Privacy Policy

O&C Management Services Ltd

Last updated: 1 September 2026  ·  Version 1.2 (photography, filming and event footage update)

1. Who we are

O&C Management Services Ltd ("OCMS", "we", "us", "our") is a commercial and residential property management and letting company registered in England and Wales, company number 4008642, registered office at 9 Harrison Road, Halifax, West Yorkshire, HX1 2AF.

We are registered with the Information Commissioner's Office under registration number Z1801095.

This policy applies to personal data we process about tenants, landlords, applicants, contractors, website visitors, visitors to and attendees at properties and events we manage or host, performers and their crews, and anyone else we interact with in the course of our business. It does not cover data we process about our own employees, which is set out in a separate internal policy.

2. How to contact us about privacy

Our privacy contact is Lee Robertshaw, Group Property Director, who acts as our Data Protection Officer. You can reach him at:

For image and video removal requests specifically, see Section 6. Requests to remove a photograph or video should also go to privacy@ocms.uk.

3. Information we collect

3.1 Enquiries and property applications

• Name, contact details, and the property or service you're enquiring about
• Employment, income, and reference details supplied as part of a tenancy or lease application
• Right to Rent documentation (passport, visa, biometric residence permit, or other Home Office-approved evidence)
• Identity and proof-of-address documents for anti-money-laundering (AML) checks
• Bank details, where needed to set up rent payments, deposits, or refunds

3.2 Managing a tenancy or lease

• Tenancy agreement details, rent and payment history, arrears and correspondence
• Maintenance requests, contractor visit records, and related correspondence
• Complaints, disputes, and deposit-scheme correspondence

3.3 Website and marketing

• Pages visited, device and browser information, and approximate location, via cookies and analytics tools
• Email address and marketing preferences, where you've signed up for updates
• Enquiries submitted through contact or callback forms

3.4 CCTV and site access

We operate CCTV at some of the properties we manage and at our own premises, for the safety and security of the building, the people in it and the property itself. Footage is held for up to six weeks and is then overwritten, unless it is needed for an incident, an insurance claim or a police request. Access is restricted to authorised staff.

CCTV is separate from the marketing photography and filming described in Section 3.5. Footage recorded by CCTV is not used for marketing.

3.5 Photography, filming and event footage

We take photographs and record video at properties we own or manage, and at events held at them, including live music and entertainment events at Westgate Quarter, Halifax. This content is used to promote the venue, the tenants and businesses based there, the events themselves, and OCMS as a business.

Who does the recording.

Filming and photography at our sites is carried out by:

• our own marketing team (our marketing manager and colleagues), working for OCMS;
• photographers, videographers and marketing agencies engaged by OCMS, working to our instructions under contract; and
• third parties who film for their own purposes at events we host, for example performing bands and their management, promoters, event partners and press. Section 5 explains how this works and what it means for you.

What is captured.

Photographs and video (with sound) of:

• members of the public attending or passing through an event or a public area of one of our properties, including audience and crowd footage;
• children who attend events with a parent, guardian or carer (see Section 3.6);
• performers, DJs, compères and their crews;
• tenants, their staff and their customers, where they take part in or appear at an event;
• interviews, vox pops, testimonials and other content where someone speaks to camera; and
• the date, time and location of the recording, and any caption, tag or description we add when we publish it.

Where it is published.

We publish this content on:

• our own websites and property microsites (including westgatequarter.co.uk and ocms.uk);
• our social media channels, currently TikTok, Facebook, Instagram, YouTube and LinkedIn;
• email newsletters and marketing materials sent to people who have opted in;
• printed and digital marketing collateral such as brochures, particulars, signage and advertising.

Two different situations.

We treat these differently, and the legal basis in Section 4 differs accordingly:

• Incidental and crowd footage. You appear in a general shot of a venue, an audience or a busy street scene. You are not the subject of the shot, not named, and not singled out.
• Featured footage. You are the focus of the shot: a close-up, an interview, a testimonial, a posed photograph, or a clip built around you. This includes anything where you are named, tagged, or clearly identifiable as the subject.

We do not use event photography or video for any purpose other than marketing and record-keeping. We do not use facial recognition or any other biometric technology on it, and we do not use it to profile or track individuals.

3.6 Children

Our lettings and property management services are aimed at adults, and we don't collect personal data about children in connection with them. Our events are a different matter. We run a Santa's grotto at Christmas, and we photograph children there for our marketing, with the consent of a parent or guardian. Section 3.7 explains how that works.

However, our events are open to the public and family audiences, and children do attend. That means children may appear in photographs and video recorded at those events. We recognise that children's personal data deserves specific protection, and we apply the following rules:

• Incidental appearances. A child may appear in general crowd or atmosphere footage. We keep such shots wide, brief and non-focused, and we do not name, tag or otherwise identify the child.
• Featured content. We will not publish a close-up, interview, posed photograph or clip built around an identifiable child without the express, recorded consent of a parent or guardian, given at the time. Consent for a child is always sought from the parent or guardian, not from the child.
• No identifying detail. We never publish a child's name, age, school, home area or any other identifying detail alongside their image, and we do not tag children in social media posts.
• Withdrawal and removal. A parent or guardian can withdraw consent or ask us to remove content featuring their child at any time, using Section 6. We treat requests concerning children as a priority and act on them without asking for a reason.
• Unaccompanied children. Where a child appears to be attending without a responsible adult, we do not film them as the subject of a shot.

We record parental consent on a short written form, completed and signed at the time. It names the child, the parent or guardian, the date and the event, the channels the content may appear on, and how to withdraw consent. Completed forms are held securely by our marketing manager.

Our Santa's grotto is an event aimed at children, and Section 3.7 sets out how we handle it. No other OCMS event is specifically marketed to or aimed at children.

If you believe we hold or have published personal data about a child and you have concerns, please contact us using the details in Section 2 and we'll deal with it promptly.

3.7 Santa's grotto

We run a Santa's grotto at Christmas at one of our sites. It is walk-up: we do not take bookings, and we do not ask for your child's name, age or any other detail in order to visit.

We photograph children at the grotto, and we use those photographs to promote the grotto and our venues. This is the one part of our business where we deliberately photograph children, so we treat it carefully.

How it works. Photographs at the grotto are taken by our own marketing team. Nobody else photographs your child for us, and we do not use an outside photography operator. Before we photograph your child, we ask a parent or guardian to complete and sign a short consent form. It names your child, names you, records the date, sets out the channels the photograph may appear on, and explains how to withdraw your consent. If we do not have a signed form, we do not photograph your child.

Where the photographs appear. On our websites and property microsites, our social media channels (currently TikTok, Facebook, Instagram, YouTube and LinkedIn), our email newsletters, and our printed and digital marketing material.

How long we keep them. For as long as the photograph remains in active marketing use. We review published content annually and remove anything we no longer need. We keep the signed consent form for as long as the photograph is in use, plus 12 months, so that we can show the consent was given.

What we never do. We never publish your child's name, age, school or any other identifying detail alongside their photograph, and we never tag a child in a social media post. We do not use facial recognition or any other biometric technology.

Changing your mind. You can withdraw your consent at any time, and you do not need to give a reason. Contact us using the details in Section 2 and we will remove the photograph from our own channels and add it to our record of removed content so that it is not published again. We cannot recall printed material already distributed, or copies that others have already downloaded or shared, and we will tell you honestly if that is the case.

Parents and guardians are of course welcome to take their own photographs at the grotto. That is personal and family use and is not covered by this policy.

We do not give or sell you a copy of the photograph. We take it for our marketing, and that is the only thing we use it for.

4. Why we use your information, and our legal basis

Under UK GDPR, we must have a valid legal basis for every use of personal data. The table below sets out our main purposes and the basis for each.

Scroll the table sideways to see all columns.

Where we rely on legitimate interests you can ask us for a copy of our balancing test.

5. Filming by third parties at our events

Not everything filmed at our events is filmed by us. It matters who is doing the recording, because it determines who is responsible for the data and who you should approach.

Agencies and freelancers working for us. Where we engage a photographer, videographer or marketing agency to produce content for OCMS, they act as our processor. They work to our written instructions, may only use the content for the purposes we specify, must keep it secure, and must return or delete it when the engagement ends. This policy covers their processing.

Performers, promoters, event partners and press filming for themselves. Bands, their management and crews, promoters, event partners and members of the press often record their own performances and the audience for their own channels: their social media, websites, showreels, press coverage and promotional material. When they do this for their own purposes they are independent controllers of that content. We do not control what they capture, how they use it, or how long they keep it, and this policy does not cover it.

• We tell third parties filming at our events that they must comply with data protection law and have their own lawful basis and notices in place, and we ask them to respect anyone who has asked not to be filmed.
• If you want content removed from a band's, promoter's or publication's own channels, you will need to contact them directly. If you contact us we will tell you who they are, so far as we know, and pass your request on.
• We ask every band, performer, agency, promoter and press outlet filming on site to sign a written filming permission agreement. It confirms that they are responsible for their own footage, that they must have their own privacy notice, that they must not film a child as the subject of a shot without the consent of a parent or guardian, and how removal requests are passed on.

Attendees filming on their phones. Members of the public recording at an event for their own personal or household use are outside the scope of data protection law and outside our control.

6. Asking us to remove a photograph or video

If you appear in a photograph or video we have published and you'd rather you didn't, tell us and we will take it down. You don't have to give a reason, and we won't ask for one.

• How to ask. Contact us using the details in Section 2. Tell us where you saw the content (the platform and, if you can, a link), roughly when and where it was recorded, and enough detail to identify you in it. A description of what you were wearing is usually enough. Please don't send us documents or additional personal data we haven't asked for.
• What we do. We'll remove or replace the content on channels we control, and record your objection so we don't publish that content again. We treat requests concerning children as a priority and act on them as quickly as we can, and in any event we will respond within one month, which is the legal maximum.
• Requests about a child. A parent or guardian can ask on a child's behalf. We prioritise these.
• What we can't do. Once content is public, others may have shared, downloaded, screenshotted, embedded or re-posted it. We can remove our own posts, but we can't recall copies held by other people or reliably remove content from third parties' own channels (see Section 5). We'll tell you honestly what we have and haven't been able to do.
• We do not currently operate a wristband or marked no-filming area at events. If you would prefer not to appear, tell a member of our team or the person holding the camera at the time, and we will not film you as the subject of a shot. A marked no-filming area is not practicable at our venues, because the seating areas are shared between several tenants and cannot be set aside, so please just tell us instead.

7. Automated decision-making

We do not make any decision about you by automated means alone. Referencing and credit check results are always reviewed by a member of our team before a decision is made.

If that ever changes, and a decision materially affecting you is made using automated means alone, you have the right to request human review, express your point of view, and challenge the decision. Contact us using the details in Section 2.

8. Who we share your information with

We share personal data only where necessary, with:

• Landlords and property owners, where we manage a property on their behalf
• Referencing and credit-check providers, to assess tenancy applications
• Contractors and maintenance providers, to carry out repairs and inspections
• Deposit protection schemes, as required by law
• Our professional advisers (solicitors, accountants, insurers)
• Regulators and law enforcement, where we're legally required to
• Social media platforms, currently TikTok, Meta (Facebook and Instagram), YouTube and LinkedIn, when we publish photographs and video. These platforms are independent controllers of the content once it is on their services, and they process it under their own terms and privacy policies, including for their own analytics and advertising purposes. We can delete our posts; we cannot control what the platforms do with data they have already collected.
• Photographers, videographers and marketing agencies we engage to produce content, as our processors
• Performers, their management, promoters and event partners, where we share event content with them for their own promotion. In that case they are independent controllers
• Tenants and businesses at our properties, where content features their premises, staff or events and we share it for them to use in their own marketing

Our current technology and marketing suppliers who process personal data on our behalf include Mailchimp (email marketing) and Google Analytics (website analytics), plus Pegasus Opera (accounting software), Released (property management software), M365 (comms and business administration software), Bright HR (human resources software), Lloyds Banking Group (supplier and beneficiary data), The Hub (property records and customer information), THG (our secure data and document drive), and desk and mobile phones (password and IT protected). We have contracts in place with each requiring them to protect your data and use it only as we instruct.

9. International transfers

Some of our suppliers and the platforms we publish on, including Mailchimp, Google Analytics, TikTok, Meta, YouTube and LinkedIn, may process data outside the UK, including in the United States and elsewhere.

Where we transfer personal data outside the UK ourselves, we rely on the transfer safeguards set out in each supplier's own data processing terms, which are typically the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, to make sure your data is protected to a UK standard wherever it's processed. You can request a copy of the relevant safeguard from us.

Where we publish content on a social media platform, that platform processes it as an independent controller under its own terms and its own transfer arrangements, which may involve countries outside the UK. TikTok is provided by TikTok Pte. Ltd., based in Singapore. TikTok states that it stores UK and European user data in its European data centres in Ireland and Norway by default, and that employees in China do not have access to restricted data held in that European environment. TikTok also states that some de-identified data flows globally in order to run the platform. Its published privacy policy names Singapore, Malaysia, Ireland and the United States as locations where data may be stored. This is TikTok's own published position and we rely on the safeguards in its terms. If you want to know more about how TikTok handles your data, please read TikTok's own privacy policy. If you would rather your image was not published on a particular platform, tell us and we won't publish it there.

10. How long we keep information

We keep personal data only as long as necessary for the purpose it was collected for, or as required by law. Our standard retention periods are:

11. How we protect your information

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption where appropriate, and staff training. We review our security arrangements regularly.

Photographs and video are stored in access-controlled storage available only to those who need it, and we require the same of any agency working for us. Devices and storage are password-protected and access is limited to authorised marketing staff.

12. If something goes wrong

If we become aware of a data breach that's likely to result in a risk to your rights and freedoms, we'll notify the ICO within 72 hours where required, and tell you directly if the risk to you is high, along with the steps we're taking in response.

13. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data, in certain circumstances
• Restrict how we use your data, in certain circumstances
• Receive your data in a portable format, where processing is based on consent or contract
• Object to processing based on legitimate interests, including direct marketing
• Not be subject to a decision based solely on automated processing that significantly affects you
• Withdraw consent at any time, where processing relies on consent

These rights apply to photographs and video of you in the same way as to any other personal data. In practice, the quickest route for image and video content is Section 6.

To exercise any of these rights, contact us using the details in Section 2. We'll respond within one month, and won't charge a fee unless a request is manifestly unfounded or excessive.

If you think we have handled your personal data wrongly, you can complain to us directly. Email privacy@ocms.uk or write to us at the address in Section 2, and tell us what you think has gone wrong. We will acknowledge your complaint, look into it, and tell you the outcome. You do not have to complain to us first, and complaining to us does not affect your right to go to the Information Commissioner's Office. You can contact the ICO at any time:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

14. Marketing preferences

We only send marketing emails to people who've opted in. Every marketing email includes an unsubscribe link, or you can contact us directly to opt out at any time.

15. Cookies

This website uses cookies for essential site functions and for analytics and marketing. Full details, including how to manage your preferences, are in our separate Cookie Policy.

Embedded social media content, for example a TikTok or Instagram feed or an embedded video on one of our pages, can set cookies and share data with the platform as soon as it loads, even if you don't click it. We do not currently embed social media feeds or video players in our pages. If we add them in future, they will be held back until you accept non-essential cookies.

16. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed. Significant changes will be highlighted on our website.