This policy (together with our Cookie Policy) sets out how we use any personal data that we collect from you or that you provide to us via this consultation website and any related services, including community engagement, planning consultation, stakeholder communications, and public affairs activities undertaken in connection with Shaftesbury Capital’s estates and projects.

This policy does not cover third-party websites that may be linked from this site.

Please read this policy carefully to understand how your personal data will be used. By using this site you agree that we may process and use your personal data in accordance with this policy.

You may unsubscribe from news and information communications at any time by clicking the unsubscribe link in any email sent from this website, or by emailing the contact address below. If you unsubscribe, we will not retain the data you submitted when you subscribed and will cease sending you communications.

Data Controller

The Data Controller in respect of the personal data collected through this website is:

Capital & Counties CG Limited (as General Partner of Capital & Counties CGP), Shaftesbury CG Limited and Covent Garden Holdings (No.3) Limited

Regal House, 14 James Street, London, WC2E 8BU

Email: feedback@shaftesburycapital.com

Website Operator (Data Processor)

This website is operated and managed on behalf of Shaftesbury Capital by:

Hedry Ltd

The Forge, 133 Park Street, London, SE1 9EA

Email: data@hedry.co.uk

Company Registration No: 16452050

Hedry processes personal data solely on behalf of and under the instruction of Shaftesbury Capital, in accordance with a formal data processing agreement between the two organisations.

We ensure that your personal information is processed lawfully, transparently, and for a specific purpose. Once that purpose is fulfilled, your data is no longer retained. The grounds for processing your information include:

• Contractual necessity: where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal compliance: where processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
• Explicit consent: where you have given clear consent for us to process your personal data for one or more specific purposes.
• Legitimate interests: where processing is necessary for the legitimate interests pursued by Shaftesbury Capital, except where such interests are overridden by your fundamental rights and freedoms.

We will only use your personal data for the purpose for which we collected it.

We collect personal information necessary for service provision, including but not limited to name, address, email address, and telephone number. This information is used for:

• Delivering and administering consultation and engagement activities relating to Shaftesbury Capital’s estates and projects.
• Communicating updates on projects, planning applications, and community matters.
• Improving the content and operation of this website.
• Compiling consultation feedback reports to inform planning applications and engagement strategies.
• Complying with any legal obligations.

We do not make any automated decisions using your personal information.

Consultation-Specific Information

Hedry organises surveys, public exhibitions, workshops, and other engagement activities as part of community consultation work for Shaftesbury Capital. We collect data during these consultations to help inform and evidence planning applications and engagement reports.

This information is used solely for the relevant consultation. It is not transferred to Hedry’s core marketing databases. It may be shared with Shaftesbury Capital (as the commissioning client), the consultant team, and the relevant local planning authority. It is never shared more widely.

Where name and contact details are collected via this website or at events, we include a consent mechanism. Only those who opt in will receive future updates, and only on the specific consultation topic.

Mailing List and Communications

If you subscribe to receive updates via this website, your details will be held securely and used only to send you information about the projects and activities of Shaftesbury Capital’s estates covered by this site. Each communication will include an unsubscribe option. Where your personal information is not already publicly available, a double opt-in process is used, requiring you to confirm your subscription via email.

We gather anonymised statistics around email engagement (such as open and click-through rates) to help monitor and improve our communications. Mailing list data is never shared with any third party for marketing purposes.

We may disclose your personal data to the following recipients:

• Shaftesbury Capital group companies: including any company within the Shaftesbury Capital group and its joint venture companies, to the extent necessary for the management and development of its estates.
• Service providers: third parties to whom we or Shaftesbury Capital outsource certain functions, such as IT service providers, marketing agencies, or other consultants working on the relevant project. All service providers are required to respect the confidentiality and security of personal data.
• Local planning authorities: where consultation data is submitted as part of or in support of a planning application.
• Professional advisers: such as lawyers, auditors, or insurers, where necessary for the establishment, exercise, or defence of legal claims.
• Regulatory or enforcement bodies: such as the police or the Information Commissioner’s Office, where we reasonably believe we are required to do so by applicable law, regulation, or court order.
• Prospective buyers: in the event of a sale, merger, or restructuring of any part of Shaftesbury Capital’s business.

We do not transfer your personal data outside the United Kingdom.

We employ robust technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure, or destruction. Data is stored securely using encrypted cloud services and access is restricted to authorised personnel only.

Our commitment extends to requiring any third parties we work with to also employ adequate protection measures in accordance with UK data protection law.

Personal information is retained only as long as necessary for the fulfilment of the purposes described in this policy, or as required by law (for example, for tax, legal, or accounting purposes).

Consultation data is retained for the duration of the relevant project and planning process, after which it is securely deleted or anonymised.

Mailing list data is retained until you unsubscribe, at which point your details are removed from the mailing list.

Upon expiration of any retention period, personal information may be anonymised, pseudonymised, or securely destroyed.

Under UK data protection law, you have the following rights with respect to your personal information:

• The right to request copies of your personal information (a “subject access request”).
• The right to ask us to rectify inaccurate or incomplete personal information.
• The right to ask us to erase your personal information.
• The right to ask us not to use your personal information for direct marketing.
• The right to ask us to restrict the processing of your personal information.
• The right to object to the processing of your personal information.
• The right to ask that we transfer your personal information to another organisation or to you (data portability).
• The right to withdraw consent at any time, where consent is the legal basis for processing.

To exercise any of these rights, please contact us using the details in Section 10 below. We will respond to your request within one month.

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. We encourage you to review this policy periodically. The date of the most recent update is shown at the bottom of this page.

For enquiries or concerns regarding this policy or your personal information, please contact:

Hedry Ltd (Website Operator)

Email: data@hedry.co.uk

The Forge, 133 Park Street, London, SE1 9EA

Capital & Counties CG Limited (as General Partner of Capital & Counties CGP), Shaftesbury CG Limited and Covent Garden Holdings (No.3) Limited (Data Controllers)

Email: feedback@shaftesburycapital.com

Regal House, 14 James Street, London, WC2E 8BU

If you believe that your data protection rights have been breached, you have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO):

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Tel: 0303 123 1113 (local rate)

Website: ico.org.uk

This policy is reviewed periodically and as necessary due to system changes, policy updates, or legal enhancements.

Data Controller: a natural or legal person which determines the means and purposes of processing of personal data.

Data Processor: a natural or legal person which processes personal data on behalf of the Data Controller.

Data Subject: an individual whom the personal data is about.

UK GDPR: the General Data Protection Regulation (EU) 2016/679 as retained in UK law by the European Union (Withdrawal) Act 2018, supplemented by the Data Protection Act 2018.

ICO: the Information Commissioner’s Office, which regulates the processing of personal data by all organisations within the UK.

Legitimate Interests: a ground which can be used by organisations as a lawful basis of processing, for example where personal data is used in ways that could reasonably be expected, or there is a compelling reason for the processing.

Service Providers: third parties to whom certain functions are outsourced. All service providers are required to respect the confidentiality and security of personal data.