Privacy notice

Who we are

Homestart Sales Progression Ltd trading as Ash & Acre Estate Agents is the controller responsible for the personal information described in this notice.

Email: hello@ashandacre.co.uk
Office: Unit 5, 51 Water End Road, Maulden, Bedford MK45 2BD.

This notice covers our UK property sales estate agency, enquiries and valuations, buyer and seller services, identity and anti-money laundering checks, sales progression, professional communications and website.

Information we use and where it comes from

Depending on your dealings with us, we use:

• Your name, contact details, correspondence, viewing appointments and communication preferences.
• Property details, photographs, marketing instructions, offers, transaction history and information needed to progress a sale or purchase.
• Identity and verification information, such as date of birth, address history, identification documents, proof of address, beneficial ownership, source of funds and relevant screening results.
• Payment, invoice and financial information needed for our services or legal checks.
• For professional contacts, your name, role, organisation, business contact details and relevant history of our professional relationship.
• Website and device information, such as IP address, browser information and, where enabled with the appropriate permission, advertising identifiers and enquiry-conversion events.

We receive information directly from you and, where relevant to your transaction, from joint owners, buyers, sellers, representatives, solicitors, other agents, brokers and identity-check providers. Checks may involve public registers and screening databases. Professional contact details may come from our previous dealings with you or publicly available business information. Where someone else supplies your information, we provide privacy information within the applicable legal timescale, normally within one month and no later than our first communication or disclosure, unless a legal exception applies.

Please provide only information relevant to your enquiry. We explain when information is required by law or needed for a contract. Without required identity or transaction information, we may be unable to act for you or progress the transaction.

Why we use your information

Our lawful bases under the UK GDPR depend on the purpose:

Enquiries, valuations and services you request

Taking steps at your request before entering a contract, or performing our contract with you (Article 6(1)(b)). For general enquiries or people who are not our contracting clients, we rely on legitimate interests (Article 6(1)(f)) in responding helpfully and running our agency.

Viewings, offers, property marketing and sales progression

Contract where processing is necessary for our agreement with you; otherwise legitimate interests in arranging and progressing property transactions, communicating with the parties and maintaining accurate records. This includes handling a buyer’s information when our client is the seller.

Identity, anti-money laundering and other statutory checks

Legal obligation (Article 6(1)(c)), including duties under the Money Laundering Regulations 2017 and applicable financial-crime law. This may involve verifying identity and ownership, checking source of funds, and screening for politically exposed persons and sanctions.

Administration, security, disputes and complaints

Legal obligation where a specific law requires processing; otherwise legitimate interests in protecting our business and clients, preventing misuse, keeping appropriate records and establishing or defending legal claims.

Relevant professional marketing

Legitimate interests in maintaining professional relationships and introducing relevant services, subject to the safeguards and email rules below. Where consent is required, we rely on consent (Article 6(1)(a)).

Optional advertising measurement

Consent for Google Ads measurement involving personal information and device storage/access. Necessary website delivery and security may rely on legitimate interests. Further website technology details are addressed in the cookies section below.

Where we rely on legitimate interests, we assess necessity and balance our interests against your rights and reasonable expectations. You can ask about that assessment and object to the processing.

Identity checks and MoveButler

We use MoveButler in connection with identity and anti-money laundering checks. Its published consumer terms identify the operator as Intelligent Services Group Limited. See MoveButler’s consumer privacy information for its own processing.

Clients upload identification and complete a selfie/facial check through MoveButler. We review failed checks ourselves and also retain copies of identity documents on our own files. The process involves sharing identity information with the verification provider and receiving verification or risk results. Legal restrictions may limit what we can tell you about particular financial-crime reports or checks. Information collected to meet anti-money laundering obligations is used for that purpose and other uses permitted by law, rather than automatically being added to marketing lists.

Who receives information

We share relevant information, limited to what is needed, with:

• Buyers, sellers, their authorised representatives, solicitors, conveyancers, other estate agents and brokers involved in the transaction.
• Identity and anti-money laundering providers, including MoveButler.
• Suppliers supporting our website, enquiry forms, email, record keeping and IT. We use Microsoft Outlook for email and Loop Software Limited’s Loop CRM for customer records. Loop describes itself as a processor for information hosted in its application on behalf of estate agents; see Loop’s privacy information. The website enquiry form is configured to submit to Web3Forms. The contact page includes a Google Maps embed, which may receive your IP address and browser information when it loads. Google receives advertising-measurement information where that service is enabled with consent.
• Property marketing providers and portals where we use them to market your property.
• Professional advisers, insurers, dispute-resolution bodies and regulators where needed for advice, complaints or claims; HMRC, law enforcement and other authorities where disclosure is required or lawfully justified.

Some recipients act on our instructions; others, such as solicitors and regulators, make their own decisions about personal information and have their own privacy notices.

Communicating through WhatsApp

We currently use the standard WhatsApp app to communicate with clients about enquiries, appointments and property transactions. This involves your telephone number, profile information visible to us, message content and any attachments you share. We use information needed to provide contracted services on the contract basis described above, or rely on legitimate interests in responding and coordinating transactions where we do not have a contract with you.

WhatsApp also processes information to provide its service under its own applicable privacy terms. You can ask us to use email or telephone instead. Contacting us on WhatsApp does not by itself give permission for promotional messages. Any promotional use must satisfy the applicable marketing rules and WhatsApp requirements, with a clear way to opt out.

Relevant messages forming part of your enquiry or transaction record follow the applicable retention period described in this notice. Please use our agreed secure verification process for identity documents rather than sending unnecessary copies through chat.

Professional communications and your opt-out

We may send carefully selected service updates to solicitors and other professional contacts where there is a relevant existing professional relationship and a reasonable expectation of hearing from Ash & Acre. We use only information needed for that purpose and assess whether the communication is appropriate.

Business email rules depend on the recipient. Companies and limited liability partnerships are generally corporate subscribers under PECR. Sole traders and many unincorporated partnerships are treated as individual subscribers: marketing emails to them require consent unless a valid soft opt-in applies. Knowing someone professionally, or having emailed them before, does not itself establish consent or a soft opt-in.

You can object to direct marketing at any time. Reply “unsubscribe” to a marketing email or email hello@ashandacre.co.uk. We will stop using your information for direct marketing. We retain a minimal suppression record to help ensure you are not contacted again. Necessary messages about an active service or transaction are separate from marketing.

Website cookies and similar technologies

The website displays a choice to accept or reject Google Ads measurement cookies and a “Cookie settings” control in the footer. The displayed notice says that, if accepted, Google receives page visits, advertising identifiers and a successful-enquiry event, that form answers are not sent to Google, and that this tag is not used for personalised advertising. It says the choice is remembered for 180 days.

Use the website’s “Cookie settings” control to change your advertising-measurement choice. Optional advertising measurement requires consent before the relevant technology is used. You can also contact us about your choice. See how Google uses information from partner sites.

The website’s cookie controls provide information about advertising measurement. We are reviewing the detailed cookie inventory, including third-party embeds, and will update the information available here. Contact us if you need further details. This notice does not itself set your cookie preferences.

How long we keep information

We retain personal information for the purpose for which it is needed, taking account of legal requirements, the transaction, complaints and potential claims. Relevant criteria are:

• Anti-money laundering records: generally five years after the business relationship ends or the relevant occasional transaction completes. Personal data must then be deleted unless a permitted legal exception applies; any longer retention needs a specific justification.
• Enquiries and unsuccessful valuations: the time needed to respond and complete reasonable follow-up, then deletion or anonymisation unless another justified purpose remains.
• Client, transaction and accounting records: applicable tax and accounting duties and the period reasonably needed to address complaints or legal claims, starting from the relevant transaction, financial period or closure date.
• Professional marketing contacts: while the relationship and communications remain relevant and lawful. An objection stops marketing; a limited suppression record is retained as needed to respect it.
• Website records and consent choices: the actual supplier settings and justified security or measurement need. The current banner states a 180-day preference period; this does not establish the lifetime of Google’s cookies or other records.

Information outside the UK

Web3Forms’ published privacy policy identifies Web3Creative as processor for form submissions, says it operates from India and uses infrastructure in multiple regions, and describes retention of submissions for up to three years unless a shorter period applies or information is deleted earlier. See Web3Forms’ privacy policy. We are reviewing the retention and transfer arrangements applicable to our account and can be contacted for further information. Other suppliers may also process information outside the UK. Where a restricted international transfer occurs, UK data protection law requires an appropriate route, such as applicable UK adequacy regulations or approved contractual safeguards, together with the required assessment and supplementary protections where necessary. You can contact us for information about relevant safeguards and how to obtain a copy, with confidential information removed where appropriate.

Your rights

Depending on the circumstances, you may ask us to:

• Provide access to your personal information and a copy.
• Correct inaccurate information or complete incomplete information.
• Erase information or restrict its use.
• Provide certain information in a portable format where processing is automated and based on consent or contract.
• Stop processing based on legitimate interests, on grounds relating to your situation. Your right to stop direct marketing is absolute.

You can withdraw consent at any time without affecting the lawfulness of earlier processing. Where legally significant decisions are made solely by automated means, applicable safeguards include information about the decision, an opportunity to make representations and contest it, and human intervention.

Contact hello@ashandacre.co.uk to exercise your rights. We may need proportionate information to verify your identity. We normally respond without undue delay and within one month; the law allows extensions or adjustments in specified circumstances, which we will explain. Requests are normally free. Some rights have exceptions, including where records must be kept by law or disclosure would prejudice protected investigations.

Questions and complaints

Please email hello@ashandacre.co.uk or write to our office to raise a data protection concern or complaint. Tell us what happened and the outcome you would like. We will acknowledge your complaint within 30 days, investigate appropriately, keep you informed and explain the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Visit ico.org.uk/make-a-complaint for its current contact details and guidance. The ICO generally expects you to give the organisation an opportunity to resolve your concern first.

We may update this notice when our services, practices or legal requirements change. The date above shows when it was last updated.