At Colby River Group (“CR”), we respect your privacy and are committed to protecting your personal data. This summary provides an overview of how we handle your data across our customer-facing divisions.

• Who We Are
  The Colby River (“Colby River”) group of companies comprises Colby River Capital Management Ltd and Dandara Living Management Limited. Colby River Capital Management Ltd is a private company limited by shares incorporated in England and Wales (Company No. 16544469), registered office Waverley House, 9 Noel Street, London, United Kingdom, W1F 8GQ. Dandara Living Management Limited is a private company limited by shares incorporated in England and Wales (Company No. 10421427), registered office Vertex, 2nd Floor, 1 Tabley Court, Victoria Street, Altrincham, WA14 1EZ. Colby River Capital Management Ltd delivers full-lifecycle capital management for UK Living-sector assets—sourcing and underwriting deals, executing transactions, and then providing ongoing asset, development and portfolio management for institutional investors without handling day-to-day tenant operations. Dandara Living Management Limited manages, lets and operates residential developments throughout the United Kingdom.

• What Data We Collect
  We collect information relevant to our services, such as contact details, demographic information, property and rental details, employment information, call recordings, CCTV images, and data gathered from our website, services and social media.

• How We Use Your Data
  We use your data to manage property sales and rentals, provide customer support, enhance our services, conduct surveys, and ensure safety and security.

• Sharing Your Information
  We may share your information with trusted third parties for tenant vetting, call monitoring, maintenance, payment processing, customer service, social media management or where required by law.

• Your Rights
  You have rights over your data, including the right to access, correct, delete, and restrict processing. To exercise these rights, contact us at dpo@dandara.com .

Please review the full privacy policy below for more details on how we protect your data.

Introduction

Colby River (“We,” “us,” or “our”) is committed to protecting your privacy. This privacy policy explains how we collect, use, share, and protect your personal data. CR manages residential developments, often in city locations, for long-term rental. For more details about our services and locations, please refer to our individual websites. Colby River Capital Management Ltd and Dandara Living Management Ltd are registered with the United Kingdom Information Commissioner. Reference ZB955588 and ZA517839 respectively.

Clarification on Scope of Controllers

This policy covers two separate independent data controllers within the Colby River Group: Dandara Living Management Ltd (DLM) and Colby River Capital Management Ltd (CRCM). When we refer generally to "CR" or the "Colby River Group," the policy primarily addresses data collected and processed by DLM in relation to residential lettings, property management, and related customer services. CRCM processes only limited business-to-business (B2B) contact information relating to its own institutional and corporate investors and professional counterparties; therefore, sections relating specifically to tenant data, property management, residential lettings, and associated consumer activities do not apply to CRCM. However, general information about your rights, data minimisation, security, and contact details applies to both entities equally.

Data Minimisation

We are committed to data minimisation. This means we only collect information necessary to fulfil specific purposes and use it solely for those purposes as defined in this policy.

Information We Collect

Depending on the service and division, we may collect and process the following types of data:

• Contact Details
  Full name, telephone number, email, address, and preferred contact times and marketing preferences.

• Demographic Information
  Date of birth, age, pet information (if applicable), and dependent details.

• Property and Rental Details
  Type of property, lease details, apartment number, tenancy dates, monthly rent, and prior rental history.

• Financial and Employment Information
  Income verification, employment details (industry, employer), and salary.

• Verification Data
  Right-to-rent/buy documentation, identity confirmation and sanctions-screening results, where required, for legal-compliance and fraud-prevention purposes.

• Website Interaction and Analytics
  IP addresses, device/browser type, geolocation, and web analytics (e.g., page views, time spent).

• Surveys and Feedback
  Customer satisfaction surveys and feedback on properties, amenities, or services.

• Maintenance and Support Requests
  Records of maintenance requests, feedback on repairs, and access preferences.

• Social Media
  Social media profiles gathered from public interactions on our platforms.

• Amenity and Activity Participation
  Information about bookings and preferences for amenities or activities, such as time slots, class registrations, or facility usage, to manage services and enhance customer experiences.

• Call Recordings
  Recordings of calls with our customer service representatives, primarily for service quality and training purposes.

• CCTV Images
  CCTV footage captured in public or common areas of our properties, where applicable, to enhance security.

• Door Access Data
  Information recorded from door fob usage, including access times and locations, to ensure security and manage building access.

• Photographs and Video Content
  Images or videos captured during events, marketing activities, or for promotional purposes, with appropriate consent where required.

• Vulnerability Information
  Details about individual requirements or adjustments, such as accessibility needs, language preferences, or additional support to accommodate environmental, physical, or personal challenges.

How We Use Your Information

We use personal data for purposes tailored to each service or division:

• Property and Tenancy Management
  Processing purchase applications, leases and property agreements.

• Customer Service
  Providing support and responding to enquiries, including handling maintenance and repair requests.

• Demographic Analysis
  Analysing demographics for product and service improvement and to adjust amenities.

• Customer Protection
  CR supports standards and schemes aimed at ensuring consumer protection, quality, and safety in its rental properties.

• Surveys and Reviews
  Conducting customer satisfaction surveys and monitoring review sites to improve our services.

• Marketing
  Sending targeted marketing with consent, based on demographics and location data.

• Safety and Security
  Monitoring facilities for security purposes (e.g. CCTV in apartment blocks and some office spaces).

• Vulnerability
  We will use the information you provide us with, to record the actions we need to take to accommodate your needs, this will not include storing health data unless it is essential and we have your consent.

Legal Bases for Processing

We process your data under the following legal bases:

• Contractual Necessity
  To manage tenancy agreements, purchases, and services.

• Legal Obligations
  To comply with right-to-rent checks, sanctions-screening obligations, and other regulatory requirements.

• Legitimate Interests
  For improving services, demographic analysis, customer support, handling complaints and business to business contacts.

• Consent
  For marketing and survey participation, where required.

Sharing Your Information with Third Parties

To provide our services effectively, we may share your data with various trusted third parties. These third parties may change over time, and categories of third parties include:

• Tenant Vetting, Sanctions Screening and Credit Reference Agencies
  For tenant verification, sanctions-compliance checks and credit checks, especially for Dandara Living and rental services.

• Call Monitoring and Engagement Services
  For tracking and enhancing customer engagement.

• After-Hours Support and Maintenance Providers
  Contractors and third-party companies to address repairs, maintenance, and out-of-hours needs.

• Web Chat and Customer Interaction Tools
  For customer enquiries and online support.

• Payment Processing and Deposit Management
  Secure processing of payments and deposit management.

• Local Authorities and Utility Providers
  When property ownership or service responsibilities transfer from us to the client.

• Social Media Platforms
  For managing interactions through our social media channels.

• Cloud Storage and Administrative Systems
  For secure data storage, records management, and administrative support.

• Prospective Buyers or Sellers of Dandara Businesses or Assets
  To facilitate the sale or transfer of any part of CR or its assets, as required during such processes.

• Law Enforcement or Regulators Where Legally Required
  To comply with legal obligations or to assist with investigations or audits.

• Fraud Protection, Sanctions Screening, Credit Risk Reduction, and Payment Recovery Services
  To protect against fraudulent activity, comply with sanctions obligations, manage credit risks, and recover payments owed.

Who is responsible for your information

CR is normally the data controller for the personal we collect about residents and process as set out in the privacy notice. Because each development may have a different ownership structure, the property owner (the “Owner”) can also be a controller in certain situations:

• CR as sole controller
  Applies to most day-to-day activities – viewings, reference checks, tenancy management, maintenance and rent collection.
  
  Only CR is named as controller in your tenancy documentation.

• Joint controllers – CR & Owner
  Where CR and the Owner jointly decide why and how particular data are used – for example strategic marketing for the development, debt management etc.
  
  Your tenancy documentation will provide the details of the Owner.

• Independent controllers – CR & Owner
  CR processes your data for building management; the Owner separately uses a copy for its own legitimate business needs (e.g. financing, portfolio analysis).
  
  The Owner will also be named in your tenancy documentation together with a link to its own privacy notice.

Single point of contact

Whatever the arrangement, CR remains your main point of contact for questions or requests about your data.

International Data Transfers

While CR itself does not routinely transfer data internationally, some of our third-party providers may do so. In cases where data is transferred outside the EU or UK, we ensure that appropriate agreements are in place with these third parties to protect your data according to GDPR standards, such as Standard Contractual Clauses or other approved transfer mechanisms.

Data Retention and Deletion
Retention periods vary by service and type of data:

• Prospects: We retain data for up to 3 years or until we confirm it is outdated or incorrect.

• Tenants Data: Personal data is retained for 6 years post-tenancy, with right-to-rent information retained for 1 year after tenancy ends.

• Digital Analytics and Web Interactions: Retained according to schedules for engagement analysis as detailed in our Cookies Policy.

• B2B Contacts: 2 years after the last communication or end of mandate.

Data Subject Rights

You have rights over your data, including:

• Access: Request a copy of your personal data.

• Correction: Update inaccurate information.

• Deletion: Request deletion allowed by law and contractual obligations.

• Objection and Restriction: Limit or object to specific data processing.

• Data Portability: Obtain data in a structured format.

For any of these requests, please contact us at: dpo@dandara.com . Consent management tools are available for marketing opt-outs.

Security and Data Storage

Data security is a priority. We restrict access to authorised personnel and follow best practices for data retention and protection. Data stored on third-party systems is protected through agreements requiring GDPR-compliant practices and security standards.

Cookies and Website Monitoring

Our websites use cookies to enhance functionality and collect usage analytics. For details, refer to our Cookie Policy.

Keeping you informed about changes

We will review and update this Privacy Notice whenever our processing activities, applicable laws or supervisory-authority guidance change.

• Minor edits
  If an update clarifies wording, fixes typographical errors or re-orders content without materially altering the substance of how, why or with whom we process your personal data, we will publish the new version on our website and show the “Last updated” date at the bottom of the page, or we may draw your attention to it.

• Material changes
  If an update adds new purposes, changes our lawful basis, introduces new recipients or data transfers, affects your rights, or could otherwise influence your choices or expectations, we will notify you before the change takes effect and give you a reasonable period to review the update, ask questions and exercise your rights or withdraw consent.

• Historic versions
  We keep an archive of previous versions of this Notice. You can request a copy at any time by contacting us at dpo@dandara.com .

Your continued use of our services after a minor update, or after the effective date of a material update of which you have been notified, constitutes acknowledgement of the revised Notice.

Contact Us

For further information about this policy or data processing, please contact us at dpo@dandara.com. If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the UK’s data protection authority, the Information Commissioner’s Office (ICO). You can contact them at: www.ico.org.uk or call 0303 123 1113.

Last updated: 12 August 2025