Legal Notice

PRIVACY POLICY

Last Updated: July 2026

Section One: Introduction
Welcome to the privacy policy of Heera Estates And Lettings Limited. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) or interact with us directly as a landlord, tenant, guarantor, or applicant. It also tells you about your privacy rights and how the law protects you under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Section Two: Important Information and Who We Are
Heera Estates And Lettings Limited is the data controller and is responsible for your personal data (collectively referred to as "we", "us" or "our" in this privacy policy).

If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out below:

• Full Name of Legal Entity: Heera Estates And Lettings Limited
• Email Address: info@heeraestates.co.uk
• Postal Address: 120c Melton Road, Leicester, LE4 5ED, United Kingdom
• Telephone Number: 0116 403 0405

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Section Three: The Data We Collect About You
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store, and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: Includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, proof of identity, national insurance number, and immigration/Right to Rent compliance records.
• Contact Data: Includes billing address, delivery address, residential tenancy address, forwarding addresses, email address, and telephone numbers.
• Financial Data: Includes bank account details, payment card records, and detailed financial background details or credit histories from external reference agencies.
• Transaction Data: Includes historical details about rental payments to and from you and other detailed records of property management products or letting services you have engaged from us.
• Technical Data: Includes the internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time-zone setting and location, browser plug-in types and versions, and your operating system and platform.
• Profile Data: Includes your account portal username and password, historical interactions, preferences, feedback, and survey responses.
• Usage Data: Includes information about how you navigate and interact with our website, client portals, and administrative services.
• Marketing and Communications Data: Includes your explicit preferences in receiving marketing updates from us and our associated third parties, alongside your communication preferences.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data), nor do we collect any information regarding criminal convictions, except where required by strict statutory anti-money laundering frameworks. Please note that our physical business premises do not operate CCTV surveillance systems.

Section Four: How Is Your Personal Data Collected?
We use different methods to collect data from and about you including through:

• Direct Interactions: You may give us your Identity, Contact, and Financial Data by filling in paper or digital forms or by corresponding with us by post, phone, email, text message, or otherwise. This includes personal data you provide when you apply to rent a property, list a property for lease, create an account on our customer platforms, subscribe to our property alerts, or request marketing materials.
• Automated Technologies or Interactions: As you interact with our web services, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and tracking systems built into our hosting environment. Our website platform is hosted on secure external infrastructure provided by IONOS.
• Third Parties or Publicly Available Sources: We receive personal data about you from various third parties and public sources including:
  • Estate agency business management suites and Client Relationship Management (CRM) tools, specifically our integrated 1090 CRM database platform.
  • Comprehensive online tenant referencing and tenant screening providers, specifically Canopy.
  • Industry-standard property portals and online advertising networks used to source and facilitate property inquiries, which may include platforms such as Rightmove, Zoopla, OnTheMarket, Facebook Marketplace, and Gumtree.
  • Statutory credit reference agencies and identity verification bureaus.
  • Publicly available registries such as Companies House and the Electoral Register within the United Kingdom.

Section Five: How We Use Your Personal Data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contractual obligations we are about to enter into or have entered into with you as a landlord or tenant.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with an explicit legal or regulatory obligation (including completing mandatory Right to Rent checks within England, or fulfilling statutory UK Anti-Money Laundering verifications).

Section Six: Purposes For Which We Will Use Your Personal Data
We have set out below a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate:

• To register you as a prospective customer: Relies on the performance of a contract with you.
• To process and manage tenancies: Including executing credit profiling, background screening through Canopy, drafting tenancy agreements, and collecting rental funds. Relies on the performance of a contract with you.
• To administer deposit protection: Managing statutory security deposits through our registered government scheme provider, the Deposit Protection Service (DPS). Relies on a strict legal obligation.
• To manage our relationship with you: Which will include notifying you about changes to our terms or privacy policy, or asking you to leave a review. Relies on the performance of a contract with you, compliance with a legal obligation, and our legitimate interests to keep our business records updated.
• To enable property maintenance and emergency repairs: Passing necessary contact data to verified third-party contractors and tradespeople. Relies on our legitimate interests to protect and maintain the structural integrity of managed client assets.
• To transfer necessary utility accounts: Communicating occupancy change records with local municipal authorities (Council Tax billing) and water, gas, electricity, or broadband suppliers. Relies on our legitimate business interests to ensure accurate billing transitions.

You will receive marketing communications from us if you have requested information from our team or explicitly registered for property updates on our website and you have not opted out of receiving that marketing. You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing transmission or by emailing info@heeraestates.co.uk directly.

Section Seven: Disclosures of Your Personal Data
We may share your personal data with external parties for the explicit purposes of property management, background validation, and statutory compliance:

• Professional service providers acting as processors who deliver IT, software hosting, database infrastructure, and general system administration, including IONOS and our 1090 CRM environment.
• Identity validation and referencing platforms, specifically Canopy, alongside credit reference registries.
• Third-party contractors, independent tradespeople, and repair specialists who require access to contact details to coordinate structural repairs at managed addresses.
• Public bodies, utility network operations, and local authorities where a change of occupancy requires a modification of accounts for billing stability.
• The Deposit Protection Service (DPS) to secure tenant deposits under statutory frameworks.
• Third-party marketing platforms or online directory networks where you submit direct property inquiries to our agency.
• Professional advisers acting as processors or joint controllers including legal specialists, financial institutions, insurance brokers, and accounting firms based in the United Kingdom.
• HM Revenue & Customs, regulatory bodies, and law enforcement authorities based in the UK who require reporting of processing activities in specific legal situations.

Section Eight: International Transfers
We do not transfer your personal data outside the United Kingdom. All client files, communication histories, and asset records are safely retained on servers based within the UK.

Section Nine: Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a strict duty of confidentiality.

Section Ten: Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, and the applicable legal requirements (such as retaining financial ledger records and tenancy contracts for up to 6 years following contract completion to satisfy UK tax rules).

Section Eleven: Your Legal Rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a "data subject access request").
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data where there is no good reason for us continuing to process it.
• Object to processing of your personal data where we are relying on a legitimate interest.
• Request restriction of processing of your personal data to suspend its processing in specific scenarios.
• Request the transfer of your personal data to you or to a third party in a structured, machine-readable format.
• Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of the statutory rights set out above, please contact our administrative desk via email at info@heeraestates.co.uk.