Privacy and cookie policy

Let-Buy-Invest Properties Ltd

Website www.let-buy-invest.co.uk

Last updated [CONFIRM publication date]

1 Who we are and how to contact us

LET- BUY-INVEST PROPERTIES LIMITED, trading as Let-Buy-Invest Properties Ltd, is responsible for the personal information described in this policy. We are registered in England and Wales under company number 10124688. Our registered office and correspondence address is 200b Mitcham Road, Croydon, England, CR0 3JG.

Our Data Protection Lead is Jelena Nasi. Contact her at jelena.nasi@let-buy-invest.co.uk, call 0800 158 3548, or write to the address above marked Data Protection Lead. General enquiries can be sent to info@let-buy-invest.co.uk.

This policy explains how we use information about website visitors, people making enquiries, landlords, sellers, buyers, investors, applicants, tenants, occupiers, guarantors and people referred for temporary accommodation. It also covers information supplied by council officers, representatives and contractors. Separate notices apply to staff and recruitment, and to CCTV at any premises where it operates.

We act as a controller where we decide why and how your information is used. A landlord, placing local authority or another organisation may be a separate controller for its own activities. Where we act solely on another controller’s documented instructions, that controller’s privacy notice also explains the processing. We can explain which organisation is responsible for a particular activity.

We handle personal information under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended, including relevant changes made by the Data (Use and Access) Act 2025.

2 The information we collect

Website enquiries can include your name, telephone number, email address, preferred location, enquiry type, property requirements, budget, preferred contact method and anything you choose to include in your message.

Maintenance reports can include the property address, problem description, contact details, photographs, access arrangements and subsequent correspondence. Photographs may contain people, belongings or location metadata. Please photograph the issue, avoid including people, identity documents or unrelated possessions, and do not upload more information than we need.

When relevant to a service or application, we may also collect identity and date-of-birth information; proof of address; identification and Right to Rent evidence; ownership and authority to instruct us; employment, income, affordability and reference information; bank and payment details; rent accounts; tenancy, occupancy and placement records; household details; inspection and inventory records; complaints; and records of antisocial behaviour or safeguarding concerns. Financial and identity checks depend on the transaction and applicable law.

We may receive information about health, disability, accessibility needs or vulnerability where necessary for suitable accommodation, reasonable adjustments, repairs or safeguarding. Section 4 explains the additional protections for this information. Allegations of offences and criminal-record information have separate legal protections.

Technical information can include your IP address, browser and device details, pages requested, request times, errors and security logs. Cookies, browser storage and embedded services are explained in section 11.

3 Where information comes from

We obtain information from you through forms, emails, telephone calls, meetings and service correspondence. Depending on the service, we also receive relevant information from your representative, landlord, guarantor, employer or referee; a placing council or housing provider; referencing or identity-checking services; contractors; professional advisers; and publicly available property and company records such as HM Land Registry and Companies House.

Where we receive your information indirectly, we provide the required privacy information within the applicable legal timeframe, normally within one month and earlier if we first contact you or disclose the information, unless a lawful exception applies. We can identify the source relevant to your case, subject to lawful restrictions protecting other people or investigations.

4 Why we use information and our legal grounds

We use a legal ground appropriate to each purpose. A council’s public-task ground does not automatically become our legal ground, and a contract with a landlord or council does not automatically mean we have a contract with an occupier.

Enquiries and requested services. We use contact details and requirements to answer questions, arrange viewings, assess a proposed instruction and take steps you request before entering a contract with us. Our ground is contract or pre-contract steps where you are the contracting individual. For other enquiries, including contacts acting for organisations, our legitimate interest is communicating with people about our services and managing genuine requests.

Property and accommodation management. We use necessary occupancy, rent, contact and property information to administer agreements, coordinate placements, arrange inspections and repairs, and communicate with landlords, residents and placing bodies. We rely on contract where the processing is necessary for our contract with you; otherwise, on our legitimate interests in managing properties, maintaining safe accommodation and administering placements. Where a specific duty requires processing, we rely on legal obligation.

Checks and compliance. We use identity, financial and supporting records for applicable Right to Rent, anti-money-laundering, sanctions, tax, accounting and property-safety obligations. Legal obligation applies only where the relevant law requires that processing. Necessary affordability, referencing and fraud checks outside a statutory requirement rely on pre-contract steps with you or legitimate interests in assessing applications fairly and preventing fraud. We explain the checks and providers before they take place.

Complaints and legal matters. We use relevant records to investigate complaints, resolve disputes and establish or defend legal claims. Our grounds are legitimate interests in fair complaint handling and protecting legal rights, and legal obligation where a specific requirement applies.

Security and administration. Our legitimate interests in protecting our website, information and services support proportionate security logging, fault investigation and preventing misuse. Legal obligation may also apply to required security and regulatory measures.

Marketing and optional website features. We use consent where required for electronic marketing and optional tracking. Section 5 explains the limited circumstances in which we may send our own similar-service marketing without fresh consent. We keep a minimal suppression record when necessary to respect an objection or withdrawal.

When relying on ordinary legitimate interests, we assess necessity and balance our interests against your rights and reasonable expectations. You can ask about that assessment and object as explained in section 9.

Health and other sensitive information. An ordinary legal ground is not enough on its own for special category information. We also need a specific condition under Article 9 UK GDPR and, where applicable, the Data Protection Act 2018. Explicit consent may be suitable for genuinely optional support or adjustments; necessary legal claims may rely on Article 9(2)(f); and qualifying safeguarding may rely on Article 9(2)(g) with an applicable statutory safeguarding condition. We do not treat a general website checkbox as permission for sensitive-data processing.

[CONFIRM the actual additional condition for each health, accessibility and safeguarding purpose, including any relevant Schedule 1 condition and required safeguards. Insert the selected purposes and conditions here before publication. Do not retain examples that the business does not use.]

In a life-threatening emergency, vital interests may permit necessary processing. For special category information, the vital-interests condition additionally requires that the person is physically or legally incapable of giving consent. Criminal-offence information is processed only with the authorisation required by Article 10 and applicable UK law, which we explain in the relevant case-specific notice.

5 Marketing and service messages

Responding to your enquiry, arranging a viewing or repair, and sending necessary tenancy or placement updates are service communications. Making an enquiry or reporting a fault does not automatically subscribe you to marketing.

We send promotional emails or texts to individual subscribers with their consent, or under the existing-customer exception where all its conditions are met: we obtained the details directly during a sale or genuine negotiations for a sale of our services; we promote only our own similar services; and we offered a clear, free opt-out both when collecting the details and in every message. We do not assume every property enquiry qualifies. Where this exception is used, our UK GDPR ground is our legitimate interest in promoting relevant services to existing or prospective customers, subject to your rights.

You may withdraw marketing consent or object to direct marketing at any time, without charge. Use the unsubscribe option or contact us. We will stop marketing to you and retain only what is needed to respect that choice. This does not stop communications necessary to handle your enquiry, accommodation, contract or a legal obligation. We do not sell personal information.

6 Who receives information

We share information only where relevant, necessary and supported by a legal ground. Recipients may include:

• The property owner, landlord, managing agent, seller or other party involved in your enquiry or transaction, with the relevant role explained to you.
• Your placing local authority, housing provider or authorised representative for referrals, placement administration and necessary reporting.
• Contractors and tradespeople who need limited contact, property, access or fault information to perform authorised work.
• Referencing, identity, Right to Rent and financial-crime checking providers, where relevant checks are required or appropriate.
• Tenancy deposit schemes, banks or payment providers, insurers, utilities and local councils, where needed to administer payments, deposits, accounts or obligations.
• Website hosting, email, IT support and property-management system providers acting on our instructions.
• Solicitors, accountants, auditors, redress bodies, courts, regulators, law enforcement and safeguarding agencies where disclosure is justified or required.

We use appropriate written terms with processors, restrict access and avoid sharing whole files where a smaller amount is sufficient. Independent controllers use information under their own legal responsibilities and notices. We do not give every recipient access to every category of information.

If you request an overseas property introduction, we explain the relevant developer or partner, the information to be shared and any international-transfer implications before making the introduction. An international-property enquiry is not general permission to distribute your details to unrelated businesses.

7 International transfers

Some technology providers or overseas property partners may process information outside the UK. Google’s embedded map may involve Google processing information internationally, as explained in its privacy information. We assess transfers for which we are responsible and use a lawful route, such as applicable UK adequacy regulations or an appropriate UK International Data Transfer Agreement or UK Addendum with the required assessment and additional safeguards. We do not assume that EU contractual clauses alone are sufficient for a UK restricted transfer.

[CONFIRM actual overseas processing destinations, recipients or recipient categories, and the transfer route used for each relevant service. Insert those details here, including whether a UK adequacy route applies.]

You can contact the Data Protection Lead for information about the safeguards and how to obtain a copy, with confidential information removed where necessary. If an exceptional transfer requires your explicit, informed consent, we explain the specific transfer and risks before requesting it.

8 How long we keep information and how we protect it

We retain information only for as long as necessary for its purpose and applicable legal requirements. The periods below describe our usual approach; they do not justify keeping every document in a file for the longest period.

Where a specific law sets a different retention period, that requirement takes priority. We may preserve relevant records for an ongoing complaint, investigation or legal claim, documenting why they are needed. We then delete, securely destroy or irreversibly anonymise them. Backup copies remain protected and are removed through the applicable backup-retention cycle.

We use proportionate technical and organisational safeguards, including access restrictions, secure systems, staff responsibilities and appropriate protection for sensitive information. We assess incidents and notify the regulator and affected individuals where legally required. Please do not send identity documents, bank information or detailed medical records through a general website form unless we specifically request them through an appropriate channel.

9 Your choices and rights

Depending on the circumstances, you can ask to access your personal information, correct inaccuracies, delete information, restrict its use, or receive information you supplied in a portable format where the legal conditions are met. You can withdraw consent at any time without affecting the lawfulness of earlier processing.

You have an absolute right to object to the use of your information for direct marketing, including related profiling. You may also object on grounds relating to your circumstances when we rely on ordinary legitimate interests. We will consider that objection and stop unless the law permits us to continue.

Contact the Data Protection Lead to exercise your rights. There is normally no charge. We may need proportionate information to verify identity. We respond without undue delay and normally within one month under the applicable rules. If a permitted extension or clarification procedure applies, we explain the reason and timing. If a legal exception limits what we can provide, we explain this where permitted and tell you about your complaint rights.

Some information is needed to handle your request, perform a contract or comply with law. If you do not provide necessary contact, identity or eligibility information, we may be unable to progress the relevant enquiry, application or service. We explain what is mandatory and why. Optional marketing consent is not a condition of receiving accommodation or repair support.

10 Children and automated decisions

Our website is primarily directed at adults, but accommodation services may involve children and young people. We collect household information only where necessary, provide age-appropriate explanations where needed, and take particular care with safeguarding information. A young person who needs help with accommodation or repairs can contact us; this policy does not remove their rights.

[CONFIRM whether any application, credit, eligibility or placement decision is made solely by automated processing with a legal or similarly significant effect. If none, insert: “We do not make decisions about your application or accommodation solely by automated processing that produces a legal or similarly significant effect.” If used, instead describe the data, logic, significance, likely consequences and the applicable rights to information, representations, human intervention and challenge. Check third-party referencing systems as well as the website.]

11 Cookie policy

Cookies are small files stored on your device. Similar technologies include browser storage, pixels and other tools that store information on, or access information from, your device. A session cookie normally ends when the browser session closes; a persistent cookie remains until its expiry or deletion. First-party technologies are operated for this website, while third-party technologies may be operated by another provider.

Necessary functions. Technologies genuinely needed to transmit communications or provide a service you request may operate without consent under a relevant legal exception. Examples can include security and remembering cookie choices, but only where their actual purposes meet the exception. This does not make advertising or unrelated tracking necessary.

Optional functions. We ask for consent before enabling non-exempt technologies. Our chosen approach is to obtain consent for optional analytics and embedded third-party features listed in the schedule. If advertising technologies are introduced, they also require consent and a clear explanation before activation. Consent is separate from agreeing to website terms or sending an enquiry.

UK law includes limited exceptions for certain statistical and appearance functions, subject to specific conditions and an easy, free means of objecting. We do not treat all analytics as exempt. Any use of an exception must be identified in the schedule with its purpose and available control.

Google Maps. The contact section offers an embedded Google map. When you choose to load it, Google receives technical information such as your IP address and browser information and may store or access information on your device. Google’s own processing is described at https://policies.google.com/privacy and https://policies.google.com/technologies/cookies. You can read our address and contact us without loading the map. The map should remain blocked until you make the applicable choice described in the controls.

Cookie and storage schedule. The schedule must identify the technologies actually used, including third-party technologies and any browser storage.

[CONFIRM AND INSERT the verified schedule: exact cookie or storage name; provider and domain; specific purpose; category and legal exception or consent requirement; session or precise expiry duration; and the relevant control. Include the Google Maps technologies observed in the intended configuration and the consent-preference record. Do not publish guessed cookie names or lifetimes.]

Your controls. Use Cookie settings on the website to accept optional technologies, reject them or choose by purpose. Optional choices start switched off. Closing the banner, scrolling or continuing to browse is not consent. Refusing optional technologies does not prevent you from reading the website or using the enquiry and maintenance forms.

You can reopen Cookie settings and withdraw consent as easily as you gave it. Withdrawal stops future optional loading; it does not undo earlier lawful processing. We remove or disable optional first-party storage where technically possible. Browser controls can remove remaining cookies, including third-party cookies; Google also provides its own privacy controls. Blocking all cookies may affect necessary functions. Choices may need to be made again on another device, browser or after deleting preference storage.

12 Complaints and policy changes

Please raise privacy concerns with the Data Protection Lead by email, telephone or post. We can record a complaint for you if writing is difficult. We acknowledge data-protection complaints within 30 days at the latest, investigate without undue delay, keep you informed and explain the outcome. Our published service-complaints procedure provides a shorter acknowledgement target of three working days.

You have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator: https://ico.org.uk/make-a-complaint/ or 0303 123 1113. We would welcome the opportunity to address your concern, but this does not remove your right to contact the regulator.

We review this policy when our services, technology or legal duties change. The current version and update date will appear here. Where a change requires new information or consent, we provide it before making the relevant new use of your information.