Home
Privacy Policy

Privacy Policy

Updated 14 May 2026

Picton Property Income Limited and its subsidiaries (‘Picton’, ‘we’ or ‘us’) have created the following policy guidelines to let you know how we collect and use your personal data. We are the controller of the personal data processed under this privacy policy. Picton is committed to protecting your personal data and your rights in line with privacy legislation.

About this privacy policy

This privacy policy tells you about how we use, protect and disclose personal data relating to you (‘you’ and ‘your’) that we have collected including in connection with the use of our website (including when you complete any forms on this website) or when you interact with us through other means.

Our website may, from time to time, contain links to and from the websites of our partners and affiliates, such as property agents. Please be aware that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services, such as contact and location data. Please check these policies before you submit any personal data to these websites or use these services. This privacy policy does not apply to the practices of such other websites.

What information we collect

We may collect, use and store the following personal data. Please note that we may combine personal data collected from one source with personal data that we have collected from other sources.

Your biographical, identity and contact details - This personal data may include name, email address, address, telephone number and other contact details, business information, marketing preferences, username or similar identifier, marital status, title, date of birth and gender. We may also collect information to verify your identity and for business acceptance. This may include information relating to finance (including credit checks using third party service providers), collection of passport information, national insurance number and driving licence and certain administration and anti-money laundering checks.
Correspondence and interactions with us - We collect personal data where you contact us or we contact you, and we will typically keep a record of such correspondence. This personal data may include your name and contact information, account information, your queries, and other personal data you may choose to provide to us. We also collect personal data provided to us through testimonials, feedback, reviews or comments.
Financial Data – This data includes bank account details.
Technical Data - We may access metadata and other information associated with other files stored on your computer, tablet, mobile phone, or any other device such as IP address, domain name, browser version and operating system, plug-in types and versions, traffic data, web logs and other communication data, login data, time zone setting and location and device identifiers. To the extent required by applicable law, we will ask for your consent prior to collecting device information.
Usage Data – We collect information about how you use our website and services.
CCTV footage – We may collect personal data from CCTV and access controls in our properties.
Marketing and Communication Data - We will keep a record of your marketing preferences, any marketing we have previously issued to you and how you have interacted with marketing content received by us.
Collection and use of public information - We may also collect, use, store, transfer, share, and disclose your personal data that is publicly available for the purposes set out in this privacy policy.
Social media information - We maintain a presence on the social media platform, LinkedIn. We collect personal data when you interact with us on social media. Please note that this social media platform may set cookies and other tracking technologies on your device when you visit its pages and when you navigate from its pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on this social medial platform). This social media platform will also be a data controller of your personal data. Information about how it collects and uses your personal data (and how it uses cookies and other technologies, including instructions on how you can disable these) can usually be found on its privacy policy and cookies policy on its website.

How do we collect your personal data

Picton typically collects personal data about occupiers, suppliers, contractors and website visitors through use of our website, website signups (for example, registering for email alerts), when occupiers contract with us for services and when individuals contact us directly. We may sometimes collect additional information from third parties including credit reference agencies.

We sometimes need to collect and use your personal data to enter into a contract with you or to perform our obligations under a contract with you, or because the law requires us to collect the personal data. If you don’t provide us with this information, we might not be able to enter a contract with you or perform it or provide services to you. In this case, we might have to cancel the contract you have with us, but we will notify you if this is the case.

How we use your data

We only process your information where it is lawful to do so. We use your personal information for several business purposes, and we have defined the legal grounds for doing so below:

To conduct our business - Including to enable use of our website to respond to queries, to carry out our obligations arising from any agreements entered into and to contact you in connection with the foregoing.

Lawful basis: Contract performance (if our contract is entered into with an individual) and in all other cases, legitimate interests (to enable us to perform our obligations and provide our website and wider services to you).

To provide communications (about updates and changes) and to provide technical and support - To communicate about updates to our business and website and to provide technical support and to respond to requests, comments, questions, or concerns, and to contact you if we have any issues with respect to the same. Such communications may be provided by various means, including emails and telephone.

To ensure our websites/applications content is relevant and to maintain the security of our website - To ensure that content from our websites/applications are presented in the most effective and secure manner.

Lawful basis: Legitimate interests (to allow us to improve our services).

For analytics and business development purposes - To analyse personal data in order to better understand our business and marketing requirements, and to better understand our business and develop our websites. This may include aggregating and/or de-identifying your personal data.

Lawful basis: Legitimate interests (to allow us to improve our services).

To provide marketing materials - To provide updates and offers, where you have chosen to receive these. We may also use personal data for marketing our own and our selected business partners’ products and services by mail, email, SMS and phone. We may also use personal data to market via social media. Where required by law, we will ask for consent at the time we collect the personal data to conduct these types of marketing and provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent or you may opt-out/change your marketing settings by contacting us. Please note that even if you opt-out of receiving marketing emails, you may still receive communications from us that are important and/or related to your interactions with us, or otherwise as required by law.

Lawful basis: Consent, legitimate interest (where we are not required to rely on consent) to keep you updated with news in relation to our products and services.

In connection with legal or regulatory obligations and to manage claims - We may process personal data to comply with our legal and regulatory requirements or dialogue with regulators/judicial proceedings/court orders and manage claims and litigation (as applicable) which may include disclosing personal data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so.

Lawful basis: Legal obligations, legitimate interests (to cooperate with law enforcement and regulatory authorities). With respect to special categories of personal data, we will usually rely on legal claims, substantial public interests (processing for the prevention and detection of fraud/crime) or very rarely where necessary, explicit consent.

To conduct certain checks on you, such as credit checks and anti-fraud checks - One or more of the Picton entities may access and use your personal data to conduct know your customer checks which may include credit checks and checks to prevent fraud and money laundering. Law enforcement agencies may access and use this information.

To reorganise or make changes to our business - In the event that we: (i) are subject to negotiations for the sale of our business or part thereof to a third party; (ii) are sold to a third party; or (iii) undergo a re-organisation, we may need to transfer personal data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analysing any proposed sale or re-organisation. We may also need to transfer personal data to that re-organised entity or third party after the sale or reorganisation.

Lawful basis: Legitimate interests (in order to allow us to change our business).

Cookies and similar technology

We use cookies and similar technologies. For more information, please refer to our cookies policy available on this website at https://www.picton.co.uk/site-services/cookies/

Who do we share data with and why

We may share or disclose personal data for the purposes and lawful bases set out above with third party organisations which includes subsidiaries and affiliates of Picton Property Income Limited, service providers such as processors who manage this website, business partners and our advisors. We may share your personal data we collect and process within the Picton Group.

We may disclose personal data as required by law, regulation and other binding requests (such as subpoenas and court orders), and when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, or legal process served on us.

Disclosure may be necessary in order to enforce agreements or to investigate potential breaches; or protect the rights, property or safety of Picton, our occupiers or others. This includes information with other companies and organisations for the purpose of fraud protection and credit risk reduction. As described above, we may also need to transfer personal data in the context of a reorganisation or sale of all or part of our business.

Transfer of data

Personal data may be accessed by staff or third parties in, transferred to, and/or stored at, a destination outside the country in which you are located. These countries may not provide the same level of data protection as your home country; however, we will take steps to ensure that personal data that is transferred outside a home country is safeguarded as in line with this privacy policy and applicable laws.

If transfers are made to other countries that are not deemed to provide adequate protections under EEA or UK law, we will ensure that such transfer is subject to appropriate safeguards in accordance with applicable data protection laws such as approved standard contractual clauses.

How we keep your data secure

We understand the importance of protecting your privacy and we take commercially reasonable efforts to protect the personal data under our control. Appropriate technical and organisational measures have been implemented to protect personal data. However, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our websites or through communications. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

If you are given user credentials (such as username and passwords), please keep these safe and do not disclose these to third parties.

Data retention

Our retention periods for personal data are based on business needs and legal requirements. We will retain personal data while we are using it, for purposes described above. We may continue to retain it after we have ceased such uses for certain legitimate business purposes. We may also continue to retain personal data to meet our legal requirements or to defend or exercise our legal rights.

The length of time for which we will retain personal data will depend on the purposes for which we need to retain it. After we no longer need to retain personal data, we will delete it, anonymise it, or securely destroy it.

Your rights and access to data

When a request to exercise certain rights in relation to personal data is made, we will need to check the entitlement prior to answering a request. Under data protection legislation, you have the right to:

Be provided with details about what personal data we hold about you and to be provided with a copy of your personal data;
Ask us to correct your information if it is incorrect;
Ask us to delete the information that we hold about you in certain circumstances, for example, where we no longer need the information;
Opt-out of us processing your personal information for marketing purposes or withdraw consent (where our processing activity is based on your consent);
Ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer;
Restrict certain processing of your information, for example, if you tell us that the information is inaccurate, we can only use it for limited purposes while we check its accuracy;
Restrict how we use your personal data whilst a complaint is being investigated; and
Object to our processing of your personal data (where our processing is based on our legitimate interests).

To submit a request regarding personal data, please contact us using the information below.

Changes to this policy

Any changes we may make to our privacy policy in the future will be posted on our website.

This privacy policy was last updated on 14 May 2026.

Contacting us

Questions, comments and requests regarding this privacy policy should be addressed to the Data Protection Officer at Picton on Tel: +44 (0)20 7628 4800 or email us at [email protected]

If you are dissatisfied about how we process your personal information and are still not satisfied with how we have addressed your complaint or concerns you can contact the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. This can be done at https://ico.org.uk/concerns/