“We”, “our” or “us” means M&G Affordable Living RP Limited (M&G). We are part of the M&G Investment group; a list of the key entities within that group is available here.

This privacy policy explains how we use personal data that we collect and process on this website. That personal data relates to residents of our shared ownership properties, and other users of this website (“you”).

M&G is the data controller in respect of the personal information we hold about you. This means that we are responsible for deciding how we hold and use personal information about you.

Although we own shared ownership properties, we will typically have arrangements in place for the overall management of the properties; including, in some cases, with housing associations. We and the relevant property manager or housing association are each independent controllers of your personal data; you will find further information about how they handle your personal data in their privacy policy or notice.

This privacy policy was last updated in January 2025. We will make changes to this policy from time to time by updating this page. Please contact the Data Protection Office if you have any questions regarding this policy:

M&G Data Protection Office
10 Fenchurch Avenue,
London,
EC3M 5AG

Email
Privacy.team@mandg.co.uk

Other sites linking to or from this website will have their own privacy policies. Please review these policies for information about how those third parties collect and process your data. We are not responsible for the privacy practices of other organisations.

What personal data we collect from you

We collect and process the following personal data about you:

  • Your name and contact details;
  • postal address;
  • email address;
  • mobile and fixed-line telephone numbers;
  • date of birth;
  • nationality;
  • occupation;
  • income;
  • information relating to your property; including valuations, rent and service charges;
  • financial information about your ownership of your property, and payments made in respect of it (including information on late payments);
  • the results of any background checks we need to carry out on you before you purchase a property (such as Know Your Customer checks and credit checks).

Note that when we collect the results of any background checks, that may involve our processing of “special category data” or information about criminal convictions and offences. “Special category data” is a term used to describe categories of personal data (such as personal data concerning health or revealing political opinions, racial or ethnic origin) which, like information about criminal convictions and offences, are afforded additional protection under data protection laws.

For all registered users of this website:

  • Log in details and pin numbers and/or passwords as necessary to set up and administer registered user accounts;
  • any enquiries, comments or complaints you submit to us through this website;
  • The IP address of the computer or device you are using to access our website (this is a number which recognises the computer or other device used to access the Internet. A web server automatically collects IP addresses and uses them to administer a website).

We may also receive personal data about you from third party sources such as:

  • Our property managers (including, in some cases, housing associations);
  • Public authorities; and
  • Credit reference agencies.

This may include personal data about your financial situation and credit worthiness. We use this personal data to ensure that your rent accounts are up to date, your needs in terms of the management of the property are met, the administration of the buildings is efficient and that you are able to afford the financial commitments you have entered into with us.

How we use your personal data

We use your personal data for the following purposes:

  • To manage our relationship with you;
  • To communicate with you, and to respond any enquiries, comments or complaints submitted by you through this website;
  • To manage and administer our business, and for client management and business development purposes;
  • To comply with our legal and regulatory obligations;
  • To manage our risk, and ensure compliance with our internal policies and procedures, including but not limited to the collection and processing of personal data for Know Your Customer checks and Customer Due Diligence;
  • To prevent, detect and investigate fraud and other financial crimes;
  • To establish, exercise and/or defend legal claims, to protect our business against fraud, theft, other financial or business crimes and/or other criminal activity;
  • To monitor and manage communications to and from us using our communications systems;
  • To protect the integrity and security of our systems;
  • Where necessary as part of any restructuring relating to:
    • M&G and its business or assets;
    • As part of a sale of M&G or, as relevant, another company in the M&G plc group, or its/their assets.

Call Recordings 

If you call us or we call you, we will normally record your call with us for quality service control and training purposes. We take compliance with privacy requirements very seriously and as a result we have conducted a legitimate interest assessment. In some instances, we may also record calls where we have a requirement to comply with legal and regulatory obligations – these legal and regulatory obligations may vary depending on the jurisdictions of where the call recording takes place. All calls recorded will be retained in accordance with our retention policies. You may have a right to access your call recordings with us. See the section below “Your Data Subject Rights and how to exercise them” for further information.

Sharing your personal data

We share your personal data with:

  • The relevant property manager (including, in some cases, housing associations) responsible for the management of your property, and any other third parties involved in the management or maintenance of the property;
  • Other companies within the M&G plc Group;
  • Our service providers, including providers of IT services and data storage;
  • Our legal, tax and other professional advisors, and auditors;
  • Tax, government and/or regulatory authorities;
  • Prosecuting authorities and courts, and/or other relevant third parties connected with legal proceedings or claims;
  • Fraud prevention and/or law enforcement agencies;
  • Third parties when we sell any business or assets (or enter into meaningful discussions about the possibility of doing so), in which case we may disclose your personal data to the prospective buyer of such business or assets and their advisers; and
  • Third parties where we are required to do so by law.

Some of these third parties (such as IT service providers) simply process your personal data on our behalf and on our instructions. However, others will be controllers in their own right, which means that they are also responsible to you directly for their use of your personal data.

Property managers (which will, in some cases, be housing associations) are also independent controllers of your personal data; you will find further information about how they handle your personal data in their privacy policy or notice.

Transfers of your personal data outside the UK

Your personal data may be transferred outside of the UK from time to time to members or businesses within the M&G plc Group, trusted service providers and other third parties; for example, we use outsourced service providers in India. These other countries have different, and sometimes lower, standards of data protection than those in the UK.

We require third parties to keep your personal data confidential and secure. We will ensure that suitable protection is maintained at all times by ensuring that appropriate safeguards are in place. But where we are required by law to disclose, we may not always have control over the terms under which we are required to share your personal data. We will make sure that any disclosure is lawful.

We will only transfer your personal data outside the UK using appropriate safeguards which include adequacy decisions determined by the UK Government or otherwise in compliance with applicable laws.

Retaining your personal data

We will retain your personal data for as long as is necessary for the purposes described above.

Our general retention period is 7 years from the date that our relationship with you, or the client with which you are connected, ends. We keep personal data for as long as it is required by us to perform our contractual obligations, or where longer to meet our legal or regulatory obligations.

We may keep your personal data for longer where this is necessary for statistical and historical research purposes. However, where we do this, we will ensure all personal data is removed where technically feasible.

We will always maintain the security and protection of any personal data we hold by putting in place administrative, technical and physical measures on our systems which are designed to guard against and minimise the risk of loss, misuse or unauthorised processing or disclosure of the personal data that it holds. We place similar obligations on our service partners and undertake robust risk assessments on their security measures.

Profiling and Automated Decision Making

We do not engage in any profiling activities with your personal data.

We do not use any automated processes to make decisions about you which produce legal or significant effects concerning you.

Your Data Subject Rights and how to exercise them

You have certain rights relating to the personal data we hold about you which are outlined below, they may be subject to various exceptions and limitations. You can exercise these rights at any time by contacting us. We may need to validate your identity to fulfil your request.

You have rights to:

Request access to the personal data we hold about you (Data Access Request)You may request access to a copy of the personal data we hold about you.
We can refuse to provide personal data where to do so may reveal another person’s personal data or would otherwise negatively impact another person’s rights.
Object to processing (Right to Object)You may object to us undertaking automated processes, or fully automating decision making, using your personal data except where used to detect, prevent and investigate fraud and other financial crimes.

You may also object to us using your personal data for direct marketing purposes. This includes any profiling we perform as part of our direct marketing activities. Once we receive and have processed your objection, we will stop using your personal data for these purposes.
Request a copy of your personal data (Data Portability)Where you gave us the personal data directly or via the contract you have with us, and it was processed electronically, you can request the personal data we hold on you in a commonly used machine-readable format.
Request that your personal data is deleted (Right to be Forgotten)You can ask us to delete the personal data we hold about you when it is no longer required for a legitimate business need, legal or regulatory obligations, where you have withdrawn your consent or is no longer required for the purposes it was collected.
Amend or correct your personal data (Right to Rectification)If you believe that the personal data we hold about you is inaccurate, incorrect or incomplete, please contact us as soon as possible so we can update it.
Restrict the processing of your personal data (Right to Restrict)You may ask us to restrict our processing of your personal data whilst we resolve any complaints you have about the way your personal data is used, require it for a legal claim, believe the personal data is not accurate, we no longer need the personal data, you have objected to the processing of your personal data or if you think our processing is unlawful but you do not want us to delete your personal data.
Rights in relation to consent (Right to Withdraw)At any time, you may withdraw the consent you granted for your personal data to be used for direct marketing. When you withdraw your consent, it will not affect the lawfulness of any past activities we have undertaken based on the previous consent.

Making a Data Protection complaint

If you have any concerns about the use of your personal data, or the way we handle your requests relating to your rights, you can raise a complaint directly with us using the contact details above.

If you are not satisfied with the way we handle your complaint, you are entitled to raise a complaint directly with the UK Information Commissioner’s Office via the details available on their website: https://www.ico.org.uk