privacy policy

Last updated: 28 September 2026

This Privacy Policy explains how South West CPM Limited (“we”, “us” or “our”) collects, uses, stores and shares personal data when providing commercial property management services and operating southwestcpm.co.uk (“Website”).

We process personal data in accordance with applicable UK data-protection legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (“PECR”).

This policy applies to clients, prospective clients, landlords, tenants, occupiers, contractors, suppliers, professional advisers, Website visitors and other individuals whose personal data we process.

1. Who We Are

South West CPM Limited is a company registered in England and Wales under company number 16309531.

Registered office:
Bickland House
Bickland Water Road
Falmouth
Cornwall
England
TR11 4SB

Email: info@southwestcpm.co.uk
Telephone: 01872 301801

We provide commercial property management, administration, coordination and consultancy services across Cornwall and the South West of England.

For many of our business activities, South West CPM Limited is the data controller. This means we determine why and how personal data is processed.

In some circumstances, we may process personal data solely on the instructions of a property owner, landlord or other client. In those circumstances, the client may be the data controller and we may act as its data processor. The client’s own privacy information may also apply.

2. Personal Data We May Collect

The personal data we collect depends on your relationship with us and the nature of the services being provided. It may include:

• Identity data: Name, title, date of birth and other identification information where reasonably required.
• Contact data: Postal address, email address, telephone number and preferred method of communication.
• Client and business data: Organisation name, role, business contact details and information about your relationship with a property or organisation.
• Property and tenancy data: Property address, tenancy or occupancy details, lease information, key dates, correspondence, access arrangements and records relating to the occupation or management of a property.
• Financial data: Bank account details, payment information, rent or service-charge information, arrears information and other financial records relevant to the Services.
• Transaction data: Details of invoices, payments, charges, expenditure and services provided or received.
• Contractor and supplier data: Contact details, quotations, contracts, insurance information, qualifications, accreditations and work records.
• Compliance and safety data: Information connected with inspections, incidents, repairs, statutory compliance, health and safety, insurance claims or legal obligations.
• Communication data: Emails, letters, telephone notes, enquiries, instructions, complaints and other correspondence.
• Technical data: Internet protocol address, browser type, operating system, device information and technical information generated when using the Website.
• Usage data: Information about how visitors use the Website, where collected through approved cookies or similar technologies.
• Marketing and preference data: Communication preferences and records of consent, objections or requests not to receive marketing.

We aim to collect only the personal data reasonably necessary for the relevant purpose.

3. How We Collect Personal Data

We may collect personal data:

• Directly from you when you contact us, submit a Website form, request information or engage our Services;
• During telephone calls, meetings, property visits, inspections or other communications;
• When a client appoints us to manage or assist with a property;
• From landlords, property owners, tenants, occupiers, managing agents or other people connected with a Property;
• From contractors, suppliers, insurers, professional advisers and other service providers;
• From public authorities, regulators or emergency services where appropriate;
• From publicly available sources, including Companies House, HM Land Registry and professional or business directories;
• From documents relating to a property, lease, contract, transaction, incident or legal obligation; and
• Through cookies and similar technologies used on the Website, subject to applicable consent requirements.

If you provide personal data about another person, you should ensure that you are authorised to do so and that the individual has been given appropriate privacy information where required.

4. How We Use Personal Data

We may use personal data to:

• Respond to enquiries and provide requested information;
• Prepare proposals, quotations and service agreements;
• Provide and administer commercial property management Services;
• Communicate with clients, tenants, occupiers, contractors, suppliers and advisers;
• Administer leases, rent, service charges, invoices, expenditure and financial reporting;
• Coordinate inspections, maintenance, repairs and contractor access;
• Support health and safety, insurance, environmental and regulatory compliance;
• Maintain appropriate property, client and business records;
• Manage complaints, disputes, incidents, insurance claims and legal matters;
• Prevent and detect fraud, misuse, security incidents and unlawful activity;
• Operate, maintain, secure and improve the Website and our business systems;
• Send relevant business communications or marketing where permitted; and
• Comply with applicable legal, tax, accounting, regulatory and professional obligations.

We will not use personal data for a materially different purpose without first considering whether that use is lawful and whether further privacy information is required.

5. Our Lawful Bases for Processing

We must have a lawful basis for each purpose for which we process personal data. Depending on the circumstances, we may rely on:

Contract

We may process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract.

This may include responding to a service enquiry, preparing a proposal, delivering agreed Services, issuing invoices and managing payments.

Legal Obligation

We may process personal data where necessary to comply with a legal or regulatory obligation.

This may include tax and accounting requirements, health and safety responsibilities, statutory property obligations, responding to lawful requests and maintaining legally required records.

Legitimate Interests

We may process personal data where necessary for our legitimate interests or those of a client or third party, provided those interests are not overridden by your rights and freedoms.

Relevant legitimate interests may include:

• Operating and administering our property management business;
• Managing commercial properties on behalf of clients;
• Communicating with business contacts, tenants, occupiers and contractors;
• Maintaining accurate property and business records;
• Recovering debts and protecting legal rights;
• Handling disputes, complaints and insurance matters;
• Protecting properties, people, systems and business information; and
• Improving our Services and Website.

Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against the rights and reasonable expectations of the individuals affected.

Consent

We may rely on consent where you have made a freely given, specific, informed and unambiguous choice. This may apply to certain marketing communications, non-essential cookies or particular uses of sensitive information.

You may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Vital Interests

In exceptional circumstances, we may process personal data where necessary to protect somebody’s life or physical safety, such as during a serious emergency at a Property.

6. Special Category Data

Special category data is personal data which requires additional protection. It may include information about health, disability, racial or ethnic origin, religious beliefs, trade-union membership, sexual orientation or biometric information used for identification.

We do not routinely seek to collect special category data. However, limited information may occasionally be provided or become relevant to accessibility, health and safety, emergency arrangements, legal claims or the appropriate management of a Property.

Where we process special category data, we will do so only where necessary and where both a lawful basis and an appropriate additional legal condition apply. Depending on the circumstances, this may include explicit consent, protection of vital interests or the establishment, exercise or defence of legal claims.

Please avoid supplying sensitive personal data unless it is relevant and reasonably necessary.

7. Sharing Personal Data

Where necessary and lawful, we may share personal data with:

• Property owners, landlords and clients who have appointed us;
• Tenants, occupiers or other authorised property contacts;
• Contractors, maintenance providers and suppliers;
• IT, hosting, email, document-storage and other business service providers;
• Payment, banking, accountancy and financial administration providers;
• Professional advisers, including solicitors, accountants, surveyors, insurers and insurance brokers;
• Utility providers and other property-related service providers;
• Local authorities, emergency services, regulators, courts and government bodies;
• Debt-recovery providers where payment remains outstanding;
• A purchaser, investor or adviser involved in a proposed sale, merger or restructuring of our business; and
• Other parties where you have authorised disclosure or where disclosure is required or permitted by law.

We require service providers processing personal data on our behalf to use it only for authorised purposes and to maintain appropriate security and confidentiality.

We do not sell personal data.

8. International Data Transfers

Some of our technology or service providers may process or store personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take reasonable steps to ensure an appropriate legal safeguard is in place. Depending on the destination and circumstances, this may include:

• A UK adequacy regulation recognising the destination as providing adequate protection;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved contractual clauses;
• Another safeguard permitted by UK data-protection law; or
• An applicable legal exception in limited circumstances.

You may contact us for further information about the safeguards relevant to your personal data.

9. Marketing Communications

We may send relevant business communications where you have requested them, given consent or where another lawful basis permits us to do so.

Electronic marketing will be sent in accordance with applicable data-protection and electronic-communications rules. You may ask us to stop sending marketing at any time by:

• Using the unsubscribe option in a marketing message, where provided; or
• Emailing info@southwestcpm.co.uk.

After an objection or unsubscribe request, we may retain limited information on a suppression list so that we can respect your preference.

Service, contractual, safety and administrative communications are not marketing and may still be sent where necessary.

10. Automated Decision-Making

We do not currently use personal data to make decisions based solely on automated processing which produce legal or similarly significant effects.

If this changes, we will provide appropriate information about the processing, its significance and your applicable rights before it begins.

11. Artificial Intelligence and Technology-Assisted Tools

We may use artificial intelligence, automation and other technology-assisted tools to support the operation of our business and the delivery of our Services, including administration, organisation of information, document review, preparation of correspondence and reports, research and analysis. Where personal data is processed using such tools, we remain responsible for its use and apply appropriate data-protection, confidentiality and security measures having regard to the nature and sensitivity of the information. We do not use artificial intelligence as the sole basis for decisions which produce legal or similarly significant effects on individuals.

12. Data Security

We use appropriate organisational and technical measures intended to protect personal data against accidental or unlawful loss, alteration, destruction, disclosure or access.

These measures may include access controls, account security, appropriate technology protections, secure storage, backups, staff and contractor confidentiality requirements, and procedures for responding to suspected data breaches.

Access to personal data is limited to people who have a legitimate need to use it. Those people must process the information only for authorised purposes and are subject to appropriate confidentiality obligations.

No internet-based system can be guaranteed completely secure. If we become aware of a personal data breach, we will assess it and notify affected individuals and the Information Commissioner’s Office where required by law.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, regulatory, tax, accounting, insurance and reporting requirements.

When determining an appropriate retention period, we consider:

• The amount, nature and sensitivity of the personal data;
• The purposes for which it is processed;
• The risk of harm from unauthorised use or disclosure;
• Whether the purpose can be achieved in another way;
• The duration of the relevant contract or property management relationship;
• Applicable legal and professional requirements; and
• Relevant limitation periods for legal claims.

Core contractual, property management, accounting and transaction records will commonly be retained for up to six years after the end of the relevant relationship or financial period. Some records may need to be retained for a longer or shorter period depending on their nature and applicable legal requirements.

Marketing preferences may be retained for as long as necessary to respect an objection or unsubscribe request. Cookie-related retention periods are explained in our Cookie Policy or cookie settings tool.

When personal data is no longer required, we will securely delete, destroy or anonymise it where reasonably practicable.

14. Your Data Protection Rights

Depending on the circumstances and lawful basis used, you may have the right to:

• Access: Ask for confirmation that we process your personal data and request a copy.
• Rectification: Ask us to correct inaccurate or incomplete personal data.
• Erasure: Ask us to delete personal data where there is no lawful reason for us to continue processing it.
• Restriction: Ask us to restrict the processing of personal data in certain circumstances.
• Object: Object to processing based on legitimate interests and object at any time to processing for direct marketing.
• Data portability: Ask us to provide personal data you supplied in a structured, commonly used and machine-readable format where the right applies.
• Withdraw consent: Withdraw consent at any time where consent is the lawful basis.
• Automated decisions: Exercise applicable rights concerning qualifying solely automated decisions.

These rights are not absolute and may be subject to exemptions or other legal requirements.

To exercise a right, please email info@southwestcpm.co.uk or write to our registered office. Please explain which right you wish to exercise and provide enough information for us to identify the relevant records.

We may request reasonable proof of identity where necessary to protect personal data against unauthorised disclosure.

There is normally no fee for exercising a data-protection right. We will respond without undue delay and normally within one month, although the law allows additional time in certain circumstances. We will tell you if an extension or exemption applies.

15. Cookies

The Website may use cookies and similar technologies for essential functionality and, with the appropriate consent, analytics, preferences or marketing.

For further information about the types of cookies we may use and how to manage your choices, please read our Cookie Policy.

16. Complaints

If you have a concern about how we use personal data, please contact us first so that we have an opportunity to investigate and respond.

Email: info@southwestcpm.co.uk
Telephone: 01872 301801

You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK regulator for data protection:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our Services, business practices, technology or legal obligations.

The updated version will be published on this page and the “Last updated” date will be revised. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals before the new processing begins where required.

18. Contact Us

Questions about this Privacy Policy, our use of personal data or a data-protection rights request should be sent to:

South West CPM Limited
Company number: 16309531
Bickland House
Bickland Water Road
Falmouth
Cornwall
England
TR11 4SB

Email: info@southwestcpm.co.uk
Telephone: 01872 301801
Website: southwestcpm.co.uk