Privacy Policy

1. Introduction

Capital Letting & Estate Agents Ltd ("we", "us" or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and share your personal information when you use our website, contact us or use our lettings, sales and property management services. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025.

Capital Letting & Estate Agents Ltd, 316 High Road, Leyton, London E10 5PW, is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number ZA267649. If you have any questions about this policy, please contact us using the details in section 14.

If you are a tenant, prospective tenant or guarantor, our separate Personal Data Privacy Notice gives more detail about how we handle your information during the application and tenancy process.

2. Personal Data We Collect

Depending on your relationship with us, we may collect and process the following categories of personal data:

• full name, address, date of birth and contact details (email address and telephone number);
• financial information, including bank details, credit history and proof of funds;
• identification documents (for example passport, driving licence or biometric residence permit) and information needed for Right to Rent and Anti Money Laundering checks;
• details of properties you are interested in renting, buying or selling, or that you own;
• references from employers or previous landlords;
• your email address and preferences, where you subscribe to our mailing list;
• call recordings made for monitoring, training, security and service improvement purposes;
• information you enter into forms on our website, such as valuation requests, viewing requests and enquiries;
• technical information when you visit our website, such as your IP address, browser type, device information and pages visited, collected through cookies and similar technologies (see section 9); and
• any other information you choose to provide to us.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

3.1 Lettings

• To contact prospective tenants and landlords about available properties and to arrange viewings
• To share tenant information with referencing agencies for credit and background checks
• To carry out Right to Rent checks, as required by law
• To protect tenancy deposits in a government approved deposit scheme
• To pass tenant and landlord details to utility companies and the local authority so that charges and council tax are correctly directed
• To notify guarantors in cases of rent arrears
• To notify joint tenants of shared rent arrears obligations
• To share forwarding addresses with utility companies when a tenant vacates a property
• To instruct tracing agents or debt collection companies where a tenant vacates without paying rent and without making any arrangement to pay

3.2 Sales

• To contact prospective buyers about available properties and to arrange viewings
• To carry out Anti Money Laundering, identity and proof of funds checks on buyers and sellers, as required by law
• To share seller and buyer details with conveyancing solicitors once a sale is agreed
• To share seller contact details with surveyors and any other parties required to assist in the sale

3.3 Landlords

• To arrange appointments for valuations and viewings
• To maintain contact throughout the letting and management process
• To share landlord contact details with tenants who have committed to a tenancy, as required by law
• To help landlords meet their obligations under the Renters' Rights Act 2025, including registration on the Private Rented Sector Database and membership of the landlord redress scheme, where we provide this service

3.4 Website enquiries

• To respond to enquiries, valuation requests and viewing requests submitted through our website
• To keep our website secure, working properly and to understand how it is used so that we can improve it

3.5 Marketing communications

Where you have subscribed to our mailing list, we will use your email address to send you marketing communications, including property updates, news and promotional offers. By signing up to our mailing list, you give your consent to receive these communications.

You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us directly. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.

4. Lawful Basis For Processing

We only use your personal data where we have a lawful basis to do so. We rely on the following:

• Contract: Where processing is necessary to perform a contract with you, or to take steps at your request before entering into one (for example processing a tenancy application or managing a property)
• Legal obligation: Where processing is necessary to comply with the law, for example Right to Rent checks, Anti Money Laundering checks, deposit protection, tax records and obligations under the Renters' Rights Act 2025
• Legitimate interests: Where processing is necessary for our legitimate business interests and these are not overridden by your rights and interests, for example referencing, recovering debts, call recording, website security and improving our services
• Recognised legitimate interests: Where the Data (Use and Access) Act 2025 recognises a purpose as legitimate, such as preventing or detecting crime, safeguarding and responding to requests from public bodies
• Consent: Where you have given clear and specific consent, for example to receive marketing emails or to allow non-essential cookies

Automated Decisions

Some referencing agencies use automated scoring when assessing applications. Where a decision that significantly affects you is made solely by automated means, you have the right to be told about it, to make representations, to ask for a person to review it and to contest it. We do not make final decisions on applications without human involvement.

5. Sharing your personal data

We do not sell your personal data. We may share your data with the following categories of third parties, only to the extent necessary and in line with this policy:

• referencing agencies, credit reference agencies and identity verification providers, including certified Identity Service Providers used for Right to Rent checks;
• government approved tenancy deposit schemes;
• utility companies and local authorities, to ensure charges are correctly directed on a change of occupancy;
• conveyancing solicitors, surveyors and other professionals involved in a property transaction;
• contractors and tradespeople who carry out repairs, inspections and safety checks;
• tracing agents and debt collection companies, in cases of unpaid rent or debts;
• the Private Rented Sector Database operator and redress or ombudsman schemes, where required;
• government bodies, regulators and law enforcement authorities (for example the Police, HMRC, the Home Office and local authorities), where we are required to by law or where a lawful exemption applies;
• our IT, website hosting, property management, accounting and telephone system providers, who process data on our behalf under a written contract; and
• our mailing list and email marketing service provider, solely to send you communications you have consented to receive.

We always check the legitimacy of any request from an authority and confirm that an appropriate legal basis exists before disclosing information.

6. International Transfer

We aim to keep your personal data within the UK. Some of our service providers, such as email, website or cloud storage providers, may store or access data outside the UK. Where this happens, we make sure the transfer is lawful and that your data is protected to a standard that is not materially lower than in the UK, for example through UK adequacy regulations or the International Data Transfer Agreement.

7. Data Retention

We keep your personal data only for as long as necessary for the purposes set out in this policy and in line with applicable laws.

We may keep information for longer where there is a legal claim or dispute. At the end of the relevant retention period, your data will be securely deleted or destroyed. Paper records are shredded and the hard drives of redundant computers are securely wiped.

8. Storage and Security of Your Data

We take the security of your personal data seriously. All personal data is stored securely using appropriate technical and organisational measures, including:

• storage in lockable rooms or filing cabinets with controlled access;
• password-protected computer systems and databases, with access limited to staff who need it;
• regular secure backups, stored both on-site and off-site;
• screen locks and password-protected screensavers on all workstations; and
• secure (HTTPS) connections on our website.

All staff are trained on their data protection obligations and must handle personal data in line with this policy. Disciplinary action may be taken against any member of staff found to be in breach of these obligations.

9. Cookies and Website Analytics

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a website.

• Strictly necessary cookies make the website work, for example keeping it secure or remembering your cookie choices. These do not need your consent.
• Analytics and functionality cookies help us understand how visitors use the website and remember your preferences. Under the Data (Use and Access) Act 2025, some of these may be set without consent, provided we tell you about them and give you a simple way to object. You can opt out at any time through our cookie settings.
• Marketing and third party cookies (for example social media or advertising cookies) are only set with your consent, which you can give or withdraw through our cookie banner or cookie settings.

You can also block or delete cookies through your browser settings, although parts of the website may not work properly if you do. Our website may contain links to other websites and property portals. We are not responsible for their privacy practices, so please read their privacy policies.

10. Telephone Call Recording

Telephone calls to and from our offices are recorded for monitoring, training, security and service improvement purposes, and so that we have an accurate record of what was agreed. We do this on the basis of our legitimate interests. Call recordings are treated as personal data, are only accessed by authorised staff and are handled in line with this policy.

11. Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you. We will carry out reasonable and proportionate searches to respond.
• Right to rectification: to ask us to correct any inaccurate or incomplete data
• Right to erasure: to ask us to delete your data in certain circumstances
• Right to restriction of processing: to ask us to limit how we use your data
• Right to data portability: to receive your data in a structured, commonly used format
• Right to object: to object to our processing of your data where we rely on legitimate interests, and to object to direct marketing at any time
• Rights relating to automated decisions: to ask for human review of, and to contest, significant decisions made about you solely by automated means
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time
• Right to complain: to complain to us and to the ICO (see sections 12 and 13)

To exercise any of these rights, please contact us using the details in section 14. We may need to verify your identity first. We will respond within one month of receiving your request (or of receiving any information we need to verify your identity). For complex or numerous requests we may extend this by up to two further months and will tell you if we do. There is usually no charge.

12. Complaints To Us

If you are unhappy with how we have handled your personal data, you have the right to complain to us. You can do so by email, telephone or post, or through any other way you normally contact us. We will:

• acknowledge your complaint within 30 days of receiving it;
• take appropriate steps to look into it without undue delay, including making enquiries where needed;
• keep you informed of our progress; and
• tell you the outcome without undue delay.

13. The Information Commissioner's Office (ICO)

If you have concerns about how we handle your personal data that we have not been able to resolve, you have the right to complain to the UK's data protection regulator. From 30 September 2026 the Information Commissioner's Office becomes the Information Commission, and it will continue to be known as the ICO.

ICO website: www.ico.org.uk/make-a-complaint | Helpline: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

14. Contact Us

If you have any questions, concerns or complaints about this Privacy Policy or our data practices, please contact us:

15. Changes To This Policy

We keep this Privacy Policy under regular review and may update it from time to time, for example to reflect changes in the law or in how we work. Any significant changes will be communicated to you directly where required. The latest version will always be available on our website and on request.