Privacy & Data
How we store, protect, and — when the time comes — delete your personal data. We hold identity and financial documents as part of buying property, so we take data retention and your rights seriously.
Security
Encryption at rest & in transit
All data is encrypted on our managed platform (SOC 2 Type II & ISO 27001 certified). Identity documents and proof of funds are stored as encrypted files, not embedded in records.
Access controls
Staff access is role-based and authenticated. Two-factor authentication is available and required for staff with access to compliance data.
What we hold
- Identity documents (passport / driving licence) for AML verification
- Proof of funds evidence
- Contact details and investment criteria
- Property viewing reports and offer correspondence
- Conveyancing case documents and solicitor correspondence
- Portfolio and ownership records for managed properties
Retention schedule
| Data category | Retention period |
|---|---|
| Active client & investor records | Life of the relationship, then up to 6 years |
| AML / KYC records (ID verification, proof of funds, PEP & sanctions screening) | 5 years after the end of the business relationship |
| Property & transaction documents (contracts, completion statements) | 6 years |
| Marketing contact data (with consent) | Until consent is withdrawn; suppressed & purged after 24 months of no engagement |
| Lost or dead deal records | Personal data purged after 2 years of no activity |
| Website / contact-form leads that never convert | Purged after 12 months |
| Audit logs | 5 years |
| Deleted records (any entity) | Recoverable for 30 days, then permanently deleted |
When a retention period ends, the record is deleted and remains recoverable for 30 days, then permanently removed.
Your rights
Erasure (right to be forgotten)
Ask us to delete your personal data, subject to regulatory retention above.
Data export
Receive a copy of the personal data we hold about you.
Rectification
Correct inaccurate or incomplete personal data.
Withdraw consent
Stop marketing at any time — we'll suppress your record.
Submit a data request
We action requests within one calendar month. Use this form to request deletion, export, or correction of your data.
Questions about your data? Email us or raise a request above. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
This policy is reviewed at least annually. Last updated: July 2026.