers and clients, the company named in your contract is the controller.

If you are unsure who your controller is, please contact our Data Protection Officer (DPO) via the details in Section 10.

The Types of Personal Data We Collect About You

• Identity Data: Name, previous names, username, marital status, title, date of birth, gender
• Contact Data: Addresses, email, phone numbers
• Financial Data: Bank and payment details
• Transaction Data: Payments and purchase records
• Technical Data: IP address, browser info, operating system, device ID
• Profile Data: Login, preferences, feedback, survey responses
• Usage Data: Website/app usage patterns
• Marketing & Communications Data: Marketing preferences

How Is Your Personal Data Collected?

• Direct interactions (forms, calls, emails, etc.)
• Automated technologies (cookies, logs)
• Third-party sources (e.g. Google, payment providers, public data)

How We Use Your Personal Data

We only use your data where legally allowed. Common legal bases include:

• Performance of a contract
• Legitimate interest
• Legal obligation
• Consent

Purpose & Legal Basis Table

Purpose	Type of Data	Legal Basis & Retention
Registering you as a customer	Identity, Contact	Contractual necessity, retained up to 6 years post-contract
Processing orders and payments	Identity, Contact, Financial, Transaction	Contractual necessity, legitimate interest (debt recovery)
Managing our relationship with you	Identity, Contact, Profile, Marketing	Contractual, legal obligation, legitimate interest
Competitions and surveys	Identity, Contact, Usage, Profile, Marketing	Contractual, legitimate interest (engagement)
Business and website/app security	Identity, Contact, Technical	Legal obligation, legitimate interest

Marketing

You will receive marketing if you’ve interacted with us unless you opt out. We’ll never share your data for third-party marketing without consent. You can opt out at any time using unsubscribe links or by contacting us.

Cookies

See our cookie policy for more on how we use cookies.

Disclosures of Your Data

• Legacie Group companies
• Landlords, councils, contractors
• Business purchasers/mergers

International Transfers

We do not transfer personal data outside the UK.

Data Security

We have strict internal security protocols. We also limit access and will notify you and the ICO in the event of a breach, where required.

Data Retention

We retain your data up to 6 years post-contract unless legal reasons require longer. We’ll only keep what’s necessary and assess retention based on sensitivity, purpose, and risk.

Your Legal Rights

You have the right to:

• Access, correct, erase or restrict your data
• Object to processing or marketing
• Request a data transfer

To exercise any right, contact us (details below).

Fees and Timing

No fees for requests unless excessive. We may verify your identity. Responses are usually within one month.

Contact Details

Email our DPO: DPO@legacie.co.uk

Complaints

You can complain to the ICO (www.ico.org.uk) but we’d prefer to resolve issues directly.

Policy Updates

This version was last updated on 26th March 2025. We may update it periodically. Please notify us of any changes to your data.

Third-party Links

Our site/app may link to third-party services. We’re not responsible for their policies. Please read theirs before use.