Last updated: 13 February 2025

1. Data Controller

Block is the data controller responsible for your personal data. We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Block

Address: 274 Manchester Rd, Audenshaw, Manchester M34 5GL

Email: info@blockmanagementcompany.com

Phone: 0161 371 7190

If you have any questions about this Privacy Policy or our data practices, please contact us using the details above. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, at ico.org.uk or by calling 0303 123 1113.

2. What Personal Data We Collect

We may collect the following categories of personal data depending on your relationship with us:

2.1 Identity and Contact Data

Full name, title, and date of birth
Postal address, email address, and telephone number(s)
Proof of identity and address (where required for compliance purposes)

2.2 Property and Lease Data

Property address and unit number
Lease details, including lease term and ground rent obligations
Ownership records and conveyancing information

2.3 Financial Data

Bank account details for service charge payments or direct debits
Service charge payment history and account balances
Ground rent payment records

2.4 Communication Data

Records of correspondence, including emails, letters, and telephone call notes
Maintenance requests, complaints, and enquiries
Meeting minutes and AGM records

2.5 Technical Data

IP address, browser type and version, and operating system
Pages visited on our website, time spent, and navigation paths
Cookie identifiers and similar tracking technologies (see our Cookie Policy)

3. Lawful Basis for Processing

We only process your personal data where we have a lawful basis to do so. The lawful bases we rely on include:

Contractual necessity: Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract. This includes administering management agreements, collecting service charges, and managing maintenance.
Legal obligation: Processing is necessary for compliance with a legal obligation to which we are subject, such as health and safety regulations, anti-money laundering requirements, and landlord and tenant legislation.
Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. Our legitimate interests include the efficient management of properties, debt recovery, fraud prevention, and improving our services.
Consent: Where we rely on your consent to process personal data (for example, for marketing communications), you have the right to withdraw that consent at any time by contacting us.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

To provide block management and property management services
To administer service charge accounts and process payments
To arrange and manage building maintenance and repairs
To procure and administer buildings insurance
To communicate with leaseholders, freeholders, and other stakeholders
To comply with legal and regulatory obligations
To respond to enquiries, complaints, and requests for information
To administer Section 20 consultations and major works projects
To manage health and safety at the properties we manage
To conduct AGMs and directors' meetings
To recover debts and manage arrears
To improve our website and services through analytics
To send service-related communications (not marketing)

5. Data Retention

We will retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and whether we can achieve those purposes through other means.

In general:

Property management records: Retained for 6 years after the end of the management agreement, or longer if required by law.
Financial records: Retained for a minimum of 6 years in accordance with HMRC requirements.
Health and safety records: Retained for the period required by applicable legislation (typically 40 years for asbestos-related records).
Website analytics data: Retained for up to 26 months.
Marketing consent records: Retained for the duration of the consent and for 12 months thereafter.

6. Your Rights Under UK Data Protection Law

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access: You have the right to request a copy of the personal data we hold about you (a “subject access request”).
Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
Right to erasure: You have the right to request that we delete your personal data in certain circumstances (the “right to be forgotten”).
Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as the lawful basis.
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Right to complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us at info@blockmanagementcompany.com. We will respond to your request within one month of receipt. In certain circumstances, we may extend this period by a further two months, in which case we will notify you accordingly.

7. Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users and to improve your browsing experience. Cookies are small text files placed on your device when you visit our website. We use both essential cookies (which are necessary for the operation of our website) and analytics cookies (which help us understand how visitors use our website).

For full details on the cookies we use, their purposes, and how to manage your cookie preferences, please refer to our Cookie Policy.

8. Third-Party Data Sharing

We may share your personal data with the following categories of third parties where necessary for the purposes outlined in this policy:

Contractors and service providers: Maintenance contractors, cleaning companies, and other service providers engaged in connection with the properties we manage.
Insurance providers: Insurers and insurance brokers for the arrangement and administration of buildings and liability insurance.
Legal and professional advisors: Solicitors, accountants, auditors, and other professional advisors providing services to us or to the properties we manage.
Financial institutions: Banks and payment processors for the processing of service charge payments and other financial transactions.
Regulatory bodies: Government agencies, regulators, and ombudsman services where required by law or regulation.
Successor managing agents: In the event of a change of managing agent, we may transfer relevant property and leaseholder data to the successor agent.
IT service providers: Cloud hosting providers, email service providers, and property management software providers who process data on our behalf.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

9. International Transfers

We primarily store and process your personal data within the United Kingdom and the European Economic Area (EEA). Where we transfer personal data outside of the UK or EEA, we ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the UK Secretary of State, an adequacy decision, or binding corporate rules.

10. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

Encryption of personal data in transit and at rest
Access controls and authentication procedures
Regular security assessments and penetration testing
Staff training on data protection and information security
Incident response procedures for data breaches
Secure disposal of personal data when no longer required

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated “last updated” date. We encourage you to review this page periodically for the latest information on our privacy practices.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal data, please contact us:

Block

274 Manchester Rd, Audenshaw, Manchester M34 5GL