Whites Residential Lettings Ltd & Whites Estate Agents
Please read this policy carefully. It explains how Whites (“we”, “us”, “our”) collects, uses, shares and protects personal data, and your rights under the UK GDPR and related data-protection law.
1.Who we are / Controller information
Controller:
- Whites Estate Agents Limited (Company no. 03656580)
- Whites Residential Lettings Ltd (Company no. 05613117)
Address:
Whites Estate Agents, 339 Wellingborough Road, NN1 4ER, United Kingdom
Contact for data protection / privacy questions, subject-access requests, or concerns:
Email: [email protected]
We do not have a separate Data Protection Officer (DPO). The email above acts as our contact point for data-protection matters.
2. Who this policy applies to (audiences)
This policy applies to all individuals whose personal data we process, including (but not limited to):
- Prospective and current tenants / residents / applicants / guarantors.
- Landlords / property owners.
- Prospective and current buyers / sellers (in respect of sales).
- Contractors / tradespeople / service providers we engage (e.g. for repairs).
- Other contacts (e.g. referees, agents, intermediaries, prospective leads).
We provide below some separate mini-sections “If you are a …” so you can quickly find what applies to you.
3. What personal data we collect and when / how
Depending on your role (tenant, applicant, buyer, seller, landlord, contractor), we may collect:
- Identity & contact details: full name, date of birth, current and previous addresses, passport/immigration-status/Right to Rent share-code (where provided), contact phone number(s), email address.
- Financial and payment information: bank transfer details used for rent, deposit, payments; guarantor information; deposit amount; rent amount; tenancy start and end dates.
- Employment and credit information: employment details, credit history, references (via our referencing provider FCC Paragon), landlord references, previous tenancy references.
- Property-related information: address of rental or sale property, tenancy or sale agreement details, property condition, repairs history, communications about property maintenance or complaints.
- Communications data: telephone call recordings (for training, monitoring and dispute-resolution), emails, messages, notes.
- Website / online data: data collected via our website including analytics data (via Google Analytics), which may include IP addresses, usage data, cookies or similar identifiers — if and when you interact with our website or online systems.
We do not routinely collect any special-category data (e.g. health, race, religion, biometric data, criminal-conviction data), unless you voluntarily provide such data (for example a request for a disability-related property adaptation).
We generally collect personal data:
- Directly from individuals (applicants, tenants, landlords, buyers, sellers, contractors), for example via application forms, tenancy or sale agreements, telephone calls, email, or in-person.
- From third parties when necessary — for example from FCC Paragon when obtaining references or credit history.
4. Why we process data (Purposes) & Lawful bases
We process personal data for a variety of purposes. Below is a summary of the main purposes, and the lawful basis under UK GDPR that we rely on:
| Purpose | Lawful basis |
| Processing tenancy applications and referencing (via FCC Paragon) | Performance of a contract & legitimate interest |
| Managing tenancy and/or sale contracts (signing, administration, record-keeping) | Performance of a contract |
| Collecting rent, deposits, and payments | Performance of a contract |
| Arranging repairs, maintenance, or property services / managing contractors | Legitimate interest |
| Managing complaints, dispute resolution, involvement of an ombudsman if needed | Legitimate interest / legal obligation (if required) |
| Registering deposit, complying with deposit-protection regulations | Legal obligation |
| Right to Rent / immigration status checks (including use of share code) | Legal obligation |
| Complying with legal or regulatory obligations (e.g. HMRC, police or other authorities when required) | Legal obligation |
| Marketing — sending property alerts, market updates, property-search information to prospective tenants / buyers (“soft opt-in”) | Legitimate interest (soft opt-in) |
| Website analytics and improvement (via Google Analytics) | Consent (via cookies / analytics banner) |
If you do not want us to process your data on the basis of legitimate interest (e.g. marketing), or you want to withdraw consent for analytics cookies, you may contact us (see section 11).
6. Data retention — how long we keep your data
We retain personal data only for as long as necessary in light of the purposes. In particular:
- Tenancy and sale records: retained for 7 years after end of tenancy or completion of sale (to allow for possible disputes, obligations, audit, legal requirements).
- Right-to-rent checking records: retained for the duration of the tenancy / agreement, and at least 7 years, or minimum 2 years after tenancy ends (whichever is longer), to ensure compliance with licensing and regulatory obligations.
- Complaints and dispute-resolution records kept for 7 years.
- Telephone recordings: retained up to 7 years, if required for HMRC compliance or for dispute-resolution; otherwise deleted earlier.
- Applicant data (people who enquired but did not proceed): kept for a limited time (e.g. up to 12 months) — unless you consent to marketing or keep actively searching; after which we may delete or anonymise them.
- Other data: we review periodically and delete or anonymise where no longer needed or no longer justified.
All retention periods are determined in accordance with the principle of “storage limitation” under UK GDPR: we do not keep data longer than necessary.
7. Where and how your data is stored — cloud services & security
We store data on our internal network and use cloud-based services:
- We use a cloud CRM called Alto for storing applicant / sales / letting leads.
- We back up our data using Acronis Cyber Cloud. Acronis offers data-centre options inside the UK and globally; customers (including us) can choose where data is stored to meet regulatory / compliance needs.
- We have appropriate data-processing agreements with our cloud providers and ensure that data is stored securely (encryption, access controls, backups, restricted access). This helps us comply with the UK GDPR requirement to keep data secure.
If we ever transfer data outside the UK (e.g. in our cloud providers’ global data-centre networks), we will ensure appropriate safeguards (such as standard contractual clauses) in compliance with UK GDPR.
8. Cookies, analytics, website tracking
When you visit our website, we use Google Analytics to collect certain information for analytics purposes (e.g. pages visited, time, device, IP). We will show a cookie banner on the website to ask for your consent (or refusal) of analytics / non-essential cookies.
If you decline, we will respect your choice and not set non-essential cookies (or anonymise / restrict data collection).
9. Your rights
Under UK GDPR, you have the right to:
- Request access to your personal data (subject-access request).
- Request correction of inaccurate or incomplete data.
- Request erasure (if data no longer needed or you withdraw consent / object).
- Request restriction of processing (in certain situations).
- Object to processing based on legitimate interest (e.g. marketing).
- Data portability (if you wish to receive your data in a structured, machine-readable format).
- Withdraw consent at any time (for processing that is based on consent, such as cookies or marketing).
- Lodge a complaint with the supervisory authority (the Information Commissioner’s Office (ICO)) if you think we are not handling your data properly.
To exercise any of these rights, you can contact us at [email protected]
We will respond without undue delay and, in any case, within one month (or two months if complex) as required by law.
10. Telephone & call recording
We record telephone calls for the purposes of staff training, monitoring quality of service, and dispute resolution / evidence if needed. If you do not wish your call to be recorded, you may ask at the beginning of the call.
Call recordings are stored securely and retained for up to 7 years (if required for compliance, record-keeping, HMRC or dispute resolution), otherwise they are deleted.
11. Marketing and opt-out
We may send you occasional marketing communications (for example, property-alerts, market news, or property search guidance) if you have previously enquired or used our services (“soft opt-in”).
If you do not wish to receive further marketing, you may opt out at any time by emailing [email protected].
12. Data breaches
We have internal procedures to detect, report and investigate any personal-data breaches (unauthorised access, loss, disclosure, damage). If a breach occurs that is likely to result in a risk to individuals’ rights and freedoms, we will notify the Information Commissioner’s Office (ICO), and — if required — affected individuals without undue delay.
13. Changes to this policy
We may update this privacy policy from time to time (for example to reflect changes in legislation, our data-practices, or cloud-service arrangements). The “Last updated” date at the top will change accordingly.
We encourage you to check this page periodically. If there are substantial changes (e.g. new processing activity), we will notify you by email (if we hold your contact), or via a notice on our website.
14. Contact & Data Subject Requests
If you have any questions about this policy, your data, or wish to exercise any of your rights, you may contact us at:
[email protected]
Address: Whites Estate Agents, 339 Wellingborough Road, NN1 4ER, United Kingdom
15. Separate sections by audience (quick guide)
If you are a tenant / prospective tenant / guarantor:
We process your data to assess suitability, manage tenancy, collect rent, arrange repairs, administer deposits, comply with Right-to-Rent and legal obligations.
If you are a landlord / property owner:
We hold your contact and property details to manage tenancy or sale, liaise with tenants/contractors, make sure rent and deposit obligations are met, and comply with statutory/regulatory duties.
If you are a buyer / seller (sales):
We share necessary details (name, address, purchase amount) with solicitors and other professional advisers to complete the property sale and keep transaction records for up to 7 years for compliance and possible disputes.
If you are a contractor / tradesperson:
We may share limited contact and property data with you to enable repairs or maintenance, based on legitimate interest; you must keep such data confidential and secure under our contractor agreements.