Privacy Policy

1. Who we are

We are Brinkley Estates Ltd (“Brinkleys”, “we”, “us” or “our”) with registered number 09927407 and address 120 Wimbledon Hill Road Wimbledon, SW19 7QU.. Brinkley Estates Ltd is the controller of your personal data unless this notice says otherwise.

We are committed to protecting personal data and handling it in accordance with the UK GDPR, the Data Protection Act 2018, and other applicable privacy laws.

If you have any questions about this privacy notice or how we use personal data, please contact our Data Protection Lead at [email protected].

2. Who this notice applies to

This privacy notice applies to personal data we process about:

• sellers and buyers;
• landlords and tenants;
• guarantors, occupiers and referees;
• prospective landlords, tenants, buyers and sellers;
• contractors and suppliers;
• complainants and other correspondents;
• website visitors; and
• other individuals whose personal data we process in connection with our business activities.

3. What personal data we collect

Depending on the service we provide, we may collect and use the following categories of personal data:

Category	What this includes
Identity data	Name, title, date of birth, nationality, passport details, driving licence details, national insurance number, company directorships, beneficial ownership information and other identity verification information.
Contact data	Home address, correspondence address, email address, telephone numbers and other contact details.
Financial data	Bank account details, payment details, rent payment history, affordability information, source of funds information, source of wealth information and other financial information relevant to a transaction or legal compliance.
Transaction data	Details of property instructions, viewings, offers, tenancy applications, tenancy agreements, sales progression, deposits, maintenance issues, complaints and related records.
Compliance data	AML and identity verification results, sanctions and PEP screening results, fraud prevention checks, right to rent information where applicable, and other information needed to comply with legal and regulatory obligations.
Marketing and communications data	Preferences in receiving marketing, opt-in and opt-out records, and your communication preferences.
Call and correspondence data	Emails, letters, notes of calls, messages, and call recordings where calls are recorded.

We may also receive personal data from publicly available sources, referees, employers, agents, solicitors, conveyancers, landlords, tenants, buyers, sellers, compliance providers and service providers.

4. How we collect personal data

We collect personal data:

• directly from you;
• when you contact us by phone, email, website form or in person;
• from landlords, tenants, buyers, sellers and their representatives;
• from guarantors and referees;
• from property portals and online platforms;
• from compliance and verification providers;
• from public registers and publicly available sources; and
• from regulators, redress schemes, courts, law enforcement and other authorities where relevant.

5. How we use personal data

We only use personal data where we have a lawful basis to do so.

Reference	What do we use your personal data for?	Lawful bases
Sales	market and introduce properties; arrange and record viewings; handle offers and negotiations; verify identity and carry out compliance checks; liaise with buyers, sellers, solicitors, brokers and other parties; progress transactions; and maintain records of the transaction.	Performance of a contract, legitimate interests, legal obligation.
Lettings	market properties for let; assess applicants; obtain references and affordability information; prepare tenancy documentation; protect deposits; administer rent and tenancy issues; manage check-in, check-out and disputes; and communicate with landlords, tenants, guarantors and contractors.	Performance of a contract, legitimate interests, legal obligation.
Property management	manage maintenance and repair issues; instruct contractors and suppliers; deal with inspections, access, inventories and compliance matters; administer rent, renewals, notices and end-of-tenancy matters; handle complaints and disputes; and communicate with landlords, tenants and service providers.	Performance of a contract, legitimate interests, legal obligation.
Anti-money laundering, identity verification and compliance	verify identity; carry out customer due diligence; assess source of funds and source of wealth where required; carry out sanctions and PEP screening; prevent fraud; and comply with anti-money laundering, financial crime and other legal obligations.	Legal obligation, legitimate interests.
Communications and customer service	Respond to enquiries, provide updates, handle complaints, maintain internal records, and where applicable record calls for training, monitoring, complaint handling and service quality purposes.	Legitimate interests, performance of a contract, legal obligation.
Marketing	Send relevant marketing communications about our services where permitted by law.	Consent and/or legitimate interests, depending on the nature of our relationship with you and the type of communication.
Website administration and analytics	Operate, secure and improve our website and systems, including through analytics and security monitoring.	Legitimate interests and, where required, consent for non-essential cookies and similar technologies.

6. AML / Lifetime Legal

Where relevant to a transaction or instruction, we may share personal data with Lifetime Legal Ltd and/or other compliance providers in order to carry out anti-money laundering, identity verification and related compliance checks.

This may include sharing:

• identity data;
• contact data;
• proof of address;
• ID document details;
• beneficial ownership information;
• source of funds information;
• source of wealth information; and
• other information reasonably required for customer due diligence, fraud prevention, sanctions screening and compliance checks.

We do this to comply with our legal obligations and to protect our business and clients from fraud and financial crime.

7. South African administration support

Some of our administration and support services are provided by Twelfth Capital (Pty) Ltd, a South Africa-based administration company.

Employees of Twelfth Capital may access and process personal data on our behalf and may communicate directly with clients, customers, tenants, landlords, buyers, sellers, contractors and other third parties as part of the services they provide for Brinkleys.

This may include support with:

• tenancy administration;
• property management administration;
• customer communications;
• compliance administration;
• maintenance coordination; and
• general back-office support.

Where Twelfth Capital processes personal data on our behalf, it does so under our instructions and subject to confidentiality and security obligations.

8. Who we share personal data with

We may share personal data with selected third parties where reasonably necessary to provide our services, progress a sale, letting or tenancy, manage a property, carry out compliance checks, protect against fraud and financial crime, obtain professional advice, operate our business systems, or comply with legal and regulatory obligations. These third parties may include:

• landlords, tenants, buyers, sellers and their authorised representatives;
• guarantors and referees;
• solicitors, conveyancers, mortgage brokers and lenders;
• referencing and credit-check providers;
• tenancy deposit protection scheme providers;
• inventory clerks, check-in/check-out providers and contractors;
• insurers and insurance brokers;
• payment providers, banks and accounting providers;
• IT, cloud, CRM, telephony and email providers;
• property portals and marketing platforms;
• anti-money laundering and identity verification providers, including Lifetime Legal Ltd;
• Twelfth Capital (Pty) Ltd as our South Africa-based administration support provider;
• legal and compliance advisers;
• HMRC, courts, regulators, redress schemes, law enforcement agencies and other public authorities where required or permitted by law.

We do not sell personal data.

9. International transfers

Because some of our support services are provided from South Africa by Twelfth Capital (Pty) Ltd, personal data may be accessed and processed outside the UK.

Some of our other software or technology providers may also store or process personal data outside the UK.

Where personal data is transferred outside the UK, we take steps to ensure that appropriate safeguards are in place, including, where appropriate, adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, and that personal data is protected in accordance with applicable law.

10. Special category data and criminal offence data

We do not generally seek to collect special category personal data. However, limited special category data or criminal offence data may be processed where necessary for:

• legal claims;
• fraud prevention;
• sanctions screening;
• anti-money laundering compliance;
• safeguarding; or
• compliance with legal obligations.

If we process special category data, we will ensure that we have both an Article 6 lawful basis and an additional condition for processing as required by law.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, regulatory, tax, accounting and dispute-resolution requirements.

Typical retention periods may include:

• sales, lettings and property management files: usually up to 6 years after the end of the matter or relationship, and longer where needed for legal claims or regulatory reasons;
• AML / customer due diligence records: for the period required by law;
• unsuccessful applications and enquiries: usually up to 12 months, unless longer retention is justified;
• marketing records: until you opt out or we no longer have a lawful basis to retain them;
• call recordings and website records: for limited retention periods set by our operational and security policies, unless needed for investigation, security or legal reasons.

We may keep information for longer where required by law or where necessary to establish, exercise or defend legal claims.

12. What happens if you do not provide personal data

If you do not provide information that we reasonably require:

• to enter into or perform a contract;
• to carry out AML or identity checks; or
• to comply with the law,

we may be unable to act for you, continue to act for you, or progress a transaction or tenancy.

13. Marketing

We may send you marketing communications about our services where permitted by law.

You can opt out of marketing at any time by:

• clicking the unsubscribe link in emails; or
• contacting us at [email protected].

Opting out of marketing does not affect service-related communications where we need to contact you in relation to an instruction, tenancy, property, complaint or transaction.

14. Cookies

Our website may use cookies and similar technologies to:

• make the website function properly;
• remember your preferences;
• improve website performance and user experience;
• understand how visitors use the site;
• support security and fraud prevention; and
• help us improve our marketing and online services.

Cookies are small text files placed on your device when you visit a website.

We may use:

• strictly necessary cookies for core website functions;
• analytics cookies to understand site usage; and
• functionality or marketing cookies where applicable.

Where required by law, we will ask for your consent before placing non-essential cookies or similar technologies on your device. You can manage cookies through your browser settings and any cookie banner made available on our website. If you disable certain cookies, some parts of our website may not function properly.

For more information about the cookies we use, please see our cookie settings or cookie banner.

15. Your rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal data is used;
• request access to your personal data;
• request correction of inaccurate personal data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing; and
• request portability of certain personal data.

Where we rely on consent, you may withdraw that consent at any time. To make a subject access request, please contact [email protected]. We may ask you for proof of identity before responding. The right to object must be clearly brought to people’s attention.

16. Automated decision-making

We do not generally make decisions about you based solely on automated processing that produce legal or similarly significant effects.

17. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Access to personal data is limited to those who need it for legitimate business purposes.

18. Changes to this notice

We may update this privacy notice from time to time. The latest version will be available on our website and from us on request.

19. Complaints

If you have any concerns about how we use your personal data, please contact us first at [email protected].

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. Details of how to contact the ICO are available on its website.