Centro Plc External Privacy Notice

We are Centro Plc. We operate as either a data controller or a data processor in respect of the personal information you provide to us (meaning the organisation making decisions about how and why your personal information is used).

We are registered with the Information Commissioner’s Office (ICO) under the following registration numbers:

• Z1979559 (CENTRO PLC),
• Z243878X (CENTRO RESIDENTIAL SALES AND LETTINGS LIMITED),
• ZA366600 (CENTRO COMMERCIAL LIMITED),
• ZA366614 (CENTRO GROUP LIMITED) and
• ZA366628 (CENTRO SERVICES LIMITED).

This privacy notice is for our customers, clients, and suppliers. As a data controller, we are committed to protecting your personal information and being completely transparent about what information we hold and how we use it.

Where we provide a service to or work on behalf of an organisation, it is likely that we are a data processor and the contracting organisation is the data controller. If you do not have a direct contract with Centro Plc or one of our other businesses, but you do have a direct relationship with one of our business customers (e.g., as an employee of that business customer, or as a customer of that business), it is likely that they are the data controller and will be best placed to help you.

1. Our Contact Details

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us using the details below:

• Full Name of Legal Entity: Centro Plc
• Email Address: info@centro.plc.uk
• Postal Address: Centro Plc, Mid-Day Court, 30 Brighton Road, Sutton, Surrey, SM2 5BN
• Telephone Number: 020 8401 1000

2. Core Data Protection Principles

Processing your information in accordance with the UK General Data Protection Regulation (UK GDPR) means we adhere to the following principles:

• Fairness and Transparency: We are fair, open, and transparent with you regarding how we use your data.
• Purpose Limitation: We clearly identify our purposes for processing your information and ensure any additional purpose is legally compatible. We document and periodically review these purposes.
• Data Minimisation: We ensure that the information we process is adequate, relevant, and strictly limited to what is necessary for our stated purposes.
• Accuracy: We take all reasonable steps to ensure the information we hold is accurate, up-to-date, and corrected or erased without delay if found to be incorrect.
• Storage Limitation: We do not keep information for longer than is required. We erase or anonymise data safely when it is no longer needed.
• Integrity and Confidentiality: We employ appropriate technical and organisational security measures to protect your data against unauthorised processing, accidental loss, destruction, or damage.

3. The Type of Personal Information We Collect

The type of personal data we collect depends on how you interact with Centro Plc. We process the following categories of data:

• Information You Give Us: You may give us information by enquiring about or using our residential sales, lettings, or commercial services, or by corresponding with us by phone, email, post, or in person. This includes:
o Identity Data (e.g., name, title, proof of identity/passport for anti-money laundering checks).
o Contact Data (e.g., address, email address, phone numbers, employer name).
o Financial Data (e.g., bank account details, credit checks, employment/salary references for tenancy applications).
o Transaction Data (e.g., details of properties bought, sold, or rented through us).
• Information Given About Others: You may share information about another person, such as a spouse, partner, or guarantor. If you are a company sharing information about employees or clients, you may be the data controller and Centro Plc will be the data processor. Please ensure you have provided the appropriate privacy notices to those individuals before sharing their data with us.
• Information We Collect From Your Use of Our Site: When you visit our website, we may automatically collect technical and usage data, including:
o Technical Data (e.g., IP address, browser type and version, time zone setting, operating system, and platform).
o Usage and Cookie Data (e.g., information about how you use our website, products, and services). Please see our Cookie Policy for full details.

4. How We Get Personal Information and Why We Have It

We collect personal data directly from you, as well as from third parties (such as reference agencies, credit bureaus, property portals like Rightmove or Zoopla, and public registers like Companies House).

Under the UK GDPR, the lawful bases we rely on for processing this information are:

• Contractual Obligation: Where processing is necessary to perform a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g., managing a tenancy agreement, processing a property sale).
• Legitimate Interest: Where it is necessary for our legitimate business interests (or those of a third party), provided your fundamental rights and freedoms do not override those interests. Examples include:
o Measuring, auditing, and improving our customer services.
o Internal administration, staff training, and record-keeping.
o Investigating queries, complaints, incidents, or managing legal claims.
• Legal Obligation: Where processing is necessary for us to comply with the law (e.g., Anti-Money Laundering legislation, Right to Rent checks under immigration laws, tax and company accounting regulations).
• Consent: Where you have given clear, explicit consent for us to process your data for a specific purpose (such as subscribing to our property marketing alerts).

Marketing Communications

We will only send you electronic promotional marketing (such as emails or texts) if you have actively opted in to receive them, or if you are an existing customer who purchased similar services from us previously (in line with PECR regulations). You have the right to withdraw your consent or opt out of marketing at any time by clicking the "unsubscribe" link in our emails or by contacting us directly.

Special Category (Sensitive) Data

On rare occasions, we may need to process sensitive personal data (such as health details for vulnerable tenants, accessibility requirements, or criminal record checks for background screening). The lawful bases we rely on for this processing are:

• Your explicit consent.
• Where necessary to protect your vital interests or those of another person (in an emergency).
• Where necessary for reasons of substantial public interest (and authorised under the Data Protection Act 2018).

5. International Data Transfers

We store and process your data primarily within the UK and the European Economic Area (EEA). If we ever need to transfer your personal data outside of the UK, we ensure it receives a similar degree of protection by ensuring at least one of the following safeguards is implemented:

• The country has been deemed to provide an adequate level of protection for personal data by the UK government.
• We use specific legally binding contracts approved for use in the UK (such as the International Data Transfer Agreement or Addendum) which give personal data the same protection it has in the UK.

6. Data Retention (How Long We Keep Your Information)

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use, and applicable legal timelines.

• Client and Transaction Files (Sales and Lettings): We typically retain contract data, financial records, and anti-money laundering checks for [Insert timeframe, e.g., 7 years] following the termination of our contract or completion of the transaction, to comply with statutory tax and legal limitation periods.
• General Enquiries: We retain general enquiries and correspondence for [Insert timeframe, e.g., 1 year or 2 years] from the date of last contact.
• Marketing Data: We retain your data until you withdraw your consent or ask us to stop marketing to you.
Once the retention period expires, your data will be securely destroyed, deleted, or permanently anonymised.

7. Your Legal Rights

Under UK data protection law, you have specific rights regarding your personal information:

• Right of Access: You have the right to ask us for copies of your personal information (a Subject Access Request). • Right to Rectification: You have the right to ask us to rectify personal information you think is inaccurate or complete information you think is incomplete.
• Right to Erasure: You have the right to ask us to erase your personal information in certain circumstances (the "right to be forgotten").
• Right to Restriction of Processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Right to Object to Processing: You have the right to object to the processing of your personal data in certain circumstances, including an absolute right to object to direct marketing.
• Right to Data Portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where we rely on your consent to process your data, you can withdraw that consent at any time.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us using the details in Section 1 if you wish to make a request.

8. How to Complain

If you have any concerns or are unhappy with how we have used your data, you can make a complaint to us directly using the contact information in Section 1.

You also have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

• ICO Website: ico.org.uk
• ICO Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• ICO Helpline Number: 0303 123 1113