Privacy policy
1. About this privacy policy
This privacy policy explains how Castles Property Sales Limited and Castles Property Lettings Limited (together, “Castles”, “we”, “us” or “our”) process personal data. It applies to people who use our website, contact us, visit our offices or properties, use our estate agency or lettings services, act for a customer, supply services to us, apply for work with us, or otherwise interact with us.
We are committed to handling personal data lawfully, fairly, transparently and securely. This policy is intended to provide the information required by the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (“PECR”).
Important: This policy should be read with our cookie information, website terms and any service-specific privacy information supplied when personal data is collected.
2. Who is responsible for your personal data?
The relevant data controller will depend on the service involved:
· Castles Property Sales Limited (company number 11132980) is generally the controller for estate agency sales, property valuations, sales marketing, buyer enquiries and related services.
· Castles Property Lettings Limited (company number 06562865) is generally the controller for lettings, tenant applications, landlord services, property management, maintenance coordination and related services.
The companies may act as separate controllers, or as joint controllers where they jointly determine why and how personal data is used, for example where shared systems, staff, marketing or customer administration are involved. You may exercise your rights by contacting either company using the details below. We will ensure that the appropriate company responds.
3. How to contact us
Privacy contact
Ronnie Clarke
Email: [email protected]
Website
https://castlesestateagents.co.uk
Postal contact
Please use the relevant Castles office address shown on our website or the registered office shown on the Companies House register.
Ronnie Clarke is our Data Protection Contact. References to this role do not necessarily mean that Castles is legally required to appoint a statutory data protection officer under the UK GDPR.
4. Personal data we collect
“Personal data” means information relating to an identified or identifiable person. Depending on your relationship with us, we may collect the following categories:
Category
Examples
Identity data
name, title, date of birth, signature, nationality, photographs, identification documents and identity-verification results.
Contact data
postal address, property address, email address, telephone number and communication preferences.
Property data
ownership, tenure, property characteristics, valuation information, occupancy, access arrangements, photographs, floor plans, inventories and related records.
Transaction and contract data
offers, negotiations, agreements, tenancy details, deposits, rent, fees, invoices, payment records and service history.
Financial data
bank-account details, affordability information, income, employment, credit or referencing information and source-of-funds or source-of-wealth information where required.
Compliance data
anti-money laundering (“AML”), sanctions and politically exposed person screening; Right to Rent checks; fraud-prevention information; and records required by regulators or law-enforcement bodies.
Household and occupancy data
details of buyers, sellers, landlords, tenants, guarantors, occupiers, dependants, emergency contacts and other people connected with a property or transaction.
Communications data
emails, messages, call notes, correspondence, complaints, feedback and records of instructions or consent.
Technical and usage data
IP address, device and browser information, website activity, cookie identifiers, form submissions and security logs.
Marketing data
interests, preferences, campaign interactions and decisions about receiving marketing.
CCTV and access data
images or records captured at offices or managed properties where CCTV or access-control systems are used.
Recruitment and supplier data
employment history, qualifications, references, right-to-work information, business contact details and due-diligence records.
Special category and criminal-offence data
We do not routinely seek special category data, but may process health, disability, racial or ethnic origin, religious belief, sexual orientation or similar information where relevant to accessibility, safeguarding, housing requirements, legal claims or another lawful purpose. We may process criminal-offence information where necessary for fraud prevention, AML checks, property safety, legal claims or legal obligations. We will use an appropriate UK GDPR Article 9 condition and Data Protection Act 2018 condition where required.
5. How we collect personal data
We collect personal data:
· directly from you, including through forms, email, telephone, meetings, viewings, valuations, applications, contracts and our website;
· from another party to a transaction or property, such as a landlord, tenant, seller, buyer, guarantor, occupier or representative;
· from professional advisers and service providers, including solicitors, conveyancers, mortgage brokers, surveyors, contractors, inventory clerks, referencing providers and payment providers;
· from public and official sources, including HM Land Registry, Companies House, electoral registers, local authorities, courts, insolvency registers and sanctions or PEP databases;
· from property portals, lead-generation services, social-media platforms and advertising partners where you have made an enquiry or permitted information to be shared;
· through cookies, analytics, security systems, CCTV and your use of our website or online services.
Where you give us personal data about another person, you should ensure that you are permitted to do so and, where appropriate, make this policy available to them.
6. Why we use personal data and our lawful bases
We only use personal data where we have a lawful basis. More than one basis may apply. The principal purposes and bases are set out below.
Purpose
Lawful basis
Responding to enquiries, arranging valuations and viewings, preparing particulars and managing negotiations
Steps at your request before a contract; performance of a contract; legitimate interests in providing and administering property services.
Marketing, selling, letting and managing properties
Contract; legitimate interests; legal obligations. Where marketing rules require consent, we will obtain it.
Verifying identity, ownership, authority, source of funds and compliance with AML, sanctions and fraud-prevention requirements
Legal obligation; public interest; legitimate interests in preventing crime and protecting customers and our business.
Tenant referencing, affordability checks, guarantor checks and Right to Rent checks
Steps before a contract; contract; legal obligation; legitimate interests. Consent will not normally be the primary basis where processing is necessary for these purposes.
Preparing, administering and enforcing agency agreements, tenancies, deposits, rent, fees, maintenance and other services
Contract; legal obligation; legitimate interests in administering and protecting contractual rights.
Sharing information with parties and professionals involved in a transaction
Contract; steps before a contract; legal obligation; legitimate interests in progressing the transaction.
Safety, security, complaints, claims, debt recovery and dispute resolution
Legal obligation; legitimate interests in protecting people, property and legal rights; establishment, exercise or defence of legal claims.
Business administration, auditing, accounting, training, service improvement and system security
Legal obligation; legitimate interests in running and improving our business and protecting information.
Sending relevant marketing and measuring its effectiveness
Consent where required by PECR; otherwise legitimate interests, subject to your right to object and any applicable “soft opt-in”.
Recruitment and supplier management
Steps before a contract; contract; legal obligation; legitimate interests in recruiting staff and managing suppliers.
Legitimate interests
Where we rely on legitimate interests, we consider whether the use is necessary and balance our interests against your rights and reasonable expectations. You may ask for further information about a relevant assessment.
When providing data is required
Some personal data is needed to enter into or perform a contract, comply with law, verify identity or progress a property transaction. If required information is not provided, we may be unable to act for you, arrange a tenancy, progress a transaction or provide a requested service.
7. Estate agency sales
For sellers, prospective sellers, buyers and prospective buyers, we may use personal data to:
· provide market appraisals and valuations;
· verify identity, ownership, authority and source of funds;
· prepare and publish property particulars, photographs, videos, floor plans and advertisements;
· arrange and record viewings, feedback, offers and negotiations;
· qualify buyers and progress agreed sales;
· communicate with conveyancers, mortgage brokers, surveyors, buyers, sellers and other relevant parties;
· manage keys, access, appointments, complaints, fees, invoices and legal claims;
· meet AML, sanctions, fraud-prevention, tax, accounting and regulatory obligations.
8. Lettings and property management
For landlords, prospective landlords, tenants, applicants, guarantors and occupiers, we may use personal data to:
· value, advertise and let properties;
· arrange viewings and process applications;
· conduct identity, Right to Rent, affordability, credit, employment, landlord and other reference checks;
· prepare and administer tenancy, guarantor, deposit and management arrangements;
· collect or account for rent, deposits, fees, invoices and payments;
· manage check-in, inventories, inspections, renewals, notices, check-out and deposit deductions;
· coordinate repairs, maintenance, safety inspections, utilities, contractors and emergency access;
· manage arrears, complaints, anti-social behaviour, safeguarding, insurance and legal proceedings;
· provide information to landlords, tenants, guarantors, deposit schemes, local authorities, utilities and other parties where lawful.
9. Who we share personal data with
We may share personal data where necessary and lawful with:
· the other Castles company and authorised staff, agents or group service functions;
· buyers, sellers, landlords, tenants, applicants, guarantors, occupiers and their authorised representatives;
· solicitors, licensed conveyancers, mortgage brokers, lenders, surveyors, valuers and insurers;
· property portals and advertising platforms, such as Rightmove, Zoopla, OnTheMarket and social-media advertising services, where used;
· tenant-referencing, identity-verification, AML, sanctions, fraud-prevention, credit-reference and Right to Rent service providers;
· deposit-protection schemes, inventory providers, utility-management services, contractors, tradespeople, cleaners, locksmiths and safety inspectors;
· IT, CRM, website hosting, cloud storage, communications, analytics, e-signature, payment, accounting and document-management providers;
· HM Revenue & Customs, HM Land Registry, local authorities, courts, tribunals, police, regulators, ombudsman or redress schemes and other public bodies;
· auditors, accountants, legal advisers, insurers, prospective purchasers or investors in connection with professional advice or a business reorganisation or sale;
· any other recipient where you direct us to share information, give valid consent, or where disclosure is otherwise permitted or required by law.
We require service providers acting as processors to protect personal data, use it only on our documented instructions and meet applicable data-protection requirements. Some recipients, such as solicitors, lenders, portals, referencing providers, public authorities and deposit schemes, may act as independent controllers under their own privacy notices.
10. Property advertising, images and online listings
Property particulars may include address information, photographs, videos, floor plans, virtual tours and descriptions. We take reasonable steps to avoid publishing unnecessary personal information. Sellers, landlords and occupiers should remove or conceal personal documents, family photographs, vehicle registrations, security codes and other sensitive items before marketing photography or video. Published material may remain in portal archives, search-engine caches, historic listings or transaction records after a property is sold or let, although we will take reasonable steps to update or remove material within our control where appropriate.
11. Direct marketing
We may contact you about properties, valuation services, lettings, property management or other relevant services. For electronic marketing to individuals, we will comply with PECR. We will use consent where required or, where available, the limited “soft opt-in” for similar services offered to an existing customer or a person who has negotiated for those services, provided a clear opt-out was offered when details were collected and in every message.
You can stop marketing at any time by using the unsubscribe option in a message or emailing [email protected]. Opting out of marketing does not prevent service communications needed for a transaction, tenancy, contract, safety issue or legal obligation. We may retain a minimal suppression record so that we respect your choice.
12. Cookies and similar technologies
Our website may use cookies, pixels, local storage and similar technologies. Strictly necessary technologies may be used without consent where permitted. We will request consent before placing or accessing non-essential cookies, including analytics, advertising or personalisation cookies, unless a legal exemption applies. You can manage choices through our cookie controls and browser settings. Withdrawing consent will not affect earlier lawful processing.
Website action required: The website should display a consent mechanism that prevents non-essential cookies from operating before consent, offers an equally accessible reject option, records choices and links to accurate cookie details listing each technology, provider, purpose and duration.
13. International transfers
Some suppliers or technology providers may store or access personal data outside the United Kingdom. Where a transfer is restricted under the UK GDPR, we will use an approved safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. We will carry out appropriate transfer-risk assessments and apply supplementary measures where required. You may contact us for further information about safeguards relevant to your data.
14. How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purpose collected, including legal, regulatory, tax, accounting, insurance, complaint and claim requirements. Retention may be extended where a complaint, investigation, dispute, legal hold or other justified need exists. We may securely delete or anonymise information when it is no longer required.
Record
Typical retention approach
General enquiries not leading to a service or transaction
Normally up to 24 months after the last meaningful contact.
Marketing records
Until you opt out, consent is withdrawn, details become inaccurate, or continued use is no longer justified; suppression records may be kept longer to honour objections.
Sales agency and completed transaction files
Normally 6 years after completion or termination, with selected AML records generally retained for 5 years after the business relationship ends, unless law or risk requires longer.
Landlord, tenancy, guarantor and property-management records
Normally 6 years after the tenancy or management relationship ends, subject to deposit, tax, safety, complaint and legal requirements.
Unsuccessful tenancy applications and referencing data
Normally up to 12 months after the decision, unless a longer period is justified by a complaint, dispute, fraud concern or legal requirement.
Right to Rent records
For the tenancy and at least 1 year after it ends, or longer where law or official guidance requires.
CCTV
Normally up to 31 days, unless footage is needed for an incident, investigation or claim.
Call recordings, where used
Normally up to 12 months, unless needed for quality, complaint or legal purposes.
Website and security logs
Normally between 30 days and 24 months depending on the log, risk and technical purpose.
Recruitment records
Normally 6 months after an unsuccessful application; longer with consent for a talent pool or where legally justified. Successful applicant records form part of the employment record.
Supplier and financial records
Normally 6 years after the relevant financial year or end of the relationship.
15. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, staff training, confidentiality duties, secure systems, backups, supplier due diligence, incident procedures and physical security. No system is completely secure, but we review controls in light of risk and available technology.
If a personal-data breach occurs, we will assess the risk, take appropriate remedial action and notify the Information Commissioner’s Office (“ICO”) and affected individuals where legally required.
16. Automated decision-making and profiling
We do not currently make decisions producing legal or similarly significant effects solely by automated means. Referencing, fraud, identity or affordability providers may use automated tools or risk indicators, but Castles will seek to ensure that meaningful human involvement is available where required. If we introduce solely automated significant decisions, we will provide the information and safeguards required by law.
17. Children’s information
Our services are not directed at children. We may nevertheless process limited information about children where relevant to household occupancy, a tenancy, a property transaction, safeguarding, accessibility or a legal obligation. We expect a parent, guardian, landlord, tenant or other responsible adult to provide such information lawfully. We will limit its use and apply additional care where children may be affected.
18. Your data-protection rights
Depending on the circumstances, you may have the right to:
· be informed about how your personal data is used;
· request access to your personal data and a copy of it;
· ask us to correct inaccurate or incomplete data;
· ask us to erase personal data where there is no lawful reason to keep it;
· ask us to restrict processing in specified circumstances;
· object to processing based on legitimate interests or public task, and object at any time to direct marketing;
· receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
· withdraw consent at any time where processing relies on consent;
· request safeguards in relation to solely automated significant decisions;
· complain to the ICO.
These rights are not absolute. We may need to verify your identity and clarify the scope of a request. We will request only information reasonably necessary for verification. We normally respond within one month, although the law permits an extension for complex or numerous requests. We do not usually charge a fee, but may do so or refuse a request where legally permitted, for example if it is manifestly unfounded or excessive.
To exercise a right, email [email protected]. Please describe the information or processing concerned and provide enough detail for us to locate relevant records.
19. Complaints
Please contact Ronnie Clarke at [email protected] first so that we can try to resolve your concern. You also have the right to complain to the ICO, the UK supervisory authority for data protection. The ICO can be contacted through its website at https://ico.org.uk or by using the contact details published there. Your right to complain is not affected by contacting us first.
20. Third-party websites and services
Our website or communications may link to property portals, social networks, mapping services, payment services and other third-party websites. Those organisations control their own processing and privacy notices. We are not responsible for their privacy practices merely because we provide a link or integration, although we will select and manage our own service providers in accordance with applicable law.
21. Changes to this policy
We may update this policy to reflect changes in law, regulatory guidance, technology or our services. The current version will be published on our website with its effective date. We may provide additional notice where a change is significant or where required by law.
22. Document control
Document owner
Ronnie Clarke, Data Protection Contact
Version
1.0
Effective date
6 August 2026
Next review
By 6 August 2027, or earlier following a material legal or operational change