DATA PROTECTION & INFORMATION SECURITY PROCEDURE
We are dedicated to maintaining the highest standards of data security and transparency. This section serves as a comprehensive placeholder where you will detail your specific commitment to GDPR compliance, data handling procedures, and the protection of client information within your property management operations.
Neville Cressy Property Management LTD
Last updated: 17 August 2026
1. Purpose
This procedure explains how Neville Cressy Property Management LTD protects personal information used in the course of its business.
It applies to personal information relating to landlords, property owners, letting agents, tenants, occupiers, contractors, suppliers and other individuals whose information we handle.
2. Information We Handle
We may handle:
Names
Telephone numbers
Email addresses
Property addresses
Contractor details
Appointment information
Key and access information
Photographs
Inventory and inspection reports
Certificates and property documents
Invoices and payment records
Business correspondence
3. Keeping Information Secure
Personal information must be stored securely.
Where possible:
Devices must be password protected.
Strong passwords must be used.
Two-factor authentication should be enabled where available.
Software and devices should be kept up to date.
Personal information should not be stored unnecessarily on personal devices.
Information should only be accessed by people who need it for legitimate business purposes.
Confidential information must not be shared unnecessarily.
4. Email
Before sending an email containing personal information or property documents, the recipient's email address should be checked carefully.
Where information is sent to multiple unrelated recipients, appropriate measures should be taken to avoid unnecessarily revealing recipients' email addresses.
5. Keys & Access Information
Keys must be stored securely when not in use.
Keys should not be labelled with unnecessary information that could identify the property if the keys were lost.
Alarm codes, access codes and security information must be treated as confidential and only shared where necessary to carry out an authorised service.
6. Photographs
Photographs should only be taken for legitimate business purposes.
Photographs containing personal information should be stored securely and shared only with people who have a legitimate reason to receive them.
Photographs should not be used for unrelated purposes without an appropriate lawful basis.
7. Paper Documents
Paper documents containing personal information must be kept secure.
Documents that are no longer required must be securely destroyed, for example by shredding.
8. Sharing Information
Personal information may be shared with landlords, letting agents, contractors, professional advisers, insurers, service providers or authorities where there is a legitimate business or legal reason.
Only information reasonably required for the relevant purpose should be shared.
9. Retention & Deletion
Information must not be kept indefinitely.
Records should be reviewed periodically and securely deleted, destroyed or anonymised when they are no longer required, subject to legal, tax, accounting, insurance and contractual requirements.
10. Data Breaches
A data breach may include:
Sending an email to the wrong person
Losing a phone, laptop or document
Unauthorised access to an account
Sending a report to the wrong recipient
Losing paperwork
A cyberattack
Unauthorised disclosure of personal information
Any suspected breach must be reported immediately to the person responsible for data protection within the business.
Responsible person: Neville Cressy Property Management LTD
Email: bookings@nevillecressyltd.co.uk
Telephone: 0800 998 7989
The incident will be assessed and appropriate action will be taken.
Where legally required, the ICO and/or affected individuals will be notified.
11. Data Protection Requests
Any request from an individual asking to access, correct, delete or otherwise exercise their data protection rights should be passed to Neville Cressy Property Management LTD immediately.
Requests should not be ignored or unnecessarily delayed.
12. Confidentiality
Personal information must be treated as confidential.
It must only be used for legitimate business purposes and must not be disclosed to unrelated individuals.
13. Accuracy
Reasonable steps should be taken to ensure personal information is accurate and up to date.
Incorrect information should be corrected when identified.
14. Review
This procedure will be reviewed periodically and whenever there is a significant change to our business, services, technology or data protection requirements.
Approved by: Neville Cressy Property Management LTD
Date: 17 August 2026