Privacy Policy
This policy explains what personal data Smethurst Sales & Lettings collects, why, who we share it with, and your rights.
Who we are
Smethurst Sales & Lettings ("we", "us") is the data controller for the personal data you provide when you use our website, client portal, and services. We are a property investment and lettings agency based in Liverpool.
What we collect
Identity documents (passport, driving licence) and proof of funds for anti-money-laundering verification; contact details and investment preferences; property viewing and offer correspondence; conveyancing and solicitor correspondence; and portfolio records for managed properties. We collect marketing data only with your consent.
Lawful basis for processing
We process your personal data under: (a) contract — to deliver the services you've requested; (b) legal obligation — to meet AML, KYC and tax record-keeping requirements under the Money Laundering Regulations 2017 and related legislation; (c) legitimate interests — for reasonable business operations such as reporting and fraud prevention; and (d) consent — for marketing communications, which you can withdraw at any time.
Who we share your data with
We share data only where necessary: solicitors and conveyancers acting on your transactions; mortgage brokers and lenders where relevant; HMRC and other regulators where legally required; and our managed-service providers (hosting, email, payments) under appropriate data-processing agreements. We never sell your personal data.
International transfers
Our platform and service providers may process data outside the UK. Where this happens, we rely on adequate safeguards such as UK International Data Transfer Agreements or appropriate contractual clauses to protect your data to UK standards.
How long we keep it
Retention periods are set out in detail on our Data Retention & Requests page. In summary: AML/KYC records are kept for 5 years after our relationship ends (legal requirement); transaction documents for 6 years; marketing data until consent is withdrawn or after 24 months of no engagement; and deleted records are permanently removed after a 30-day recovery window.
Security
All data is encrypted at rest and in transit on our managed platform (SOC 2 Type II and ISO 27001 certified). Access is role-based and authenticated, and staff handling compliance data use two-factor authentication.
Cookies & analytics
We use essential cookies for the portal to function and anonymous analytics to improve our services. We do not use your personal data for cross-site advertising.
Your rights
You have the right to access, rectify, erase, restrict, or object to the processing of your data, to data portability, and to withdraw consent at any time. You can exercise any of these rights from our Data Retention & Requests page or by contacting us. If you're unhappy with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ico.org.uk).
Children's data
Our services are intended for adults. We do not knowingly collect personal data from anyone under 18.
Changes to this policy
We review this policy at least annually and will update it here when it changes. Last updated: July 2026.
Privacy Policy·Terms of Use·Data Retention & Requests
Smethurst Sales & Lettings · PRS Member No. PRS055020 · Client Money Protection