Privacy policy.

01 — WHO WE ARE

About this policy.

This Privacy Policy explains how Business Rock Property Limited, trading as Business Rock (“Business Rock”, “we”, “us” or “our”), collects, uses, stores and protects personal information.

We process personal information in accordance with applicable UK data protection and privacy laws, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time.

Business Rock Property Limited is registered in England and Wales under company number 10872800. Our registered office is A2 Patrick Tobin Business Park, Bolton Road, Wath-Upon-Dearne, Rotherham, S63 7LL, United Kingdom.

02 — OUR ROLE

How we work with agency clients.

Business Rock provides outsourced, white-label property management services to independent letting and estate agencies. Depending on the circumstances, we may act as either a data controller or a data processor.

• When we act as a controller, we decide how and why personal information is used. This includes information collected through our website, our own business contacts and clients, and information needed to administer our business.
• When we act as a processor, we process personal information on behalf of a letting agency or other client, following its instructions and the terms of our service agreement and any applicable data processing agreement. The agency will generally be the controller and responsible for providing the relevant privacy information.

If you are a landlord or tenant whose property is managed by us on behalf of a letting agency, the agency’s privacy notice may explain how your information is used. You can contact the agency or us if you are unsure who is responsible for a particular use of your information.

03 — INFORMATION WE COLLECT

The information we may handle.

The information we collect depends on how you interact with us. It may include:

• Contact and business details: name, job title, agency or company name, business email, telephone number and address.
• Property and tenancy details: property addresses, ownership or landlord details, tenancy information, tenancy dates, inspection records, maintenance reports and compliance information.
• Landlord and tenant information: contact details and other information needed to administer agreed property management services, communicate with relevant parties and coordinate repairs or tenancy matters.
• Financial and accounting information: invoices, contractor payments, rent and payment records, statements, reconciliations and bank details where needed for an agreed service.
• Pre-tenancy information: details needed to administer tenancy documentation, referencing, agreements, deposits and move-in preparation where included in our instructions.
• Communications and records: website enquiries, emails, telephone notes, feedback, complaints and records of our dealings with you.
• Website and technical information: IP address, browser and device information, website usage, server logs and information collected through cookies or similar technologies.
• Staff and supplier information: information about job applicants, employees, contractors and suppliers where relevant to our business relationship with them.

In some property-management circumstances, we may need to handle sensitive information, such as health or accessibility information relevant to a property, repair or tenancy. We will only do so where necessary and where an appropriate lawful basis and any additional condition required by law apply. We aim to collect only information that is relevant and reasonably necessary.

04 — SOURCES AND PURPOSES

Where information comes from and how we use it.

We may obtain information directly from you; from letting agencies and other clients who instruct us; from landlords, tenants, applicants, contractors and suppliers; through property management, tenancy administration, accounting and communication systems; from specialist referencing or identity providers where relevant; and from public sources or professional advisers where lawful and appropriate.

We use personal information to respond to enquiries; provide and administer services; manage business relationships; coordinate repairs, inspections and compliance; handle tenancy documentation, deposits and move-in or move-out processes where agreed; provide client accounting and payment administration where agreed; communicate about property matters; manage invoices, complaints and disputes; administer our team and systems; protect our business and systems; comply with legal obligations; establish or defend legal claims; and understand and improve our services.

If we receive information from a source other than the person it relates to, we will provide privacy information where required by law. We will not use personal information for incompatible purposes unless we have a lawful basis and provide any further information required by law.

05 — LAWFUL BASES

The legal grounds we rely on.

We process personal information only where a lawful basis applies. Depending on the circumstances, this may include:

• Contract: where processing is necessary to enter into or perform a contract with you, or to take steps you request before entering into one.
• Legal obligation: where we need to comply with a legal or regulatory requirement.
• Legitimate interests: where processing is necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and freedoms. These interests may include providing and developing services, managing relationships, keeping records and securing our systems.
• Consent: where we rely on your consent, such as for certain marketing communications or website technologies where consent is required. You may withdraw consent at any time.

Where we process special category information, we will also rely on an applicable additional condition required by law. Where we act as a processor for a client, that controller is responsible for determining the lawful basis for the relevant processing.

06 — MARKETING

Business communications.

We may use business contact information to respond to enquiries, maintain existing relationships and, where permitted, tell relevant letting agencies or business contacts about Business Rock’s services. We comply with applicable data protection and electronic marketing rules; the requirements depend on the recipient, communication method and how the contact details were obtained.

You can opt out of marketing at any time by using an unsubscribe link where provided or contacting office@business-rock.com. We will respect objections to direct marketing. We may retain limited information to record your preference and ensure that we do not contact you for marketing again. Operational messages about an existing service are not necessarily marketing communications.

07 — SHARING INFORMATION

Who may receive information.

Where reasonably necessary, lawful and proportionate, we may share information with letting agencies and other clients; landlords, tenants and relevant parties; contractors, engineers and inspectors; property management, tenancy administration, accounting and referencing providers; IT, hosting, email, communications, cloud storage and software providers; professional advisers, insurers and accountants; regulators and public authorities where required or permitted by law; and relevant parties involved in a business reorganisation or transfer, subject to appropriate safeguards.

Some recipients process information on our instructions. Others act as independent controllers and are responsible for their own use of it. We share only information reasonably necessary for the relevant purpose. We do not sell personal information as a standalone commercial product.

08 — TECHNOLOGY AND AI

People first, technology enabled.

We use technology to support workflows, communications, property information, maintenance and administration. This may include property management software, tenancy administration and accounting platforms, automation and AI-assisted tools such as Hey Alfie.

Where personal information is processed by these tools, we remain responsible for ensuring that the processing is lawful and that appropriate safeguards are in place. The information provided to a technology provider depends on the task and the service arrangements. We do not intend to make decisions producing legal or similarly significant effects about individuals solely by automated means. If this changes, we will provide further information and apply safeguards required by law.

09 — INTERNATIONAL TRANSFERS

Using service providers securely.

Some service providers may store or process information outside the United Kingdom. If personal information is transferred internationally, we will ensure that the transfer is permitted under applicable data protection law and that appropriate safeguards are in place where required.

10 — RETENTION AND SECURITY

How long we keep information.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, taking account of the type of information, our relationship with you, legal and regulatory requirements, contractual obligations and the need to establish or defend legal claims. Retention periods vary between business correspondence, property-management records, accounting records and complaint records.

Where we process information for a client, retention, return and deletion are governed by the applicable service agreement, data processing agreement and the client’s lawful instructions, subject to any legal requirement to retain information.

We take reasonable technical and organisational measures designed to protect personal information from unauthorised access, loss, misuse, alteration or disclosure. Access is limited to people and service providers who need it for legitimate business purposes. No method of storage or transmission can be guaranteed to be completely secure, but we work to protect the information entrusted to us and to respond appropriately to suspected personal data breaches.

11 — YOUR RIGHTS

Your choices and rights.

Depending on the circumstances and subject to legal exemptions, you may have the right to request access to your personal information; correct inaccurate or incomplete information; request deletion or restriction of processing; object to processing based on legitimate interests; object to direct marketing; request portability of certain information where that right applies; and withdraw consent where we rely on it.

These rights are not absolute and may not apply in every situation. If we process your information on behalf of a letting agency or another client, we may need to refer your request to that organisation or assist it in responding. To exercise a right, contact us using the details below. We may need to verify your identity before responding.

12 — COOKIES AND EXTERNAL LINKS

Website technologies.

Our website may use cookies and similar technologies to operate correctly, remember preferences, support security and understand website usage. Where the law requires consent for a particular cookie or technology, we will seek consent before using it. Relevant preferences can be managed through the website’s cookie controls where provided.

Our website may contain links to third-party websites or services. We are not responsible for their websites or privacy practices. Please read their privacy information before providing personal information to them.

13 — INFORMATION ABOUT OTHER PEOPLE

When you provide information to us.

If you provide personal information about another person, you should ensure that you are permitted to provide it and that the person receives any privacy information required by law. Letting agencies and other clients providing information to us are responsible for ensuring they have an appropriate lawful basis and provide required information, subject to our agreement and applicable law.

14 — COMPLAINTS

Questions or concerns about privacy.

If you have a concern about how we handle personal information, please contact us using the details below. You can mark your correspondence “Data Protection Complaint”. We will acknowledge receipt of a data protection complaint within 30 days, make appropriate enquiries and respond without undue delay, keeping you informed of progress where necessary.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Further information is available at ico.org.uk.

For concerns about our property management service, please see our separate Complaints Procedure.

15 — CONTACT US

Get in touch.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact:

16 — POLICY UPDATES

Changes to this policy.

We may update this Privacy Policy to reflect changes in our business, services, technology or legal requirements. The latest version will be published on this page with the date it was last updated. Where required by law, we will provide additional information about material changes to how we use personal information.