Last updated: 13 July 2026
1. | ||
2. | ||
3. | ||
4. | ||
5. | ||
6. | ||
7. | ||
8. | ||
9. | ||
10 | ||
11. | ||
12. | ||
13. | ||
14. | ||
15. | ||
16. | ||
17. | ||
18. | ||
19. | ||
20. | ||
21. | ||
22. | ||
23. | ||
This notice explains how Cooper & Tanner collects, uses, shares, retains and protects personal data when individuals interact with us, use our website, enquire about or receive our services, register for or participate in auctions, submit offers, apply for lettings, engage with our professional services, subscribe to newsletters, contact our teams, make a complaint, or apply for a role with us.
This Privacy Notice applies to personal data processed by Cooper & Tanner as a controller under the UK General Data Protection Regulation and the Data Protection Act 2018. It is intended to be read alongside any additional or more specific privacy information provided to individuals in particular circumstances, including auction terms, tenancy documentation, client engagement terms, finance broking documentation, recruitment communications, cookie notices and platform-specific information.
This Privacy Notice does not apply to employees, workers or contractors in relation to internal employment related processing. A separate employee privacy notice is provided for that purpose. This Privacy Notice does, however, apply to job applicants and recruitment candidates where they submit CVs, applications or related information to us.
Cooper & Tanner 1908 Limited (“Cooper & Tanner”, “we”, “us” and “our”) is the controller of the personal data described in this Privacy Notice, unless we state otherwise.
Cooper & Tanner provides a range of services, including residential sales, commercial sales and lettings, residential lettings, rural and agricultural services, valuations, development advice, professional services, land and property auctions, machinery and livestock sales, sale room auctions and associated client money, compliance and administrative services.
Where we use third-party platforms, including online bidding or property auction platforms, those providers may process personal data either as independent controllers or on our behalf as processors, depending on the circumstances. Further information about how those providers use personal data can be found in their respective privacy notices.
If you have any questions about this Privacy Notice or about how we use your personal data, please contact us using the details below:
Cooper & Tanner 1908 Limited
Address: The Agricultural Centre, Frome Market, Standerwick, Frome, Somerset, BA11 2QB
Email: [email protected]
We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing questions relating to this privacy notice and our data protection practices. If you have any questions about this privacy notice, the way we handle your personal data, or if you wish to exercise your legal rights, please contact our DPO using the details below:
Name: Mr George Trippick
Email: [email protected]
Telephone: 01458 834 28
Alternatively, you may contact us at [email protected]
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and other applicable legal and regulatory requirements.
We process personal data lawfully, fairly and transparently. We collect personal data for specified, explicit and legitimate purposes, and do not use it in a manner that is incompatible with those purposes. We seek to ensure that personal data is adequate, relevant and limited to what is necessary, that it is accurate and kept up to date where required, that it is retained only for as long as necessary, and that it is protected by appropriate technical and organisational measures.
This Privacy Notice applies to personal data processed in relation to buyers, sellers, bidders, online bidders, prospective purchasers, vendors, landlords, tenants, guarantors, occupiers, contractors, property viewers, auction participants, livestock and machinery clients, sale room customers, valuation clients, rural and agricultural clients, development clients, finance broking clients, website users, newsletter subscribers, complainants, professional contacts, job applicants and employees where relevant to recruitment and employment-related processing.
It also applies to individuals whose personal data is processed as part of anti-money laundering checks, customer due diligence, right to rent checks, right to work checks, safeguarding or DBS checks, complaints handling, legal claims, client money administration, regulatory record-keeping, internal governance and data subject rights handling.
The personal data we collect depends on the nature of your interaction with us. In line with the services we provide, we may process the following categories of personal data.
Personal Data Type | Examples of Personal Data (this list is not exhaustive) |
|---|---|
Identity Data: | may include your name, title, date of birth, nationality, gender, username, bidder number, account number, certificate reference number, passport details, driving licence details, visa details, immigration status and other identifiers used to verify or administer your relationship with us. |
Contact Data: | may include postal address, email address, telephone number, forwarding address, delivery address, emergency contact details, next of kin details, employer contact details, landlord contact details, solicitor details, contractor details and other contact information. |
Transaction and Property Data: | may include property details, land ownership data, proof of ownership, seller details, buyer details, tenant lists, chain information, related transactions, memorandum of sale details, solicitor correspondence, offer amounts, negotiation notes, completion dates, completion statements, funds transfer details, final invoices, lease or sale terms, tenancy records, tenancy history, property ownership, EPC data, listing descriptions, floorplans, photographs, viewing feedback, inspection reports, condition notes, maintenance issue reports and access arrangements. |
Auction and Bidding Data: | may include buyer registration details, seller registration details, ID documents, account numbers, bidder numbers, bid history, lot numbers, timestamps, absentee bids, telephone bid details, online bidding records, auction history, account history, payment details, invoice records, delivery and collection details, condition report requests, valuation information, catalogue interest and communications relating to property auctions, machinery and livestock sales, antiques, jewellery, watches, silver and other sale room items. |
Livestock, Machinery and Agricultural Data: | Holding numbers, livestock movement records, Defra identifiers, land ownership data, agricultural tenancy details relating to individuals, lease details relating to individuals, and site data where it identifies or relates to an individual. |
Financial, Tax and Payment Data: | may include bank account details, payment details, salary information, income details, affordability information, bank statements, utility bills, payment history, arrears balances, deposit amounts, scheme details, invoice records, tax information, pension contributions, source of funds, source of wealth, business ownership information, asset information, transaction history, loan requirements, credit history, credit score, expenditure and lender information. |
AML, Compliance and Due Diligence Data: | may include customer due diligence records, full name, date of birth, address, nationality, identity verification data, passport copies, driving licence copies, ID document images, proof of address, utility bills, bank statements, risk ratings, politically exposed person status, sanctions screening results, transaction monitoring information, suspicious activity reports, KYC records and ongoing monitoring information. |
Lettings and Tenancy Data: | may include tenant application data, current and previous addresses, address history, dependants, pets information, employment details, income, guarantor identity, guarantor address, guarantor contact details, guarantor financial data, guarantor credit history, tenancy agreements, signatures, deposit registration data, rent payment history, arrears records, recovery actions, possession proceeding documents, legal correspondence, check-out reports, deposit deductions and dispute records. |
Recruitment Data: | may include job application information, CVs, cover letters, employment history, education history, qualifications, interview notes, assessment results, interview recordings where used, interviewer notes, references, right to work documents, DBS application data, criminal conviction data where relevant. |
Communications and Customer Service Data: | may include contact form content, email addresses, email signatures, email content, call notes, call recordings where used, messages, correspondence, complaint details, enquiry records, telephone enquiry records, website enquiry details and records of interactions with our teams. |
Marketing and Digital Engagement Data: | may include marketing preferences, newsletter subscription status, consent records, consent timestamps, consent method, opt-out records, transaction history used for soft opt-in marketing, prospect interests, CRM interaction history, notes, segmentation data, behavioural data, campaign open rates, click data, suppression lists, user journey data and conversion data. |
Website, Platform and Technical Data: | may include IP address, browser type, device type, operating system, cookies, session identifiers, tracking pixels, account usernames, account passwords where account functionality is used, account preferences, device identifiers, device fingerprinting data, behavioural patterns, login attempts, suspicious activity logs, usage data, platform preferences, password change records and other information generated through use of our website, online bidding systems, account functions or digital services. |
Platform Account and Security Data: | may include account usernames, account passwords, account preferences, password change records, login attempts, suspicious activity logs, device identifiers, device fingerprinting data, behavioural patterns, authentication data and security monitoring information generated through use of online bidding platforms, user accounts and digital services. |
Development, Valuation and Advisory Data: | may include client identity, investment criteria, development costs, financial projections, planning assumptions, land ownership data, valuation figures, comparable evidence, inheritance details, ownership history, asset values, risk data, borrower details and security details. |
Legal, Complaints and Governance Data: | may include contracts, evidence, litigation records, witness statements, court filings, pre-litigation correspondence, complaint data, complaint correspondence, ICO complaint handling information, subject access request details, erasure request logs, identity verification data used for rights requests, processing logs, audit trails, DPIA assessments, risk assessments and mitigation measures. |
We do not intentionally collect more personal data than is necessary for the purposes described in this Privacy Notice.
We do not generally seek to collect special category data unless it is necessary for a particular purpose. Special category data may be processed where it is included in tenancy, employment, safeguarding, DBS, complaint, legal claim, health, accessibility, reasonable adjustment, insurance, dispute or regulatory records.
Criminal offence data may be processed where necessary and permitted by law, including in connection with DBS checks, safeguarding, certain employment checks, fraud prevention, legal claims or compliance obligations. Where we process criminal offence data, we do so only where necessary, proportionate and subject to appropriate safeguards.
We only collect personal data that is necessary for the purposes described in this Privacy Notice.
Further information is set out in Table 2: Special Category and Criminal Offence Data.
We do not knowingly collect personal data directly from children via our website or services, but we may process data relating to children where it is provided by parents, guardians or applicants in connection with property, tenancy or legal arrangements. Where children’s data is processed, we will take appropriate steps to ensure that the processing is lawful, fair, proportionate and subject to appropriate safeguards.
From you: we collect personal data directly from you when you contact us, complete forms, register for services, apply to bid, submit an offer, request a valuation, ask for a condition report, subscribe to a newsletter, apply for a property, instruct us, attend a viewing, participate in an auction, apply for a role, make a complaint or otherwise communicate with us.
From Third-parties: we also collect personal data from third parties where relevant, including solicitors, lenders, mortgage brokers, surveyors, referencing agencies, landlords, tenants, guarantors, contractors, professional advisers, insurers, auction platforms, online bidding platforms, AML and identity verification providers, credit reference agencies, DBS providers, The Property Ombudsman, HMRC, HM Land Registry, Defra, local authorities, courts, tribunals, regulators and publicly available sources.
Public Sources: we may get your personal data from publicly available sources such as HM Land Registry, Companies House, sanction lists or other regulatory or publicly accessible records where relevant.
Automatically: we collect personal data automatically when you use our website, online services, online bidding systems, account functions or digital communications. This may include technical, usage, cookie, device, session, security and interaction data.
Our website uses cookies and similar technologies. Cookies are small text files placed on your device by websites you visit. They may be used to make websites work, improve efficiency, support user experience, store preferences and provide usage information. Cooper & Tanner’s cookie policy refers to persistent and session cookies and explains that cookies may be offered to users and can usually be managed through browser settings.
Where you interact with our website, we may process website and technical data to operate the website, recognise returning users, respond to enquiries, manage registrations, provide requested services, monitor usage, maintain security and support marketing and communication activity.
Where you participate in online auctions or online bidding, additional platform data may be processed. Cooper & Tanner’s sale room information confirms that online bidding is offered via the-saleroom.com, and that bidders register directly with that platform before a sale. Cooper & Tanner also handles absentee and telephone bidding, requiring full name, postal address, email address and contact numbers for registration.
For property auctions, Cooper & Tanner also appears through EIG’s property auction platform. EIG identifies Cooper & Tanner Auctions as property auctioneers and refers to property auctions and online auction activity.
Where third-party platforms are used, the platform provider may process technical data, login credentials, account records, passwords, password changes, authentication records, IP addresses, device data, usage data, preferences, suspicious activity logs, login attempts, online bidding records and AML screening data. Cooper & Tanner may not independently access all such technical information where it is held and controlled by the platform provider, but we may receive or use platform information necessary to administer auction participation, compliance checks, bids, sales, settlement, collections, delivery, disputes and records.
Where cookies are not strictly necessary, they are used only with your consent in accordance with the Privacy and Electronic Communications Regulations 2003. You can manage or withdraw your cookie preferences at any time through your browser settings or our cookie controls. You can see our Cookie notice here.
We process personal data for the purposes set out below and in Table 1: Lawful Basis of Processing.
We use personal data to provide residential and commercial sales services, including seller onboarding, buyer registration, property listing creation, marketing and portal advertising, handling enquiries and leads, arranging and conducting viewings, managing offers and negotiations, progressing transactions, liaising with solicitors and other professional advisers, managing chains, facilitating mortgage and survey processes, completing transactions, maintaining records, handling fall-throughs, managing complaints and supporting legal claims.
We use personal data to provide lettings and property management services, including landlord onboarding, tenant enquiries, viewings, applications, referencing, credit checks, affordability assessments, guarantor checks, right to rent checks, AML checks where applicable, tenancy agreement administration, deposit registration, rent collection, arrears management, inspections, maintenance requests, contractor coordination, tenant and landlord communications, possession proceedings, check-out processes, deposit returns, dispute handling and tenancy record retention.
We use personal data to provide auction services, including buyer and seller registration, identity verification, account administration, absentee bidding, telephone bidding, online bidding, bid recording, lot management, catalogue production, condition report provision, pre-sale enquiries, sale settlement, invoicing, payment handling, collection and delivery arrangements, livestock traceability, Defra-related records, and auction history and account management.
We use personal data to provide sale room services, including valuation enquiries, consignment and listing of items, specialist auctions for jewellery, watches, silver and collectables, condition report requests, additional images, bidding (including online, telephone and absentee), payment processing, postage and collection, and release of goods to authorised third parties on verification of identity and authority.
We use personal data to provide rural, agricultural, valuation, development and professional advisory services, including landlord and tenant advice, rent reviews, compensation claims, subsidy applications, planning advice, diversification projects, valuation instructions, inspections, preparation of valuation reports, tax and insurance valuations, lending valuations, acquisition support, appraisals, development cost analysis, financial projections, planning assumptions and land ownership advice.
We use personal data to provide finance broking and loan facilitation services, including client onboarding, application processing, credit assessment, affordability assessment, security assessment and liaison with lenders and finance providers.
We use personal data to operate, manage and secure our website, online services and auction platforms, including account creation and management, authentication, password management, monitoring login activity, detecting suspicious activity, fraud prevention, device and behavioural analysis, system administration, platform functionality and performance monitoring.
We use personal data to manage client money and financial administration in accordance with regulatory obligations, including holding and processing funds, maintaining client accounts, allocating receipts, reconciling accounts, authorising payments, managing unidentified funds, maintaining audit trails and complying with RICS client money rules and financial reporting obligations.
We use personal data to meet compliance and regulatory obligations, including AML and KYC checks, identity verification, source of funds and source of wealth checks, sanctions screening, politically exposed person checks, ongoing monitoring, suspicious activity reporting, right to rent checks, right to work checks, safeguarding and DBS checks, tax and accounting obligations, complaints handling, data subject rights handling, audit trails, DPIAs, risk assessments and governance record keeping.
We use personal data to establish, exercise or defend legal claims, including dispute resolution, litigation, enforcement proceedings, regulatory investigations and associated record keeping.
We use personal data to manage recruitment processes, including applications, CVs, cover letters, interviews, assessments, references, right to work checks and onboarding processes where applicable.
We use personal data to communicate with individuals, respond to enquiries, manage website forms, handle email and telephone communications and maintain records of interactions.
We use personal data for marketing and customer relationship management purposes, including sending newsletters, managing subscriptions, maintaining CRM records, segmenting audiences, analysing engagement, maintaining suppression lists and promoting services to existing clients where permitted.
We use personal data to facilitate international transactions and cross-border participation in auctions and property services where individuals are located outside the United Kingdom.
We rely on the following lawful bases:
performance of a contract or steps prior to entering into a contract;
compliance with legal obligations;
legitimate interests pursued by us or a third party; and
consent where required.
Where special category or criminal offence data is processed, we rely on the relevant UK GDPR Article 9 condition and Data Protection Act 2018 Schedule 1 condition.
Where we rely on legitimate interests, those interests include operating and administering our property, auction and professional services; managing client, bidder and customer relationships; facilitating transactions and auction participation; assessing financial suitability and risk; preventing fraud and detecting suspicious activity; maintaining the security of our website, platforms and systems; maintaining accurate records and audit trails; improving our services and user experience; and promoting our services to existing clients in accordance with applicable law. We carry out appropriate balancing tests to ensure that such interests are not overridden by the rights and freedoms of individuals.
Further detail on the specific lawful basis relied upon for each processing activity is set out in Table 1: Lawful Basis of Processing.
We do not carry out solely automated decision-making that produces legal or similarly significant effects within the meaning of UK GDPR.
However, we may use automated or semi-automated tools to support processing, including AML screening, sanctions checks, fraud monitoring, credit and affordability checks, tenant referencing, marketing segmentation, website analytics, cookie-based tracking, platform security monitoring and behavioural pattern analysis.
These tools support decision-making but do not replace human review where decisions have a significant effect. Where required by law, appropriate safeguards are implemented, including the ability to request human intervention.
We may share personal data with the following categories of recipients, depending on the nature of our services and legal obligations.
Internal recipients
We may share personal data internally with authorised personnel across relevant teams, including residential sales, lettings, property management, auctions, sale rooms, rural and agricultural services, valuations, development, finance broking, compliance, accounts, HR, recruitment, legal, IT, marketing and management.
Professional advisers and service providers
We may share personal data with third parties who support the delivery of our services, including solicitors, conveyancers, surveyors, valuers, mortgage brokers, lenders, insurers, financial services providers, referencing agencies, credit reference agencies, AML and KYC providers, sanctions screening providers, DBS providers, contractors, maintenance providers, IT suppliers, website providers, CRM providers, email and marketing providers and other professional advisers.
Maintenance, emergency access and property service providers
We may share personal data with maintenance contractors, out-of-hours emergency maintenance providers, locksmiths and property access providers where this is necessary to manage repairs, maintenance, emergency access, property security, tenant safety, tenancy administration, deposit disputes or related property management services.
Property, auction and platform partners
We may share personal data with parties involved in property transactions, lettings and auctions, including buyers, sellers, landlords, tenants, guarantors, property portals, auction platforms, online bidding providers, including the-saleroom.com and EIG, and associated service providers.
Regulatory authorities and legal disclosures
We may share personal data where required or permitted by law with regulatory bodies and authorities, including HM Revenue & Customs, HM Land Registry, local authorities, Defra and livestock movement bodies, The Property Ombudsman, the Royal Institution of Chartered Surveyors (RICS), courts, tribunals, law enforcement bodies and other regulators.
We may also disclose personal data where necessary to comply with legal obligations, enforce our legal rights, respond to legal claims or proceedings, or protect the rights, property or safety of our business, clients or others.
Where third parties process personal data on our behalf, we require them to process personal data only in accordance with our instructions, maintain confidentiality and apply appropriate security measures. Where third parties act as independent controllers, they are responsible for their own compliance with data protection law.
We do not sell personal data.
Where Cooper & Tanner handles client money, payments, deposits, invoices or settlement sums, personal data may be processed for payment administration, client account management, ledger allocation, reconciliation, unidentified funds investigation, payment authorisation, audit and regulatory compliance. This may include names, contact details, bank details, payment records, invoice records, transaction references, client ledger information, supporting evidence and correspondence.
Client money records may be shared with banks, auditors, accountants, regulators, insurers, RICS or other appropriate parties where required for client money handling, regulatory compliance, audit, fraud prevention or legal purposes.
If Cooper & Tanner is involved in a restructuring, merger, acquisition, sale of assets or transfer of business, personal data may be transferred as part of that transaction. Where this occurs, personal data will continue to be protected in accordance with applicable data protection law.
Personal data may be transferred outside the United Kingdom where this is necessary for international buyers, sellers, bidders, clients, overseas transactions, online auction platforms, cloud-hosted systems, service providers, professional advisers, or international communications.
Where personal data is transferred outside the United Kingdom to a country that does not benefit from adequacy regulations, we will ensure that appropriate safeguards are in place. These may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations, transfer risk assessments and appropriate due diligence.
Where you access our website from outside the United Kingdom or communicate with us electronically, this may result in the transfer of personal data across international borders.
We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, restricted permissions, authentication controls, secure systems, encryption where appropriate, logging, monitoring, audit trails, staff confidentiality obligations, supplier due diligence, contractual controls, segregation of duties, secure payment processes, secure client money procedures, secure document handling and appropriate retention and deletion processes.
Access to personal data is limited to personnel and service providers who require access for the purposes described in this Privacy Notice.
Our website may contain links to third-party websites, platforms, portals, auction systems, property websites, finance providers or associated services. We do not control third-party websites and are not responsible for their privacy practices. Individuals should review the privacy notices of third-party websites and platforms they use.
This is particularly relevant where individuals register directly with online bidding platforms, including the-saleroom.com, or use EIG or other property auction platforms.
Please note that information transmitted via the internet, including email, may not be completely secure. While we take reasonable steps to protect personal data, we cannot guarantee the security of data transmitted to us electronically.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, contractual, accounting, tax, property transaction, tenancy, AML, client money, safeguarding, dispute resolution and business record-keeping requirements.
Retention periods vary depending on the type of data and purpose. AML and KYC records are generally retained in accordance with applicable AML requirements. Property transaction, lettings, financial, client money, complaint and legal records may be retained for periods reflecting statutory obligations, limitation periods and regulatory requirements. Recruitment data is usually retained for a limited period after the recruitment process unless a longer period is justified or consent has been obtained for future opportunities. Website, cookie, platform and security data may be retained for shorter operational periods unless needed for investigation, fraud prevention, compliance or legal purposes.
Retention periods are determined based on the nature of the data, the purpose of processing, legal and regulatory requirements, limitation periods and business needs.
Where personal data is no longer required, it will be securely deleted, anonymised or archived in accordance with applicable retention requirements.
Under UK data protection law, you have a number of rights in relation to your personal data.
Right of access: You have the right to request access to the personal data we hold about you.
Right to rectification: You have the right to request correction of inaccurate or incomplete personal data.
Right to erasure: You have the right to request deletion of your personal data in certain circumstances.
Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
Right to object: You have the right to object to processing where we rely on legitimate interests, including for direct marketing purposes. Where you object to direct marketing, we will stop processing for that purpose.
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time.
Right to data portability: You have the right to request the transfer of your personal data to another organisation, where applicable.
Please exercise your rights by contacting us. Requests to exercise rights will be handled in accordance with applicable law. We will respond within the timeframes required by law, typically within one month, subject to any permitted extensions. We may need to verify your identity before processing a request. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office. Further information is available at www.ico.org.uk.
Where permitted by law, we may contact you with information about services, properties, auctions, valuation events, newsletters or updates that may be of interest.
Marketing communications are sent in accordance with the Privacy and Electronic Communications Regulations 2003. Where required, we rely on your consent. In other cases, we rely on the “soft opt-in” rule or our legitimate interests where you are an existing client and marketing relates to similar services.
You can opt out of marketing communications at any time using unsubscribe links or by contacting us directly.
If you have any concerns about how your personal data is processed, you should contact us in the first instance so that we can seek to resolve the matter.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. Further information is available at www.ico.org.uk.
Where your complaint relates to property services, it may also be handled in accordance with our internal complaint’s procedure and, where applicable, referred to The Property Ombudsman or other relevant regulatory body.
We may update this Privacy Notice from time to time to reflect changes in legal requirements, business practices, services, systems or regulatory expectations.
Any updates will be published on our website. Where appropriate, we will take reasonable steps to notify individuals of material changes.
Processing Activity | Purpose | Personal Data Types | Lawful Basis |
|---|---|---|---|
Property sales (end-to-end transaction) | To manage property sale transactions including negotiation and completion | Identity Data; Contact Data; Transaction and Property Data | Contract |
Property marketing and listing creation | To advertise properties across portals and generate buyer interest | Transaction and Property Data; Contact Data | Legitimate interests (promoting properties and securing buyers) |
Buyer enquiries and viewings | To arrange and manage property viewings and buyer engagement | Contact Data; Communications and Customer Service Data | Legitimate interests (facilitating property transactions and managing enquiries) |
Offer handling and sales progression | To manage offers, negotiations and conveyancing process | Transaction and Property Data; Communications and Customer Service Data | Contract |
Lettings onboarding and tenancy management | To administer tenancy agreements and property management | Lettings and Tenancy Data; Identity Data | Contract |
Tenant referencing and affordability checks | To assess tenant suitability and risk | Lettings and Tenancy Data; Financial, Tax and Payment Data | Legitimate interests (reducing tenancy risk and ensuring affordability) |
Right to Rent checks (including UKVI share codes) | To verify immigration status of tenants | AML, Compliance and Due Diligence Data; Lettings and Tenancy Data | Legal obligation (Immigration Act 2014) |
Landlord onboarding and management | To manage landlord relationships and instructions | Contact Data; Transaction and Property Data | Contract |
Rent collection and arrears management | To collect rent and manage payment obligations | Financial, Tax and Payment Data; Lettings and Tenancy Data | Contract |
Property inspections and maintenance coordination | To maintain properties and manage contractor access | Transaction and Property Data; Communications and Customer Service Data | Legitimate interests (maintaining property condition and fulfilling management obligations) |
Out-of-hours maintenance and emergency property access | To manage urgent repairs, emergency maintenance, locksmith access, property security and related tenant/landlord communications | Identity Data; Contact Data; Transaction and Property Data; Lettings and Tenancy Data; Communications and Customer Service Data | Legitimate interests (ensuring property security and safety, protecting tenants and properties, coordinating emergency repairs and contractor access, preventing property damage, and maintaining effective property management and tenancy support services) |
Auctions (machinery, livestock and property) registration | To register buyers and sellers for auctions | Identity Data; Contact Data; Auction and Bidding Data | Contract |
Auction participation (in-person, absentee, telephone and online bidding) | To facilitate auction bidding activity | Auction and Bidding Data; Platform, Account and Security Data | Contract |
Online bidding platform integration (EIG / the-saleroom.com) | To enable remote bidding and auction participation | Platform, Account and Security Data; Website, Platform and Technical Data | Legitimate interests (facilitating online auction participation and system functionality) |
Auction settlement, invoicing and payments | To process auction transactions and payments | Financial, Tax and Payment Data; Auction and Bidding Data | Contract |
Collection, delivery and logistics | To arrange collection or delivery of purchased items | Contact Data; Transaction and Property Data | Contract |
Livestock traceability and regulatory reporting | To comply with agricultural and livestock regulations | Livestock, Machinery and Agricultural Data | Legal obligation (Defra and livestock movement regulations) |
Auction and transaction record keeping | To maintain records of auctions and financial transactions | Financial, Tax and Payment Data; Auction and Bidding Data | Legal obligation (Companies Act 2006; HMRC requirements) |
Sale room services (jewellery, antiques, watches, etc.) | To manage consignment, valuation and sale of items | Auction and Bidding Data; Transaction and Property Data | Contract |
Valuation services and condition reports | To provide valuations and pre-sale information | Development, Valuation and Advisory Data; Transaction and Property Data | Steps prior to contract |
Development and advisory services | To provide strategic and financial property advice | Development, Valuation and Advisory Data | Contract |
Rural and agricultural advisory services | To provide land, farming and subsidy advice | Livestock, Machinery and Agricultural Data; Development, Valuation and Advisory Data | Contract |
Finance broking and loan facilitation | To assist with finance applications and lender engagement | Financial, Tax and Payment Data; Identity Data | Steps prior to contract |
Credit checks and affordability assessments | To assess financial viability of transactions | Financial, Tax and Payment Data | Legitimate interests (assessing financial risk and transaction viability) |
AML, KYC and identity verification | To verify identity and prevent financial crime | AML, Compliance and Due Diligence Data; Identity Data | Legal obligation (Money Laundering Regulations 2017) |
Ongoing AML monitoring and suspicious activity reporting | To detect and report financial crime | AML, Compliance and Due Diligence Data | Legal obligation (Proceeds of Crime Act 2002) |
Client money handling and reconciliation | To manage client funds in accordance with RICS rules | Financial, Tax and Payment Data | Legal obligation (RICS Client Money Protection Scheme Rules) |
Website enquiries and contact forms | To respond to customer enquiries | Communications and Customer Service Data; Contact Data | Legitimate interests (responding to enquiries and managing customer interactions) |
Email and telephone communications | To manage communications and maintain records | Communications and Customer Service Data | Legitimate interests (business communication management and record keeping) |
Website operation and functionality | To operate and maintain website services | Website, Platform and Technical Data | Legitimate interests (ensuring system functionality and availability) |
Website analytics and tracking technologies | To analyse usage and improve services | Website, Platform and Technical Data | Consent (PECR) |
Account creation and user authentication | To manage user accounts and login credentials | Platform, Account and Security Data; Identity Data | Contract |
Fraud detection and platform security monitoring | To detect fraud and protect systems | Platform, Account and Security Data; Website, Platform and Technical Data | Legitimate interests (fraud prevention and system security) |
Marketing communications (existing clients) | To promote services to existing customers | Marketing and Digital Engagement Data; Contact Data | Legitimate interests (soft opt-in marketing under PECR) |
Marketing communications (new prospects) | To send marketing where consent is required | Marketing and Digital Engagement Data; Contact Data | Consent |
CRM management and customer profiling | To manage relationships and improve services | Marketing and Digital Engagement Data | Legitimate interests (customer relationship management and service optimisation) |
Newsletter subscriptions and updates | To provide requested newsletters and updates | Marketing and Digital Engagement Data | Consent |
Data subject rights handling (SARs, erasure, etc.) | To respond to legal rights requests | Legal, Complaints and Governance Data; Identity Data | Legal obligation (UK GDPR Articles 12–22) |
Identity verification for rights requests | To confirm identity before fulfilling requests | Identity Data; AML, Compliance and Due Diligence Data | Legal obligation (UK GDPR) |
Complaints handling and escalation | To investigate complaints and liaise with ombudsman | Legal, Complaints and Governance Data; Communications and Customer Service Data | Legal obligation (consumer protection law; Property Ombudsman Scheme) |
Legal claims and dispute resolution | To establish, exercise or defend legal claims | Legal, Complaints and Governance Data | Legal obligation (legal claims handling and limitation periods) |
Regulatory compliance and audit (including DPIAs and record keeping) | To meet governance and accountability requirements | Legal, Complaints and Governance Data | Legal obligation (UK GDPR Article 5(2) and Article 30) |
International buyers and cross-border transactions | To facilitate overseas participation in services and auctions | Identity Data; Contact Data; Transaction and Property Data | Contract |
Processing Activity | Purpose | Personal Data Types | Lawful Basis |
Enhanced due diligence (high-risk and overseas transactions) | To manage increased financial crime risk in high-value or high-risk transactions | AML, Compliance and Due Diligence Data; Financial, Tax and Payment Data; Identity Data | Legal obligation (Money Laundering Regulations 2017 – Regulations 33 & 35) |
Beneficial ownership identification (corporate and trust structures) | To identify ultimate beneficial owners in property and auction transactions | AML, Compliance and Due Diligence Data; Identity Data | Legal obligation (Money Laundering Regulations 2017 – Regulation 28) |
Source of funds and source of wealth verification | To verify legitimacy of funds used in transactions | Financial, Tax and Payment Data; AML, Compliance and Due Diligence Data | Legal obligation (Money Laundering Regulations 2017) |
Overseas transaction and jurisdiction risk assessment | To assess risk associated with cross-border transactions and high-risk jurisdictions | AML, Compliance and Due Diligence Data; Identity Data | Legal obligation (Money Laundering Regulations 2017) |
Third-party payment and intermediary verification | To verify legitimacy of payments made by or through third parties | Financial, Tax and Payment Data; Identity Data; AML, Compliance and Due Diligence Data | Legal obligation (Money Laundering Regulations 2017) |
Transaction monitoring and behavioural analysis | To identify unusual or high-risk transaction patterns | AML, Compliance and Due Diligence Data; Auction and Bidding Data; Financial, Tax and Payment Data | Legal obligation (Money Laundering Regulations 2017) |
Auction bidder verification and approval | To verify identity and eligibility before allowing participation in auctions | Identity Data; Auction and Bidding Data; AML, Compliance and Due Diligence Data | Contract and legal obligation (Money Laundering Regulations 2017) |
Processing Activity | Purpose | Personal Data Types | Special Category / Criminal Data | |
|---|---|---|---|---|
DBS checks (recruitment only) | To assess suitability of candidates where required for roles involving trust or safeguarding | Recruitment and Employment Data; AML, Compliance and Due Diligence Data | Criminal conviction data; offence details; DBS results | Legal obligation (Police Act 1997; Safeguarding Vulnerable Groups Act 2006) and Article 10 UK GDPR with DPA 2018 Schedule 1 |
Right to work checks (recruitment) | To verify legal right to work in the UK | Identity Data; Recruitment and Employment Data; AML, Compliance and Due Diligence Data | Immigration status data | Legal obligation (Immigration, Asylum and Nationality Act 2006) and Article 9(2)(b) with DPA 2018 Schedule 1 Part 1 |
Right to rent checks (lettings) | To verify legal eligibility to rent property | AML, Compliance and Due Diligence Data; Lettings and Tenancy Data | Immigration status data | Legal obligation (Immigration Act 2014) and Article 9(2)(g) with DPA 2018 Schedule 1 Part 2 |
AML checks involving PEPs and sanctions screening | To identify politically exposed persons and sanctioned individuals | AML, Compliance and Due Diligence Data | Political exposure data (PEP status); sanctions screening results | Legal obligation (Money Laundering Regulations 2017) and Article 9(2)(g) with DPA 2018 Schedule 1 Part 2 |
Suspicious activity reporting and financial crime detection | To detect and report suspected criminal conduct | AML, Compliance and Due Diligence Data | Criminal offence data; suspicion indicators | Legal obligation (Proceeds of Crime Act 2002) and Article 10 UK GDPR |
Legal claims and dispute resolution | To establish, exercise or defend legal claims | Legal, Complaints and Governance Data | Criminal offence data; special category data included in evidence | Article 9(2)(f) (legal claims) and Article 10 UK GDPR |
Complaints handling and escalation | To investigate complaints and liaise with regulatory or ombudsman bodies | Legal, Complaints and Governance Data; Communications and Customer Service Data | May include health data, vulnerability information or allegations of misconduct | Article 9(2)(f) and Article 9(2)(g) (DPA 2018 Schedule 1 Part 2) |
Safeguarding and vulnerability considerations | To protect individuals in vulnerable situations during service delivery | Lettings and Tenancy Data; Communications and Customer Service Data | Health data; vulnerability indicators | Article 9(2)(g) substantial public interest (safeguarding) under DPA 2018 Schedule 1 Part 2 |
Accessibility and reasonable adjustments | To accommodate accessibility or support needs | Communications and Customer Service Data | Health data; disability information | Article 9(2)(a) consent or Article 9(2)(g) where necessary |
Correspondence containing sensitive data | To manage communications where individuals voluntarily disclose sensitive information | Communications and Customer Service Data; Legal, Complaints and Governance Data | Health data; criminal allegations; other sensitive disclosures | Article 9(2)(a) consent or Article 9(2)(f) where relevant |
Data subject rights requests (identity verification and handling) | To comply with legal obligations when processing rights requests | Legal, Complaints and Governance Data; Identity Data | May include sensitive identifiers or supporting documentation | Legal obligation (UK GDPR Articles 12–22) and Article 9(2)(g) |
Recruitment equality monitoring (if collected) | To monitor equality and diversity in recruitment processes | Recruitment and Employment Data | Racial or ethnic origin; diversity data | Article 9(2)(a) explicit consent |
©2026 Cooper and Tanner. All Rights Reserved.
