Who we are
True North Management Ltd ("TNM", "we", "us", "our") is a London-based, vertically integrated flexible living real estate investment and management company. We are the controller of the personal data described in this policy.
Company number 13513993. Registered office: 4th Floor, 95 Gresham Street, London, EC2V 7AB. For any privacy question or to exercise your rights, contact our IT Admin at it_admin@truenorthm.com or write to us at the address above, marked "Data Protection".
Scope
This policy explains how we collect and use personal data about: visitors to our website; people who contact us or subscribe to our updates; investors, prospective investors, co-investors, lenders and their representatives; vendors, agents, joint venture partners, contractors, consultants and suppliers and their staff; job applicants; and attendees at our events and site visits.
Personal data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, job title, employer, email address, telephone number, postal address, LinkedIn profile. |
| Enquiry and correspondence data | Content of messages, enquiry forms, meeting notes, call records, event attendance and dietary or access requirements you choose to share. |
| Technical and usage data | IP address, device type, browser, operating system, referring URL and the pages requested, as recorded in our hosting provider's standard logs. Our website does not use cookies or analytics; see our Cookie Policy. |
| Marketing preferences | Subscriptions to news or investor updates, your communication preferences, and whether emails are opened or links clicked. |
| Investor and counterparty due diligence (KYC/AML) data | Proof of identity and address, date of birth, nationality, beneficial ownership information, source of funds/wealth, PEP and sanctions screening results, tax residency and identification numbers (FATCA/CRS). |
| Transaction and relationship data | Commitments, investment holdings, bank details for distributions, contractual records, and details of your role in a transaction. |
| Recruitment data | CV, qualifications, employment history, references, right-to-work documentation and interview notes. |
We do not intentionally collect special category data (such as health information) through our website. If you volunteer it (for example, accessibility requirements for a site visit), we will use it only for that purpose. Criminal offence data may be processed as part of AML/sanctions screening where permitted by law.
How we collect it
- Directly from you: when you email or call us, subscribe, apply for a role, attend an event or enter into a transaction with us.
- Automatically: through our hosting provider's standard server logs when you visit our website, and by the services that deliver our fonts (Google Fonts) and maps (OpenStreetMap), which receive your IP address and browser details in order to send content to your device. None of these set cookies on our website.
- From third parties: your employer or organisation, placement agents, introducers and advisers, identity verification and screening providers, publicly available sources (e.g. Companies House, LinkedIn, press), recruitment agencies and referees.
Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Responding to enquiries and managing our relationship with you or your organisation | Legitimate interests (running and developing our business); contract where you are a party |
| Operating, securing and maintaining our website, including delivering its fonts and maps; detecting and preventing fraud and misuse | Legitimate interests (keeping our site secure and functional) |
| Sending news, insights, investor updates and event invitations | Legitimate interests for business contacts (corporate subscribers); consent where required by PECR (e.g. individual subscribers / sole traders). You can unsubscribe at any time |
| Investor onboarding, KYC/AML, sanctions and tax reporting (FATCA/CRS) | Legal obligation; legitimate interests; substantial public interest (preventing or detecting unlawful acts) for criminal offence data |
| Entering into and performing contracts with investors, lenders, partners, contractors and suppliers | Contract; legitimate interests (where you act on behalf of an organisation) |
| Recruitment | Steps prior to entering a contract; legal obligation (right-to-work checks); legitimate interests |
| Complying with law, regulation and requests from authorities; establishing, exercising or defending legal claims | Legal obligation; legitimate interests |
| Business reorganisations, financings or sale of assets or interests | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this assessment. We do not use your personal data for automated decision-making that produces legal or similarly significant effects.
Who we share it with
- TNM group companies, joint ventures, funds and vehicles we manage or advise, and our operating platforms, where needed for the purposes above;
- co-investors, joint venture partners, lenders and fund administrators, where you are involved in a relevant transaction;
- service providers acting on our behalf, including website hosting and development, analytics, CRM and email marketing platforms, IT and cloud providers, KYC/AML screening providers, event organisers and recruitment platforms;
- professional advisers, including lawyers, accountants, auditors, valuers, tax advisers and insurers;
- regulators, HMRC, law enforcement, courts and other public authorities where required or permitted by law; and
- a prospective buyer, investor or successor in connection with any reorganisation, sale or financing, subject to confidentiality.
Our website is hosted and delivered by Cloudflare, Inc. Its typefaces are delivered by Google Fonts (Google LLC) and its maps by the OpenStreetMap Foundation.
We do not sell your personal data.
International transfers
Some of our service providers and counterparties are located outside the UK, including in the European Economic Area, Switzerland and the United States. Where we transfer personal data outside the UK, we ensure that it is protected by: a UK adequacy regulation (for example, for the EEA and Switzerland, and for certified organisations under the UK Extension to the EU-US Data Privacy Framework); the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or another lawful transfer mechanism. Contact us for further details.
How long we keep it
| Data | Typical retention period |
|---|---|
| General enquiries and correspondence | Up to 2 years from the last contact, unless a relationship develops |
| Marketing contacts | Until you unsubscribe or object; we keep a suppression record so we respect your choice |
| Investor and KYC/AML records | 5 years after the end of the business relationship or transaction (Money Laundering Regulations 2017), or longer where required by law |
| Contract and transaction records | 7 years after the end of the contract, or up to 15 years for deeds and limitation purposes |
| Unsuccessful job applicants | 6 months after the recruitment decision, unless you agree to us keeping your details for future roles |
| Website technical data | Our website does not use analytics. Hosting logs are kept by our hosting provider for operation and security, in line with its standard retention. |
Your rights
Under UK data protection law you have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request erasure of your data in certain circumstances;
- restrict or object to our processing, including where we rely on legitimate interests;
- object at any time to direct marketing (we will always stop);
- receive data you provided to us in a portable format, where processing is based on consent or contract and carried out by automated means; and
- withdraw consent at any time, where we rely on consent (this does not affect processing already carried out).
To exercise any right, email our IT Admin at it_admin@truenorthm.com. We will respond without undue delay and in any event within one month (which may be extended in certain circumstances). We may need to verify your identity, and may carry out reasonable and proportionate searches in response to an access request.
Complaints
If you have a concern about how we handle your personal data, please contact us first at it_admin@truenorthm.com so that we can try to resolve it. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ico.org.uk; 0303 123 1113).
Security
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, multi-factor authentication and supplier due diligence. No internet transmission is completely secure; please do not send sensitive documents (such as passports or bank details) by unencrypted email unless we have asked you to use a secure channel.
Children
Our website is intended for business users and is not directed at children under 18. We do not knowingly collect their personal data.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the "last updated" date shown above. Where changes are significant, we will take reasonable steps to notify you.