HES Estate Management Privacy Policy

PRIVACY NOTICE - 2026

1. Introduction
HES Estate Management Limited (“HES”, “we”, “us”, “our”) is committed to protecting the privacy, confidentiality and integrity of personal data.

This Privacy Notice explains how we collect, use, store and protect personal data in connection with the management of residential blocks, estates and associated services.

We act in accordance with:
  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018
  • Applicable guidance issued by the Information Commissioner’s Office (ICO)

We do not sell personal data and do not use it for third-party marketing purposes.

2. Who We Are
HES Estate Management Limited is a block and estate managing agent acting on behalf of:
  • Freeholders
  • Resident Management Companies (RMCs)
  • Right to Manage Companies (RTMs)
  • Estate owners

Data Controller Status
HES acts as a Data Controller in respect of personal data processed in delivering property management services.

In certain circumstances, other parties (e.g. insurers, brokers, freeholders) may also act as independent Data Controllers.

3. Data Protection Principles
We adhere to the principles set out in UK GDPR:
  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimisation
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality
  • Accountability

We maintain internal policies and controls to demonstrate compliance.

4. Categories of Personal Data We Process
We may process the following categories of personal data:

4.1 Identity and Contact Data
  • Name
  • Correspondence address and property address
  • Telephone numbers
  • Email addresses

4.2 Property and Tenancy Data
  • Leaseholder, tenant and occupier details
  • Ownership and occupancy status
  • Letting agent or managing agent details
  • Mortgage provider

4.3 Financial Data
  • Service charge accounts and payment history
  • Bank/payment details (where necessary)
  • Arrears and enforcement records

4.4 Insurance and Compliance Data
  • Insurance policy information
  • Claims data (including reports, photographs and correspondence)
  • Fire safety, health and safety, and compliance records

4.5 Special Category Data (Limited Use)
  • Health or disability information
  • Vulnerability data

This data is processed only where strictly necessary, for example:
  • Reasonable adjustments
  • Insurance claims
  • Health and safety obligations

4.6 Technical Data
  • Website usage data (where applicable)
  • System access and audit logs
​
4.7 Sources of Data
We obtain data from:
  • You or your authorised representatives
  • Freeholders, RMC/RTM directors, joint owners
  • Previous managing agents
  • Contractors and professional advisers
  • Public records (e.g. HM Land Registry, Companies House)


5. Lawful Basis for Processing
We process personal data under the following lawful bases:

5.1 Contract
To perform obligations under:
  • Leases
  • Management agreements
  • Insurance arrangements

5.2 Legal Obligation
To comply with statutory duties, including:
  • Landlord and Tenant legislation
  • Health and safety laws
  • Fire safety legislation

5.3 Legitimate Interests
For the effective and efficient management of property, including:
  • Communication with residents
  • Enforcement of lease covenants
  • Financial administration

We ensure such interests do not override individual rights.

5.4 Consent
Where required (e.g. certain communications or sensitive processing)

5.5 Special Category Data
Processed under:
  • Substantial public interest
  • Legal claims
  • Health and safety obligations

6. How We Use Personal Data
We use personal data to:
  • Manage estates, buildings and communal areas
  • Administer service charges and financial accounts
  • Arrange maintenance, repairs and major works (including Section 20 consultation)
  • Arrange and administer buildings insurance
  • Handle insurance claims
  • Ensure compliance with legal and regulatory obligations
  • Communicate with leaseholders, residents and stakeholders
  • Enforce lease terms and estate regulations

All processing is proportionate and limited to what is necessary.

7. Data Sharing
We may share personal data with:

7.1 Core Stakeholders
  • Freeholders
  • RMCs / RTMs and their directors

7.2 Contractors and Suppliers
  • Maintenance contractors
  • Surveyors and engineers

7.3 Professional Advisers
  • Insurers and brokers
  • Loss adjusters
  • Solicitors and debt recovery agents
  • Accountants and auditors
  • Professional bodies who regulate us

7.4 IT and Service Providers
  • Secure software providers
  • Cloud storage providers

7.5 Authorities and Regulators
  • Courts, tribunals
  • Law enforcement agencies
  • The Information Commissioner’s Office (ICO)
  • Tax authorities

All third parties are required to process data securely and in accordance with data protection law.

8. Insurance Data Processing (Specialist Section)

As part of our role, we arrange and administer buildings insurance.

8.1 Activities Include
  • Risk data collection and analysis
  • Placement of insurance policies
  • Policy administration and renewals
  • Claims handling and coordination
  • Liaison with brokers, insurers and adjusters

8.2 Data Processed
  • Policyholder and resident data
  • Property and risk information
  • Claims data and supporting evidence
  • Financial information

8.3 Data Sharing
Shared with:
  • Insurers and brokers
  • Loss adjusters
  • Contractors and advisers
These parties may act as independent Data Controllers.

8.4 International Transfers
Where insurance markets require:
  • Transfers outside the UK may occur
  • Appropriate safeguards (e.g. IDTAs or adequacy decisions) are applied

8.5 Retention
Insurance data may be retained:
  • Up to 12 years or longer
  • For the duration of claims or disputes

9. Data Retention
We retain personal data only as long as necessary:
  • Financial records: 6–7 years
  • Property and legal matters: up to 12 years
  • Insurance and claims: up to 12 years or longer
  • Longer where required for disputes, litigation or statutory obligations

We operate an internal Data Retention Policy governing:
  • Retention periods
  • Periodic review
  • Secure deletion and destruction
  • Data maybe stored physically or digitally using using multiple servers and the cloud.


10. International Transfers
Where data is transferred outside the UK:
  • Transfers are risk assessed
  • Appropriate safeguards are implemented
  • Data is limited to what is necessary


11. Data Security
We implement appropriate technical and organisational measures, including:
  • Access controls and role-based permissions
  • Staff confidentiality obligations
  • Secure IT systems and encryption where appropriate
  • Monitoring and audit controls
  • Physical and digital security measures

12. Data Breach Management
We operate a formal Data Breach Policy, including:
  • Identification and reporting procedures
  • Risk assessment to individuals
  • Containment and remediation measures
  • Notification to affected individuals (where required)
  • Reporting to the Information Commissioner’s Office (ICO) within statutory timeframes


13. Your Rights
Under UK GDPR, you have the right to:
  • Access your personal data
  • Rectify inaccurate data
  • Request erasure (where applicable)
  • Restrict processing
  • Object to processing
  • Data portability

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

Requests will be handled in accordance with statutory requirements.

14. Contact Details
HES Estate Management Limited
2 Chartland House
Old Station Approach
Leatherhead
Surrey
KT22 7TE
Email: [email protected]
Telephone: 01372 677977

15. Complaints
If you have concerns, please contact us first.
You may also lodge a complaint with the Information Commissioner’s Office (ICO).

16. Changes to This Notice
This Privacy Notice is reviewed regularly and updated to reflect:
  • Legal developments
  • Regulatory guidance
  • Operational changes

This privacy notice was published on 18th May 2018, then reviewed on 18th May 2023 and last updated 12th May 2026.

17. Accessibility
This notice is available in alternative formats upon request.
​

Manage Cookies

We use cookies and other technologies to make this web site work and to allow us to see how visitors behave using third party tools including Google Analytics. 

Google and Weebly collect anonymous non-personal information about your activity on our web site, such as pages visited and time spent on the web site etc. This is achieved by use of "cookies" on your web browser and other Google and Weebly technologies.

You can use our cookie management software to customise your preferences:​
View Cookie Use Report

​If you contact us using our online forms, you may entrust us, our partners Weebly (our web site hosts) with personal information such as your name, contact details and nature of your enquiry. 
​
Please look at the relevant third party privacy policies here on how these third parties use data collected:
https://policies.google.com/privacy
https://www.weebly.com/uk/privacy