NewArch Homes Privacy Notice

February 2026

We respect your data privacy and committed to handling your personal data in line with UK Data Protection Regulations such as UK General Data Protection Regulation (UK GDPR). References to “you” or “your” refer to you as an individual and the personal data we process in connection with your relationship with us.

1. About us
2. Management Partners
3. Your personal information
4. Your rights
5. Cookies
6. Security
7. Complaints
8. Changes to this Privacy Notice

About Us

NewArch Homes Limited (“NewArch”), the primary Data Controller, is a Registered Housing Provider and landlord whose operations are managed by appointment of Octopus Group. Our registered office is 6th Floor 33 Holborn, London, EC1N 2HT and ICO registration number is ZB544585.

Where necessary, your personal data may be shared within the Octopus Group, including its companies and brands, as well as with suppliers and subcontractors (acting as processors or sub-processors) who perform services on our behalf.

The Octopus Group includes:

Octopus Capital Limited (ICO registration number ZA171166)
Octopus Investments Limited and its subsidiary companies (ICO registration number Z6932923)

Management Partners

NewArch appoints Management Partners to manage homes, tenancies, and deliver landlord services. These partners act as data processors under our instruction and will be your main point of contact for day-to-day matters.

In some cases, Management Partners may process your data independently, acting as separate Data Controllers, in accordance with their own processes and governance. When this occurs, their own privacy notices will apply, and you should refer to those to understand how your data is used and your rights in that context.

Unless otherwise stated, references to “we”, “us”, or “our” in this Notice refer to the Octopus Group and us, NewArch, not our Management Partners.

This Privacy Notice explains how your personal data is processed by us, where you can download a pdf version of the Privacy Notice here.

Your personal information

The personal data we collect depends on who you are, as well as the particular products and services we provide to you. Our main purposes may include the fulfilling a contract (such as a lease requiring us to carry out repairs at your property), meet a legal requirement, such as regulatory reporting or for our legitimate interests.

1. How we collect your information

Most information will be taken from you directly, however in some circumstances may come from other third parties. This can include:

Employers,
Members of your family, neighbours, members of the public or previous landlords,
Local Authority services, Courts, or the National Anti-Fraud Network,
Doctors, Social workers or social services, or Mental health teams
Social media data relating to our services or our sites

2. What information do we collect?

Below are some of the main reasons when we collect and use personal information, to:

provide you with a suitable home, and manage your tenancy effectively;
monitor and maintain the properties, ensuring safety checks are carried out promptly;
manage and resolve complaints and deal with safeguarding concerns;
comply with reporting requirements for public or regulatory bodies like Homes England and Local Authorities;
work in partnership with other stakeholders and public services;
enable continuous improvement of our services and cost-effective delivery of our services.

We must have a lawful basis when processing your personal data where we may rely on:

Consent: Sometimes, we’ll ask for your permission to use your data. You can withdraw this consent at any time.
Contract: We may need your data to set up or manage a contract with you—for example, to provide housing services or respond to your queries.
Legal Duty: In some cases, the law requires us to collect or share your data—for example, with regulators or public authorities.
Legitimate Interests: We may use your data to run and improve our services, protect our tenants and staff, and manage our business. We’ll only do this when it doesn’t unfairly affect your rights or freedoms.
Substantial Public Interest: In rare cases, we may use your data to prevent economic harm or protect public safety, where the law allows us to do so.

For example, NewArch regularly collects and uses:

Reason for collecting	Data	Lawful basis
To communicate with you, when you reach out to us directly, or notified by our managing partners to contact you.	Contact details such as name, home address, e-mail address and telephone number.	Contract Legal obligation
To assess housing applications, support you to access public funding, collect rent and process payments.	Information which confirms your identity such as, photographic ID. Financial information such as your income, National Insurance number, benefit & tax credit entitlements, employment status and bank details	Contract Legal obligation
To understand your accessibility requirements and tailor our housing management services part of your housing services.	Information about your family status, health & wellbeing and welfare information, such as caring responsibilities, disabilities & chronic illness.	Contract Legal obligation
To prevent or detect crime and fraud, to monitor and prevent anti-social behaviour, to safeguard our tenants, staff and visitors to our premises.	Information relating to your conduct and behaviour, including details of any unspent criminal convictions.	Contract Legal obligation Reasons of substantial public interest
In relation to criminal convictions and offences (including allegations of criminal activity) to: assess if it is appropriate for us to provide you with or continue to provide you with accommodation;carry out risk assessments and to take appropriate measures to safeguard individuals (which may include reporting incidents to third parties);inform any specialised service or procedural adaptions you may need from us. We may use and share your personal data with third parties, for the purpose of preventing and detecting fraud.	Criminal Convictions Data; Allegations or offences. Court Proceedings.	Legal obligations

3. Other data

We may also process other data which may identify you as an individual such as Industry Data; Utility suppliers, historical utility usage, meter type, EPC etc.

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you. We will use aggregated and anonymised data for internal analytical purposes and for improving our service offering generally.

Whilst we do not carry out automated decision-making without meaningful human involvement, we may refer to automated reporting when considering individual circumstances. We carry out profiling to better understand our customers, inform our continuous improvement, offer support services and to improve our engagement with you.

a. Use of CCTV

Some homes, communal spaces and offices may have CCTV which may capture footage of pedestrians, vehicles and ingress/egress. This is necessary for the prevention and detection of crime and for protecting the safety of individuals, or the security of premises.

We comply with the ICO Guidance for organisations using CCTV and recordings are kept Where CCTV is in use, appropriate signage will be displayed. Recordings are generally kept for 28 days and will then be automatically deleted unless a complaint is raised and/or an investigation underway. We do not use of Automatic Number Plate Recognition (ANPR) or facial recognition technology on our premises.

We will provide copies of CCTV recordings to third parties (e.g. Police and Insurance Companies) where there is an appropriate lawful basis to do so.

b. Energy Usage Data

We have a legal obligation to report the carbon emissions from our homes and have also committed to a Net Zero strategy that means we must analyse this data to inform our decarbonisation investment programme.

As part of this, we need to quantify, track and reduce the carbon emissions associated with the buildings that we own. We work with Perse Technology Ltd, to obtain gas, electricity and associated carbon data. You can read about their privacy policy here.

We only use this data for the sustainability purposes described above and where it involves personal data, do so under the ground of legitimate interest. Public data will always be aggregated and never identify any one home or individual.

We will use the data for internal purposes (which may include sharing with consultants and other partners to help us meet our climate goals). However, we may publish aggregated data to discharge our legal and/ or voluntary obligations to report our carbon footprint. No public disclosures will include individual home usage data.

4. How long will we keep the data for?

We will not keep your personal data for longer than we need it for the purpose for which it is used. Different retention periods apply for different types of personal data. We normally keep customer data for the duration of any application and as long as someone remains a tenant, and then for a period of up to 6 years thereafter.

We may keep data for a longer period if it forms part of a record which we are legally required to keep, or where there has been a specific incident which forms a key record for the purpose of to establishing, exercising or defending a legal claim.

Once it is no longer necessary for us to hold your personal data, we will anonymise your personal data or securely destroy it.

5. Who might we share your personal information with?

We limit access to your personal data to those who have a genuine business need to access it. We have appropriate security measures to prevent personal data from being lost accidentally or used or accessed unlawfully.

Your data will largely only be used by NewArch and our Management Partners, to fulfil our shared role to you as landlord services providers. There will be times when we will need to share personal information with third parties for the purposes outlined in this Privacy Notice or where we are legally required to do so. This may include but not limited to the following:

Local Authorities
Health Care Providers
Emergency Services
Utility Companies
Social Services
Debt Collection Agencies
DWP & Universal Credit
Repairs Contractors and Sub-Contractors
External auditors and professional advisors, who are subject to confidentiality obligations

When sharing personal information, we will comply with all aspects of the UK-GDPR. We do not rely on consent to share your personal data, including special category data, unless we specifically ask for it.

6. Transferring information outside the EU

We may transfer limited personal and special category information outside of the European Economic Area (EEA), including the US, as part of contractual arrangements with third party suppliers, in order to fulfil our legal basis for processing as set out above. We will ensure we have an appropriate transfer mechanism and safeguards in place in accordance with UK-GDPR and guidance from the ICO.

We do not sell your data to any third parties.

Your rights

We want to make sure you are aware of your rights in relation to the information and/or personal data that we process about you. We have described those rights and the circumstances in which they apply, in the table below and you can contact us at [email protected] to exercise your rights:

Rights	Description
Access	You have the right to access and/or obtain your information and/or personal data that we hold about you.
Rectification	If you believe that any of the information and/or personal data that we hold about you is inaccurate, you have the right to inform us and as us to rectify it.
Erasure (the right to be forgotten)	You have the right to ask that we delete your personal data—in certain situations. You may request that we delete your information and/or personal data, if you believe that: • we no longer need to process your information and/or data for the purposes for which it was provided; • we have requested your permission to process your information and/or data and you wish to withdraw your consent; or • we are not using your information and/or data in a lawful manner.
Restriction	You have the right to ask that we stop processing your personal data for particular purposes—in certain situations. This right can be exercised under any of these circumstances: • when you believe that the information and/or personal data that we hold about you is inaccurate and thereafter, we will need time to verify the accuracy; • we have processed your information and/or personal data unlawfully however, you would prefer to restrict the processing instead of erasure; • we have requested your permission to process your information and/or data and you wish to withdraw your consent; or • we are not using your information and/or data in a lawful manner.
Portability	You have a right to receive the information and/or personal data you provided to us in a in a structured, commonly used and machine-readable format and/or transmit that data to a third party. This is an extension to your right of access. Please note that this right is only applicable to electronic processing of your personal data and when the information and/or personal data is collected directly from the individual requesting to exercise this right. We will attend to your request only if the information and/or personal data is being processed based on your consent or contractual necessity. You may also request us to provide it directly to a third party, if technically feasible.
Object	You have a right to object at any time to processing of your information and/or personal data for direct marketing purposes, including profiling you for the purposes of direct marketing. We do not carry out processing that involves automated decision making that may affect the rights or produces legal effect on our employees, investors and/or customers. In certain circumstances, you may object to our processing your personal data, eg processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims.
Automated decision-making	You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
Withdraw consent	If you have provided us with a consent to use your personal data, you have a right to withdraw that consent easily at any time. You may withdraw consent at any time, for example by contacting us using the details below. Withdrawing consent will not affect the lawfulness of how we have used your personal data, up to the point you withdraw consent. For example, it is not always possible to withdraw or destroy marketing materials which have already been published and circulated. We generally do not rely on your consent to process data.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This helps us ensure that personal information is not disclosed to any person who has no right to receive it.

Cookies

We collect information when you visit and browse our website or use an App we have provided. We rely on explicit consent and/or the legitimate interest of the business as the legal basis to process your information and/or personal data. We will use your information to contact you and provide the necessary service relevant to the purpose of using our website/app. It will also help us to improvise the usage and functionality of our website and any apps. Personal data will be held in our online system for 3 (three) months after it being submitted. Please refer to our Cookie Notice for more information and how we handle your personal data.

Security

We take all steps reasonably necessary to ensure that your information and/or personal data is treated securely and in accordance with this Privacy Notice.

We implement strict procedures and security features to protect your information and/or personal data to prevent unauthorised access. Unfortunately, the transmission of information via the internet sometimes may not be completely secured from any malicious online attack, however, we will do our best to protect your information and/or personal data while we retain it for our purpose.

Complaints

If you wish to raise a complaint on how we have handled your information or to exercise your rights in the table above, you can contact our Data Protection Team using the details below:

Email: [email protected]
Write to us at: Data Protection, NewArch Homes Ltd, 6^th Floor, 33 Holborn, London, EC1N 2HT

We hope that we can address any concerns you may have, but you can always contact the Information Commissioner’s Office (ICO) to further inquire or to lodge your complaint by visiting their page at https://ico.org.uk/global/contact-us/

Changes to this Privacy Notice

We keep our Privacy Notice under regular review and is subject to changes when we undertake any new or amended data processing. If you have any questions about this Privacy Notice or our use of your information and/or personal data you can contact us at [email protected].