Data Protection and GDPR Policy
Safelet Property
Last updated: January 2026
1. Purpose
This policy explains how Safelet Property complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to protecting the rights and freedoms of individuals whose personal data we collect and process while providing property, real estate, and related consultancy services.
2. Scope
This policy applies to all personal data processed by Safelet Property, whether in electronic or paper form, including data relating to:
- Clients (buyers, sellers, landlords, tenants)
- Prospective clients and enquiries
- Contractors, suppliers, and business partners
- Employees and associates (where applicable)
3. Definitions
- Personal Data: Any information that identifies or can identify an individual.
- Special Category Data: Sensitive personal data requiring additional protection (e.g. health information, ethnicity).
- Processing: Any operation performed on personal data (collection, storage, use, sharing, deletion).
- Data Subject: The individual whose personal data is processed.
- Data Controller: Safelet Property, which determines the purposes and means of processing personal data.
4. Data Protection Principles
Safelet Property processes personal data in accordance with the UK GDPR principles. Personal data will be:
- Processed lawfully, fairly, and transparently
- Collected for specified, explicit, and legitimate purposes
- Adequate, relevant, and limited to what is necessary
- Accurate and kept up to date
- Retained only for as long as necessary
- Processed securely and protected against unauthorised access
5. Lawful Basis for Processing
We process personal data under one or more of the following legal bases:
- Contract: To fulfil contractual obligations with clients
- Legal Obligation: To comply with Anti-Money Laundering (AML) and other regulatory requirements
- Legitimate Interests: To operate, manage, and promote our services
- Consent: For specific marketing communications where required
6. Categories of Personal Data Collected
We may collect and process the following categories of personal data:
- Contact details (name, address, telephone number, email)
- Identification documents (for AML compliance)
- Financial information (e.g. proof of funds, bank statements where required)
- Property-related information
- Communication records (emails, messages, call notes)
Safelet Property does not routinely collect Special Category Data. Where such data is provided (for example, accessibility requirements for property viewings), it will only be processed where necessary and with explicit consent.
7. Data Subject Rights
Under the UK GDPR, data subjects have the right to:
- Be informed about how their data is used
- Access their personal data
- Request rectification of inaccurate or incomplete data
- Request erasure of data (where applicable)
- Restrict processing
- Data portability
- Object to processing
- Rights related to automated decision-making (not applicable to our services)
Requests should be made in writing to info@safeletproperty.com. We will respond within one calendar month.
8. Data Sharing and Disclosure
We may share personal data with:
- Professional and regulatory bodies (e.g. HMRC, Property Redress Schemes, The Property Ombudsman)
- Third-party service providers (e.g. conveyancers, surveyors, referencing agencies)
- Law enforcement or regulatory authorities where legally required
We do not sell personal data or share it for third-party marketing purposes without explicit consent.
9. Data Retention
We retain personal data only for as long as necessary:
- AML records: minimum of 5 years
- Transaction and contractual files: 6 years
- General enquiries: up to 2 years
- Marketing data: until consent is withdrawn
At the end of the retention period, data is securely deleted or destroyed.
10. Security Measures
We implement appropriate technical and organisational measures to protect personal data, including:
- Strong password policies and access controls
- Secure cloud storage and encryption of sensitive data
- Locked storage for physical documents
- Regular reviews of data access and security procedures
11. Data Breaches
A personal data breach includes any unauthorised access, loss, or disclosure of personal data.
- All data breaches are recorded in a Data Breach Register
- Serious breaches are reported to the Information Commissioner’s Office (ICO) within 72 hours
- Affected individuals are notified where required
12. Responsibilities
The Data Controller for Safelet Property is responsible for ensuring compliance with this policy.
All employees, contractors, and associates must comply with this policy and applicable data protection laws.
13. Policy Review
This policy is reviewed annually or sooner if there are significant changes to legislation or business operations.
