Dandara Group Customer Privacy Policy

Summary
At Dandara Group, we respect your privacy and are committed to protecting your personal data. This summary provides an overview of how we handle your data across our customer-facing divisions.

Who We Are
Dandara Group includes divisions focused on Housebuilding, commercial construction, residential and commercial property rentals and management (Isle of Man and Jersey) and build to rent.

What Data We Collect
We collect information relevant to our services, such as contact details, , property and rental details, call recordings, CCTV images, and data gathered from our website, services and social media.

How We Use Your Data
We use your data to manage property sales and rentals, provide customer support, enhance our services, conduct surveys, and ensure safety and security.

Sharing Your Information
We may share your information with trusted third parties for tenant vetting, call monitoring, maintenance, payment processing, customer service, social media management or where required by law.

Your Rights
You have rights over your data, including the right to access, correct, delete, and restrict processing. To exercise these rights, contact us at dpo@dandara.com.

Please review the full privacy policy below for more details on how we protect your data.

Full Policy

Introduction
Dandara Group (“we,” “us,” or “our”) is committed to protecting your privacy. This privacy policy explains how we collect, use, share, and protect your personal data across our customer-facing divisions:

• Dandara Housebuilding
  Regional entities within the Dandara Group develop residential and commercial properties across the UK and Crown Dependencies.
• Dandara Rentals (Isle of Man and Jersey)
  In addition to property sales, our regional entities in the Isle of Man and Jersey offer rental services, working with both landlords and tenants.
• Dandara Living
  Our build-to-rent division develops apartments, often in city locations.

This Privacy Notice applies to the companies in the Dandara Group that act as data controllers. A list of the principal companies is set out in Appendix 1.

In addition, this Notice also applies to any other company that is part of the Dandara Group and is registered as a data controller with a recognised data protection regulator in the jurisdiction where it operates.

While each company is legally responsible for the personal data it processes, they follow common standards for privacy, security, transparency, purposes and rights. Allied Services Limited provides central services to the Group, including compliance and data protection.

Some companies do not operate their own website. In such cases, this notice is the applicable privacy statement for their processing activities, and you can contact them through the details given here.

Data Minimisation
We are committed to data minimisation. This means we only collect information necessary to fulfil specific purposes and use it solely for those purposes as defined in this policy.

Information We Collect
Depending on the service and division, we may collect and process the following types of data:

• Contact Details
  Full name, telephone number, email, address, and preferred contact times and marketing preferences.
• Property and Rental Details
  Type of property, lease details, apartment number, tenancy dates, monthly rent, and prior rental history.
• Financial and Employment Information
  Income verification, employment details (industry, employer), and salary (for rental services).
• Verification Data
  Identity confirmation, date of birth, dependent details and sanctions-screening results, where required, for legal-compliance and fraud-prevention purposes.
• Website Interaction and Analytics
  IP addresses, device/browser type, geolocation, and web analytics (e.g. page views, time spent).
• Surveys and Feedback
  Customer satisfaction surveys and feedback on properties, amenities, or services.
• Maintenance and Support Requests
  Records of maintenance requests, feedback on repairs, and access preferences.
• Social Media
  Social media profiles gathered from public interactions on our platforms.
• Call Recordings
  Recordings of calls with our customer service representatives, primarily for service quality and training purposes.
• CCTV Images
  CCTV footage captured in public or common areas of our properties/sales offices, where applicable, to enhance security.
• Photographs and Video Content
  Images or videos captured during events, marketing activities, or for promotional purposes, with appropriate consent where required.
• Vulnerability Information
  Details about individual requirements or adjustments, such as accessibility needs, language preferences, or additional support to accommodate environmental, physical, or personal challenges.

How We Use Your Information
We use personal data for purposes tailored to each service or division:

• Property and Tenancy Management
  Processing purchase applications, leases and property agreements.
• Customer Service
  Providing support and responding to enquiries, including handling maintenance and repair requests.
• Customer Protection
  Dandara supports standards and schemes aimed at ensuring consumer protection, quality, and safety in its residential and rental properties.
• Surveys and Reviews
  Conducting customer satisfaction surveys and monitoring review sites to improve our services.
• Marketing
  Sending targeted marketing with consent, based on expressed interest.
• Business contacts
  We keep work names, emails, phone numbers and job titles of counterparties and advisers so we can manage and service corporate transactions.
• Safety and Security
  Monitoring facilities for security purposes (e.g. CCTV in some office spaces).
• Vulnerability
  We will use the information you provide us with to record the actions we need to take to accommodate your needs, this will not include storing health data unless it is essential and we have your consent.

Legal Bases for Processing
We process your data under the following legal bases:

• Contractual Necessity
  To manage tenancy agreements, purchases, and services.
• Legal Obligations
  To comply with sanctions-screening obligations, and other regulatory requirements.
• Legitimate Interests
  For improving services, customer support, handling complaints, health and safety and business to business contacts.
• Consent
  For marketing and survey participation, where required.

Sharing Your Information with Third Parties
To provide our services effectively, we may share your data with various trusted third parties. These third parties may change over time, and categories of third parties include:

• Tenant Vetting, Sanctions Screening and Credit Reference Agencies
  For tenant verification, sanctions-compliance checks and credit checks, especially for rental services.
• Call Monitoring and Engagement Services
  For tracking and enhancing customer engagement.
• After-Hours Support and Maintenance Providers
  Contractors and third-party companies to address repairs, maintenance, and out-of-hours needs.
• Web Chat and Customer Interaction Tools
  For customer enquiries and online support.
• Payment Processing and Deposit Management
  Secure processing of payments and deposit management.
• Local Authorities and Utility Providers
  When property ownership or service responsibilities transfer from us to the client.
• Social Media Platforms
  For managing interactions through our social media channels.
• Cloud Storage and Administrative Systems
  For secure data storage, records management, and administrative support.
• Prospective Buyers or Sellers of Dandara Businesses or Assets
  To facilitate the sale or transfer of any part of the Dandara Group or its assets, as required during such processes.
• Law Enforcement or Regulators Where Legally Required
  To comply with legal obligations or to assist with investigations or audits.
• Fraud Protection, Sanctions Screening, Credit Risk Reduction, and Payment Recovery Services
  To protect against fraudulent activity, comply with sanctions obligations, manage credit risks, and recover payments owed.
• International Data Transfers
  While Dandara itself does not routinely transfer data internationally, some of our third-party providers may do so. In cases where data is transferred outside the EU or UK, we ensure that appropriate agreements are in place with these third parties to protect your data according to GDPR standards, such as Standard Contractual Clauses or other approved transfer mechanisms. Where the country has been granted an adequacy decision by the UK Government or European Commission, we rely on that decision.

Data Retention and Deletion
Retention periods vary by service and type of data:

• Prospects: We retain data for up to 3 years or until we confirm it is outdated or incorrect.
• Housebuilding Customers: Up to 10 years post-purchase to cover warranty periods and any regulatory requirements.
• Rental: Personal data is retained for 6 years post-tenancy
• Digital Analytics and Web Interactions: Retained according to schedules for engagement analysis as detailed in our Cookies Policy.

Data Subject Rights
You have rights over your data, including:

• Access: Request a copy of your personal data.
• Correction: Update inaccurate information.
• Deletion: Request deletion allowed by law and contractual obligations.
• Objection and Restriction: Limit or object to specific data processing.
• Data Portability: Obtain data in a structured format.

For any of these requests, please contact us at: dpo@dandara.com . Consent management tools are available for marketing opt-outs.

Security and Data Storage
Data security is a priority. We restrict access to authorised personnel and follow best practices for data retention and protection. Data stored on third-party systems is protected through agreements requiring GDPR-compliant practices and security standards.

Cookies and Website Monitoring
Our websites use cookies to enhance functionality and collect usage analytics. For details, refer to our Cookie Policy.

Keeping you informed about changes
We will review and update this Privacy Notice whenever our processing activities, applicable laws or supervisory-authority guidance change.

• Minor edits
  If an update clarifies wording, fixes typographical errors or re-orders content without materially altering the substance of how, why or with whom we process your personal data, we will publish the new version on our website and show the “Last updated” date at the bottom of the page, or we may draw your attention to it.
• Material changes
  If an update adds new purposes, changes our lawful basis, introduces new recipients or data transfers, affects your rights, or could otherwise influence your choices or expectations, we will notify you before the change takes effect and give you a reasonable period to review the update, ask questions and exercise your rights or withdraw consent.
• Historic versions
  We keep an archive of previous versions of this Notice. You can request a copy at any time by
  contacting us at dpo@dandara.com.

Your continued use of our services after a minor update, or after the effective date of a material update of which you have been notified, constitutes acknowledgement of the revised Notice

Contact Us
For further information about this policy or data processing, please contact us at dpo@dandara.com. If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the UK’s data protection authority, the Information Commissioner’s Office (ICO). You can contact them at: www.ico.org.uk or call 0303 123 1113

Appendix 1
Per entity IC register

Last updated: 14 August 2025