Effective Date: 1st January 2026
Review Date: Annually
1. Policy Statement
Chosen Home Limited is committed to protecting the privacy and security of personal data and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.
As a residential estate agency, we collect and process personal information relating to sellers, buyers, prospective purchasers, suppliers and employees. We recognise our responsibility to handle such information lawfully, fairly and transparently.
2. Scope
This policy applies to:
- Directors
- Employees
- Contractors
- Consultants
- Temporary workers
- Any third party processing data on behalf of Chosen Home Limited
3. Data Protection Principles
Chosen Home Limited will ensure personal data is:
- Processed lawfully, fairly and transparently.
- Collected only for legitimate business purposes.
- Relevant and limited to what is necessary.
- Accurate and kept up to date.
- Retained only as long as necessary.
- Protected against unauthorised access, loss or damage.
- Managed in a manner that demonstrates accountability.
4. Personal Data We Collect
Sellers
We may collect:
- Name
- Home address
- Correspondence address
- Telephone numbers
- Email addresses
- Property ownership information
- Identification documents where required
- Anti-money laundering information
- Solicitor details
Buyers
We may collect:
- Name
- Address
- Telephone numbers
- Email addresses
- Viewing records
- Buying requirements
- Financial position information relevant to property purchases
- Mortgage status
- Solicitor details
Prospective Clients
We may collect:
- Contact details
- Valuation enquiries
- Property information
- Marketing preferences
Employees
We may collect:
- Payroll information
- Contact details
- Employment records
- Pension information
- Emergency contact details
5. Lawful Bases for Processing
Chosen Home Limited processes personal data under the following lawful bases:
Contract
To:
- Market residential properties
- Arrange viewings
- Negotiate sales
- Communicate with buyers and sellers
- Manage instructions from clients
Legal Obligation
To comply with:
- Anti-Money Laundering Regulations
- HM Revenue & Customs requirements
- Court orders
- Regulatory obligations
Legitimate Interests
To:
- Operate and improve our services
- Prevent fraud
- Maintain accurate client records
- Defend legal claims
- Ensure business continuity
Consent
Where required for:
- Property alerts
- Marketing emails
- Promotional communications
Consent may be withdrawn at any time.
6. Marketing Communications
Chosen Home Limited may send marketing communications where:
- Individuals have consented; or
- The communication is permitted under applicable marketing regulations.
Individuals can unsubscribe at any time using the contact details provided in communications.
7. Sharing Personal Data
Personal information may be shared with:
- Solicitors and conveyancers
- Mortgage advisers and lenders
- Anti-money laundering verification providers
- Surveyors and valuers
- Property portals including Rightmove and Zoopla
- IT service providers
- Accountants and professional advisers
- Government departments and regulators where legally required
We will only share data where there is a lawful basis for doing so.
8. Data Security
Chosen Home Limited maintains appropriate security measures including:
- Password-protected systems
- Secure email practices
- Access controls limiting data access to authorised personnel
- Encrypted cloud storage where available
- Anti-virus and firewall protection
- Secure disposal of confidential information
- Regular software updates and security monitoring
Paper records containing personal information will be stored securely and access restricted to authorised individuals.
9. Data Retention
Personal information will not be retained longer than necessary.
Typical retention periods are:
| Property sales records |
6 years after completion |
| Client records |
6 years after completion or instruction end |
| AML records |
5 years from the end of the business relationship |
| Marketing consent records |
Until consent is withdrawn plus 2 years |
| Employee records |
6 years after employment ends |
| Accounting records |
6 years in accordance with HMRC requirements |
At the end of the retention period, information will be securely deleted or destroyed.
10. Individual Rights
Individuals have the right to:
- Be informed about how their data is used
- Request access to their personal data
- Request correction of inaccurate data
- Request deletion where appropriate
- Restrict processing
- Object to processing
- Request data portability where applicable
- Withdraw consent where processing is based on consent
Requests will normally be responded to within one month.
11. Subject Access Requests
Requests for personal information should be submitted in writing to the Data Protection Lead.
Identity verification may be required before information is disclosed.
No fee will normally be charged unless a request is excessive or repetitive.
12. Personal Data Breaches
Any actual or suspected breach of personal data must be reported immediately to management.
Chosen Home Limited will:
- Investigate the incident.
- Assess any risk to individuals.
- Take remedial action.
- Notify the Information Commissioner’s Office where legally required.
- Inform affected individuals if a high risk exists.
A record of all breaches and outcomes will be maintained.
13. Employee Responsibilities
All personnel must:
- Keep personal information secure.
- Follow company procedures.
- Use strong passwords.
- Avoid sharing confidential information unnecessarily.
- Report data breaches promptly.
- Attend data protection training where required.
Failure to comply with this policy may result in disciplinary action.
14. Data Protection Lead
The Data Protection Lead for Chosen Home Limited is:
Name: Dominic Stokes
Position: Director
Email: [email protected]
Telephone: 0121 222 1180
15. Review
This policy will be reviewed annually or sooner if:
- Legislation changes;
- ICO guidance changes;
- Business activities change significantly; or
- A serious data breach occurs.
