Data Protection Policy

UK GDPR internal policy · Version 1.0

Policy · Responsibilities · Records of processing · Retention · Rights requests · Breaches · Security · Suppliers · Marketing and cookies

1. Policy statement

Oak & Acre, a trading name of Oak and Acre Estate Agents Ltd, is a data controller and has applied to register with the Information Commissioner's Office (ICO); the registration number will be published here once issued. We handle personal information in line with the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR). This policy applies to everyone who works for us. Our customer-facing Privacy Policy explains the same commitments to clients.

2. The principles we follow

We use personal information lawfully, fairly and openly.
We collect it only for clear, stated purposes.
We collect no more than we need.
We keep it accurate and up to date.
We keep it no longer than necessary.
We keep it secure.
We can show how we comply.

3. Responsibilities

Data protection lead: Dr James Aziz, Director. Owns this policy, handles rights requests and breaches, and is the ICO's point of contact. A small business like ours does not need a formal Data Protection Officer.
All staff: follow this policy, complete training, and report any breach or rights request to the data protection lead straight away.

4. Record of processing activities

Activity and peopleLawful basisKept for

Sales: sellers and buyers. Contact details, property details, offers, correspondence.Contract6 years after completion

AML checks: sellers, buyers, landlords. ID, address, ownership, source of funds.Legal obligation5 years after the relationship ends

Lettings: landlords and tenants. Referencing, Right to Rent, tenancy documents.Contract and legal obligation6 years after the tenancy ends. Right to Rent: 1 year after the tenancy ends.

Client money: rent, deposits, bank details, statements.Contract and legal obligation6 years from the end of the financial year

Applicants and enquiries: buyers and tenants searching for property.Legitimate interests12 months from last contact

Marketing: newsletters and property alerts.Consent, or the soft opt-in for existing clientsUntil the person unsubscribes

Community support requests: may include health or personal circumstances.Explicit consent12 months after the request is closed

Staff and contractors: HR and payroll.Contract and legal obligation6 years after employment ends

5. Rights requests

People can ask to see, correct, delete or move their information, or object to how we use it. When a request arrives in any form, whether email, phone or in person:

pass it to the data protection lead the same day;
confirm the person's identity where there is genuine doubt;
make reasonable and proportionate searches of our systems, email and paper files;
respond within one month, which can be extended by two further months for complex requests if we tell the person why;
log the request, the outcome and the date.

We keep information we are legally required to hold, such as AML records, even if someone asks us to delete it, and we explain this to them. We also handle complaints about how we use personal information, and acknowledge them within 30 days.

6. Data breaches

Anyone who discovers a breach, such as a lost phone, an email sent to the wrong person or a hacked account, must tell the data protection lead immediately.
The data protection lead contains the breach, assesses the risk and records it in the breach log.
If the breach is likely to put people at risk, we report it to the ICO within 72 hours of becoming aware of it.
If the risk to people is high, we tell them directly without delay, with advice on protecting themselves.
We also notify our cyber and data insurer, Hiscox, on its 24-hour line (+44 (0)1206 773791) or at cyberclaims@hiscox.com, within 72 hours. Policy reference 15701799, arranged through PolicyBee.

7. Security

Two-factor sign-in on email, property software and banking.
Encrypted laptops and phones, with screen locks and remote wipe.
Identity documents stored only in our secure system, never in personal email or messaging apps.
Paper files locked away, and shredded when no longer needed.
Keys coded so they cannot be linked to an address.
Access to client information limited to the staff who need it.

8. Suppliers who handle our data

We use suppliers only under a written contract that meets UK GDPR requirements, and we check that they store data securely. Current suppliers include:

our property management software provider;
our tenant referencing partner;
our electronic ID verification provider;
our email and cloud storage provider;
our government-approved tenancy deposit scheme;
property portals, currently Rightmove, Zoopla, OnTheMarket and PrimeLocation.

Where a supplier stores data outside the UK, we make sure UK adequacy regulations or the International Data Transfer Agreement apply.

9. Marketing and cookies

We send marketing emails and texts only to people who have opted in, or to existing clients about similar services under the soft opt-in, and every message includes a simple way to unsubscribe.
Our website does not currently use cookies. If we add analytics or advertising cookies, we will ask for consent before any are set and update our Cookies Policy.

10. New projects

Before starting anything that uses personal information in a new or high-risk way, such as new software, CCTV or a new community support service, the data protection lead carries out a data protection impact assessment.

11. Training and review

All staff complete data protection training when they join and refresh it every year. The ICO registration fee is paid every year. This policy is reviewed at least once a year. Next review: October 2027.

This policy is a working draft prepared for Oak & Acre. Items in square brackets must be completed, and it should be reviewed by a qualified adviser before use.