Find what you need faster.
Get help and advice anytime from our AI assistant, Ask Croydon Council.
Privacy notices
Croydon Council privacy notices.
Private sector housing - Privacy notice
The London Borough of Croydon is committed to protecting your privacy and ensuring that personal information is used fairly, lawfully and securely.
This Privacy Notice explains how we collect, use, store and share personal information in connection with the operation of the council's property licensing schemes and private sector housing functions.
The council operates:
- selective licensing
- additional HMO licensing
- mandatory HMO licensing
under the powers contained within The Housing Act 2004.
For the purposes of this Notice, London Borough of Croydon will be the Data Controller whilst The Oyster Partnership Ltd will be deemed the Data Processor acting on behalf of London Borough of Croydon for all licence applications.
Who we are
The Oyster Partnership is the London Borough of Croydon’s delivery Partner for the delivery of its Property Housing License Services. The council appointed this Partnership in Sept 2026.
Under this arrangement, The Oyster Partnership will collect personal data from you to provide the following services:
- property licensing administration
- application processing
- inspection services
- compliance monitoring
- customer support
- licensing system management
What information we will collect
The information that we will need to collect from you will be as follows:
Personal information
- name
- address
- email address
- telephone number
- correspondence details
- company and business details
- details of directors, partners and corporate applicants
Property information
- property address
- property ownership details
- management arrangements
- Land Registry information
- licence application records
- licence history
Supporting documents
- Gas safety certificates
- Electrical Installation Condition Reports (EICR)
- EPC information
- floor plans
- fire safety certificates
- fire risk assessments
- photographs and inspection evidence
Financial information
- licence fee transactions
- payment references
- payment history
Inspection and compliance information
- inspection records
- hazard information
- compliance and enforcement records
- property condition information
Online system information
- audit logs
- user activity records
- application history
Criminal convictions and special category data
In very rare circumstances we may need to collect information to process:
- Criminal conviction information relevant to our requirement to complete Fit and Proper Person assessments. This may require a Basic Disclosure and Barring Service (DBS) check to be completed alongside your application to verify the declaration made by you.
- Information relating to the safeguarding or vulnerability concerns about a property.
- Information identified during inspections where it is necessary to protect the health, safety and welfare of an individual.
Any such processing will only occur where permitted by law and where appropriate safeguards are in place.
Why we collect this information
We collect and process information about you and your property(s) for a number of reasons. This is to allow us to:
- process your submitted online property licence applications
- verify ownership and management arrangements of a property
- assess applications and determine whether licences should be granted
- carry out inspections and compliance checks
- monitor licence conditions
- investigate complaints and service requests
- support housing enforcement activity
- produce statutory property licensing registers
- process licence fee payments
- meet our legal and regulatory obligations
Our lawful basis for processing
All information will be processed under the following legal basis in accordance with the UK General Data Protection Regulations (UK GDPR)
| Legal basis | Article | Legal description |
|---|---|---|
| Personal data | Article 6(1)(e) Public Task (UK GDPR) (Consent is not a required basis for any type of Property Licensing activity) | The primary basis for this activity will default to: “The processing is necessary for the performance of a task carried out in the public interest and the The primary basis for this activity will default to: exercise of official authority vested in the council”. |
| Article 6(1)(c) – Legal Obligation (UK GDPR) | The council may also rely on:
| |
| Special category data | Article 9(2)(g) – Substantial Public Interest (UK GDPR | In rare situations, where vulnerability / safeguarding data may be collected. |
| Criminal Conviction Data | Article 10 of UK GDPR Schedule 1, Part 2, Condition 6 (Statutory Purposes) of the Data Protection Act 2018 will apply for the data processing activity. | Where the council needs to collect criminal convictions data under the "Fit and Proper Person" declaration”. |
For The Oyster Partnership Ltd to engage in the collection of this data processing activity, the legal basis for this arrangement will be as follows:
| Type of data | Legal basis | Legal description |
|---|---|---|
| Personal data | Article 6(1)(b) Performance of a Contract (UK GDPR) | Oyster Partnership Ltd has a contract in place with the London Borough of Croydon to provide specific property licensing and physical inspection services on behalf of the council. When you submit your application online, your initial application and supporting information will be processed by Oyster Partnership before it is passed to a council Case Officer to assess. |
| Special category data | Article 9(2)(g) - Substantial Public Interest (UK GDPR): This processing is necessary for reasons of substantial public interest, based on domestic law. | In rare circumstances, where vulnerability / safeguarding data may be collected. |
| Criminal conviction data | Article 10 of UK GDPR Schedule 1, Part 2, Condition 6 (Statutory Purposes) of the Data Protection Act 2018 will apply for the data processing activity. | Where the council needs to collect criminal convictions data under the "Fit and Proper Person" declaration”. |
Who we share information with
We will share information where necessary and lawful with:
Outsourced Provider - The Oyster Partnership Ltd
To administer all licence applications, to undertake inspections, monitor compliance and deliver licensing services on behalf of the council.
System Supplier - Metastreet
To provide an online data collection point where all applications will be collected via the Property Licensing System, Metastreet which is used to administer all applications and inspections.
Payment Service Provider - Stripe
To securely process licence fee payments. Neither the council nor The Oyster Partnership will store your card details online. This will be completed via the secure Stripe web payment service.
Other council cervices
Where other council services have a legal right of access:
- Council Tax
- Planning
- Legal Services
- Finance
- Enforcement teams
Government Departments and Regulators
Where the data sharing is required by law, including:
- HM Courts and Tribunals Service
- Ministry of Housing, Communities and Local Government
- other Local Authorities
- relevant regulators and professional bodies
- internal audit and fraud services
Emergency services
Where there is an urgent health, safety or safeguarding concern identified with a property. We will only share information necessary for this relevant purpose.
Public register
The council is legally required to maintain a Public Register of Licensed Properties.
This register contains information as stipulated by current property licensing legislation and does not include any private personal contact details such as telephone numbers or email addresses.
Details published include:
- the licence number
- the owners name and full property address of the licensed property holder
- property type
- the date the licence was granted
- any specific conditions attached to the licence
- occupancy limits of the property, maximum number of occupants or rooms
- amenities and shared facilities
- enforcement action e.g. Orders serviced against the property due to management failures
How long we keep information
All information collected for this data activity will be retained in accordance with the council’s Record Retention Schedule.
Current retention periods are as follows:
- licence applications and licence records: 10 years from the closure date
- refused applications: 10 years from the closure date
- inspection and compliance records: 10 years from the closure date
- incomplete applications: 5 years from date of submission
- financial records: In line with statutory financial retention requirements which are currently 6 years plus current year
All information will be securely deleted when it is no longer required.
How we will keep your information safe
Appropriate technical and organisational security controls will be implemented to ensure that your data is protected through every delivery phase of this service.
All information will be protected through:
- role-based access system (RBAC) controls and permissions
- encryption in transit and at rest to an appropriate industry standard i.e. AES256 encryption and TLS 1.2 and more
- secure cloud hosting within the UK
- audit logging and the monitoring of all system access
- staff training provided to specific service areas to ensure all data is protected
- contracts in place with appropriate providers
- regular security reviews and testing to ensure controls are still secure
International transfers
Your personal information is stored and processed within the United Kingdom. There are no routine data transfers outside of the UK. The council does not routinely transfer personal information outside these jurisdictions.
Your rights
Under UK data protection legislation you will have the right to exercise the following rights.
The right to:
- access to your personal information
- correct any inaccurate information held about you
- restrict the processing of your data in specific circumstances
- object to the processing of your data, where applicable
- complain about how your information is used
Some rights may be limited where the council is carrying out statutory licensing or enforcement functions.
Contact us
Should you wish to submit a request for information, please contact the:
Data Protection Team, Subject Access Requests
Email: sar@croydon.gov.uk
Information Governance & Data Protection Team, General Data Protection Enquiry
Email: information.management@croydon.gov.uk
Complaints
Should you be unhappy about the way we process your data please contact the relevant Lead (as above) at the council in the first instance so that we can respond to your complaint.
Information Commissioner’s Office (ICO)
You also have the right to complain to the Information Commissioner's Office (ICO):
www.ico.org.uk should you remain unhappy with any aspect of a complaint or enquiry.
The ICO can be contacted at the following address:
Information Commissioner's Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Helpline Telephone: 0303 123 1113 (Open Monday to Friday, 9am to 5pm)
Alternative Landline: 01625 545745
Casework Email: icocasework@ico.org.uk
Please ensure that any complaints you wish to submit to the ICI has been submitted to the council in the first instance as the ICO will only redirect them to us to respond in your initial interaction with them.
Changes to this Notice
This Privacy Notice will be regularly reviewed whenever there is a significant change to the service, legislation or processing activities. This Privacy Notice was last updated on 25 September 2026.
Last updated: 25 September 2026.