1. Introduction
The Key 4 UK Cities Limited ("The Key", "we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website, use our key worker application, register your interest in a home, or engage with us as an investor, partner or landowner.
This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Please read it carefully. By using our website or services, you acknowledge the practices described here.
2. Who we are
For the purposes of UK data protection law, the data controller is:
- The Key 4 UK Cities Limited, a company registered in England and Wales (company number 11619717).
- Registered office: 101 New Cavendish Street, London, W1W 6XH.
- ICO registration number: ZB557373.
Our designated data protection contact is the CEO, Kaveh Mobasheri, our Data Protection Lead, who is responsible for overseeing questions in relation to this policy. While we are not required by law to appoint a statutory Data Protection Officer, we have appointed an internal lead for data protection matters. If you have any questions about this policy or how we handle your data, contact us at info@thekey4ukcities.com or write to the Data Protection Lead at the registered office above.
3. The personal data we collect
We collect and process the following categories of personal data:
Information you give us
- Identity & contact data: name, email address, telephone number and postal address.
- Eligibility data: employer, occupation/profession, key worker status, place of work and, where you choose to provide it, household income and household composition, so we can assess eligibility for our homes.
- Account data: login credentials and preferences if you create an account in our key worker application.
- Investor, partner & landowner data: your organisation, role, and the contents of enquiries or correspondence, including requests for access to our investor data room.
- Communications: the content of messages you send us by email, web form or in-app messaging.
Information we collect automatically
- Technical data: IP address, browser type and version, device information, operating system and time-zone setting.
- Usage data: pages viewed, links clicked, and how you navigate the website. This is collected through cookieless analytics, which measure how the site is used in aggregate without storing anything on your device (see our Cookie Policy).
Information from third parties
- Analytics providers and our hosting platform.
- Where relevant, employers or partner organisations who refer key workers to us, and publicly available sources for investor due-diligence.
4. How we use your data and our lawful bases
We only use your personal data where the law allows. The lawful bases we rely on under Article 6 of the UK GDPR are set out below.
| Purpose | Lawful basis |
|---|---|
| To assess your eligibility for, and to allocate, key worker homes | Performance of a contract; legitimate interests |
| To create and administer your account in our application | Performance of a contract |
| To respond to your enquiries and provide customer support | Legitimate interests; performance of a contract |
| To manage investor, partner and landowner relationships and grant data room access | Legitimate interests; performance of a contract |
| To send you updates about developments and opportunities you have asked to hear about | Consent; legitimate interests |
| To send direct marketing to existing contacts, transmit personal data within our group for internal administrative purposes, and ensure the security of our network and information systems | Recognised legitimate interests |
| To operate, secure, analyse and improve our website and services | Legitimate interests |
| To comply with legal, regulatory and accounting obligations | Legal obligation |
Recognised legitimate interests. The Data (Use and Access) Act 2025 introduced a lawful basis known as "recognised legitimate interests". Where we rely on this basis for a limited and defined set of activities, such as direct marketing to existing contacts, transmitting personal data within our group for internal administrative purposes, and ensuring the security of our network and information systems, we are not required to carry out a balancing test. The processing must still be necessary for the relevant purpose, and we remain bound by the wider principles of the UK GDPR.
Where we rely on consent (for example, for certain marketing emails), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms.
5. Income and eligibility information
To assess affordability and eligibility, you may choose to provide details such as your household income and employment. We treat this information as confidential and use it only to determine eligibility and the terms on which a home may be offered. We do not intentionally collect "special category" data (such as health or ethnicity) through our website, and ask that you do not send it to us unless we specifically request it.
Providing your eligibility and income information is a contractual requirement rather than a statutory one. You are not obliged by law to provide it, but if you choose not to, we will be unable to assess your eligibility for our homes or to offer you a home, or to determine the terms on which one might be made available to you.
6. Automated decision-making and profiling
We do not currently make decisions about you, including decisions about your eligibility for a home, based solely on automated processing without meaningful human involvement. Our eligibility and affordability assessments are reviewed by a member of our team.
If this changes and we introduce any solely-automated decision that produces a legal effect for you, or that otherwise significantly affects you, we will tell you before we do so and put appropriate safeguards in place. In particular, you will have the right to be given information about the decision, to make representations about it, to obtain human intervention, and to contest the decision. Where any such decision would be based on special category data, we will only carry it out where we have your explicit consent or another lawful condition applies.
8. International transfers
Some of our service providers are located outside the United Kingdom, including in the United States. Where we transfer your personal data outside the UK, we ensure an appropriate safeguard is in place, such as a UK adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, so that your data receives a level of protection consistent with UK law.
9. How long we keep your data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. In general:
- Enquiry and applicant data is retained for the duration of our relationship and for a reasonable period afterwards.
- Tenancy, financial and transaction records are kept for the periods required by law (typically up to six years).
- Marketing data is kept until you unsubscribe or otherwise withdraw consent.
When data is no longer needed, we securely delete or anonymise it.
10. Your rights
Under UK data protection law you have the right to:
- request access to a copy of your personal data;
- request correction of inaccurate or incomplete data;
- request erasure of your data in certain circumstances;
- object to, or request restriction of, our processing;
- request the transfer of your data (data portability);
- withdraw consent at any time where we rely on consent;
- raise a concern or complaint with us directly (see section 11); and
- lodge a complaint with the supervisory authority.
To exercise any of these rights, email info@thekey4ukcities.com. We will respond within one month. There is normally no charge.
11. How to raise a concern or complaint
If you have any concern about how we handle your personal data, you have the right to complain to us directly, and we would welcome the opportunity to put things right. You can raise a complaint by emailing info@thekey4ukcities.com, or by writing to our Data Protection Lead at the registered office above, marking your correspondence "Data Protection Complaint".
We will acknowledge your complaint within 30 days of receiving it. We will then look into the matter, make any appropriate enquiries, and take appropriate steps to respond without undue delay, keeping you informed of the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO) at any time (see section 16). We would, however, appreciate the chance to address your concerns first.
12. How we protect your data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including encryption in transit, access controls and restricting access to those who need it. No method of transmission over the internet is completely secure, but we take all reasonable steps to protect your information.
14. Children
Our website and services are intended for adults and are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
Where any part of our services is likely to be accessed by children, we take into account the higher protection that children's personal data merits under the UK GDPR, as reinforced by the Data (Use and Access) Act 2025. This includes how best to protect and support children when using the service, and the fact that children may be less aware of the risks involved in the processing of their data and of their rights.
15. Changes to this policy
We may update this Privacy Policy from time to time. The "last updated" date at the top of this page shows when it was last revised. Material changes will be notified through the website or, where appropriate, directly to you.
16. How to contact us
For any questions about this policy or to exercise your rights, contact our Data Protection Lead at info@thekey4ukcities.com. To raise a concern or complaint about how we handle your data, please see section 11.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.