PRIVACY POLICY


Last updated: October 2026


This Privacy Policy explains who we are, how we collect and use personal information, the circumstances in which we may share it, how we protect it and the rights you may have under applicable data protection law.


We are committed to protecting your privacy and handling personal information fairly, lawfully and transparently.


1. Who we are

Skene Business Centres comprises business centres operated by two data controllers. Skene Investments (Aberdeen) Ltd manages the Morgan Properties Partnership business centre identified below.


Skene Investments (Aberdeen) Ltd (SIAL)

Organisation name for the business centres located at 3 Queen's Gardens, 23 Rubislaw Den North and 50 Gilcomston Park.

Registered in Scotland: SC57524.

Registered address: Ledingham Chalmers, Johnstone House, 52–54 Rose Street, Aberdeen, AB10 1HA.

Head office address: 6 Union Grove, Aberdeen, AB10 6SY.

ICO registration number: Z5832715.


Morgan Properties Partnership

Organisation name for the business centre located at 2 and 7 Queen's Gardens, Aberdeen.

Managed by Skene Investments (Aberdeen) Ltd.

Organisation address: 7 Queen's Gardens, Aberdeen, AB15 4YD.

ICO registration number: ZA349427.


The relevant data controller will depend on the business centre, service or relationship concerned. If you have questions about how your personal information is used, you can contact us at 7qg@skenebusinesscentres.com. You also have the right to complain to the Information Commissioner's Office (ICO).


2. What personal information we collect

Personal information is information that identifies you or could identify you, either on its own or when combined with other information.


Depending on your relationship with us, we may collect and process:


  • Contact details, including your name, postal address, email address and telephone number.
  • Business and professional information, including your employer, business role and organisation details.
  • Information you provide through our website, by email, by telephone, in person or through other correspondence.
  • Details of enquiries, bookings, agreements, services, visits and communications with our business centres.
  • Contract, invoicing, payment and transaction information.
  • Emergency contact details where appropriate and necessary.
  • Identity documents or proof of address where required for a lawful and relevant purpose, including applicable legal or regulatory requirements.
  • Information available from public sources, such as Companies House, the Land Registry and published media, where relevant to our business activities.
  • Information relating to building security, site access, health and safety, fire safety or incidents, where applicable.
  • Information submitted through privacy complaints, individual rights requests or other correspondence concerning personal information.


We do not routinely seek to collect special category personal data, such as information about health, racial or ethnic origin, religious beliefs, political opinions or biometric data used for identification. Where such information is necessary for a lawful purpose, we will identify an appropriate legal condition and apply additional safeguards. We will seek to collect only information that is relevant and necessary for the purpose concerned.


3. How and why we use your information

We may use personal information for the following purposes:


  • Responding to enquiries and providing our services.
  • Managing client, tenant, supplier and other business relationships.
  • Preparing, administering and fulfilling contracts.
  • Managing invoicing, payments and accounting records.
  • Verifying identity where reasonably necessary or legally required.
  • Maintaining building security, site access arrangements, fire safety and health and safety.
  • Meeting legal, regulatory, insurance and record-keeping obligations.
  • Preventing and investigating suspected fraud, crime, security incidents or misuse of our services, where lawful.
  • Communicating with you about services, enquiries, agreements or matters relevant to our relationship.
  • Handling complaints, data protection requests and suspected personal data incidents.
  • Establishing, exercising or defending legal claims where necessary.


We will not use personal information for purposes that are incompatible with the purpose for which it was collected unless we have a lawful basis for doing so.


4. Our lawful bases for processing

Under UK data protection law, we must have an appropriate lawful basis for processing personal information. Depending on the circumstances, this may include:


  • Contract: Where processing is necessary to enter into or perform a contract with you, or to take steps you request before entering into a contract.
  • Legal obligation: Where processing is necessary to comply with a legal obligation, such as applicable accounting, regulatory or anti-money laundering requirements.
  • Legitimate interests: Where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and interests. Depending on the circumstances, this may include managing our business centres, maintaining security, administering business relationships and protecting our property.
  • Consent: Where you have freely given consent for a specific purpose. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
  • Vital interests: Where processing is necessary to protect someone's life or other vital interests, where the applicable legal conditions are met.


Where we process special category data or criminal offence data, we will also identify and rely on any additional legal condition required by law. We will assess the appropriate lawful basis according to the particular processing activity. We do not assume that one lawful basis applies to every use of personal information.


5. How long we keep your information

We retain personal information only for as long as necessary for the purposes for which it was collected, including any applicable legal, accounting, contractual, insurance or regulatory requirements. Retention periods will depend on the type of information, the reason it was collected and any applicable legal obligations.


We review retention requirements periodically. When information is no longer required, we will take appropriate steps to securely delete it, destroy it or anonymise it, subject to any lawful requirement to retain it.


Where information relates to a complaint, individual rights request, investigation or security incident, it may be retained for an appropriate period to manage the matter, demonstrate compliance or establish, exercise or defend legal claims.


6. Sharing your personal information

We may share personal information where necessary and lawful with:


  • Companies, property owners or business partners involved in the relevant service or business centre.
  • IT, software, cloud-storage, communications and other service providers acting on our behalf.
  • Professional advisers, including legal, accounting and insurance advisers.
  • Contractors or other service providers where access to information is necessary for the work they carry out.
  • Banks, payment providers or other organisations involved in processing transactions.
  • Law enforcement agencies, regulators, courts or government authorities where required or permitted by law.
  • A prospective or actual purchaser or successor in connection with a business transfer, restructuring or similar transaction, where lawful.


We take appropriate steps to ensure that personal information shared with service providers is handled securely and in accordance with applicable data protection requirements. We do not sell personal information to third parties.


7. International data transfers

Some of our service providers or the systems they use may process or store personal information outside the United Kingdom.


Where personal information is transferred internationally, we will ensure that the transfer complies with applicable UK data protection law. Depending on the circumstances, this may involve transferring information to a country covered by UK adequacy regulations, using an appropriate international data transfer agreement or applying another lawful transfer mechanism and any required safeguards.


You can contact us if you would like further information about relevant international transfers and safeguards.


8. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, destruction, damage, unauthorised access, disclosure or alteration.


These measures may include restricted access, secure storage, appropriate account permissions, access controls, staff guidance and other safeguards suited to the information and the risks involved.


We limit access to personal information to people who need it for legitimate business purposes or to carry out their responsibilities. No method of transmitting or storing information can be guaranteed to be completely secure. However, we take reasonable and appropriate steps to reduce risks and respond to suspected security incidents.


If we become aware of a suspected personal data breach, we will assess it promptly and take appropriate action in accordance with our internal procedures and applicable legal requirements.


9. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:


  • Access: Request a copy of your personal information and certain supplementary information. This is commonly called a Subject Access Request (SAR).
  • Rectification: Ask us to correct inaccurate personal information or complete information that is incomplete.
  • Erasure: Ask us to delete personal information where the legal conditions for erasure are met.
  • Restriction: Ask us to restrict the use of your personal information in certain circumstances.
  • Object: Object to processing carried out on certain lawful bases, including legitimate interests, and to direct marketing where applicable.
  • Data portability: Receive certain personal information in a structured, commonly used and machine-readable format, or ask for it to be transferred to another organisation, where the legal conditions apply.
  • Withdraw consent: Withdraw consent where our processing is based on consent.
  • Rights relating to automated decisions: Receive information about and exercise applicable rights in relation to solely automated decisions that have legal or similarly significant effects on you.


These rights are subject to legal conditions and exceptions. For example, we may be required or permitted to retain certain information even where erasure is requested. We will carry out reasonable and proportionate searches when responding to access requests and will assess the information and relevant legal requirements before responding.


There is normally no charge for making a data protection rights request. Applicable law permits charges or refusal in limited circumstances, such as where a request is manifestly unfounded or excessive.


How to submit a rights request

You can submit a request using our online form:


GDPR Rights Request / Subject Access Request (SAR) Form


Alternatively, you can contact us using the details in Section 13. You do not have to use the online form: a valid request can also be made verbally or in writing. We may ask for clarification or proportionate identity verification where reasonably necessary to establish what you are requesting or to ensure that personal information is not disclosed to the wrong person.


We will normally respond to a valid rights request within one calendar month of receipt. Where the law permits an extension, for example because a request is complex or we have received numerous requests, we will explain the extension and the reasons within the applicable initial period.


10. Privacy complaints and concerns

If you are concerned about how we have collected, used, stored, shared or otherwise handled your personal information, we encourage you to contact us so that we can investigate.


You can submit a complaint using our online form:


Privacy Complaint Form


Using the form is optional. You may also raise a concern verbally or in writing using the contact details in Section 13.


When handling a complaint, we will, as appropriate:


  • Record and assess the concern.
  • Make enquiries to understand what happened.
  • Contact you if further information is reasonably required.
  • Consider whether corrective or preventative action is needed.
  • Respond as soon as reasonably practicable and keep you informed where appropriate.


We will handle complaints sensitively and restrict access to information about them to those who need it to investigate or manage the matter.


A privacy complaint is different from a request to exercise a specific data protection right. If you wish to access your personal information, for example, you can use the rights request form in Section 9. If your concern involves both a complaint and a rights request, we will consider each aspect appropriately.


If you remain dissatisfied with how your personal information has been handled, you can complain to the Information Commissioner's Office (ICO): www.ico.org.uk


11. Reporting a suspected data security incident

If you believe your personal information has been lost, disclosed to someone who should not have received it, accessed without authorisation or otherwise compromised, please contact us promptly using the details in Section 13.


Where possible, provide a brief description of what happened, when it happened and how we can contact you. Please do not send additional sensitive personal information unless it is necessary and a suitable method of transmission has been agreed.


We will assess the information and take appropriate action in accordance with our data protection and security procedures. Where required by law, we will notify the ICO and affected individuals. This public reporting route does not replace the internal procedures that our staff must follow when they identify or suspect a personal data breach.


12. Automated decision-making, cookies and changes to this policy

Automated decision-making

We do not routinely make decisions about you solely by automated means that produce legal or similarly significant effects. If we introduce such processing, we will provide information where required by law and respect any applicable rights, including rights relating to human intervention, expressing your point of view and contesting a decision.


Cookies and website technologies

Our website may use cookies or similar technologies. Information about the cookies used on our website, their purposes and the choices available to you is provided in our separate Cookie Policy. Please refer to the Cookie Policy available through our website.


Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our practices, services, technology or legal requirements. The latest version will be published on our website. Please review it periodically to remain informed about how we handle personal information.


13. Contact details

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, raise a privacy complaint or report a suspected data security incident, please contact us directly or use the relevant online form linked in Section 9 or Section 10, as appropriate.


Skene Business Centres

Email: 7qg@skenebusinesscentres.com

Telephone: +44 (0) 1224 620067

Website: www.skenebusinesscentres.com


For a complaint to the supervisory authority, you can contact the Information Commissioner's Office through their website: www.ico.org.uk


We will handle your enquiry in accordance with applicable data protection law and the circumstances of your request or concern.