Privacy policy

How we handle personal data, and the rights you have over it.

Effective date 25 August 2026. Last updated 25 August 2026.

1. About this policy

This policy explains how Sable and Stone Real Estate Ltd collects, uses, shares, stores and protects personal data, and what rights you have. It covers our website, our enquiry and valuation journeys, and the sales, lettings, commercial and property management services we provide.

2. Who is responsible for your personal data

Sable and Stone Real Estate Ltd is the data controller.

3. Whose personal data we process

  • Website visitors and people using our search, enquiry and valuation tools
  • Enquirers and prospective clients
  • Sellers, buyers, landlords and property owners
  • Tenants, contract-holders, applicants, occupiers and guarantors
  • Representatives and connected persons, including authorised agents, attorneys, executors and family members acting on someone's behalf
  • Suppliers, contractors, introducers and professional partners

4. Personal data we collect

Identity and contact data

Name, address, contact details, date of birth where required, and identification documents. Provided by you, or by an authorised representative.

Property and enquiry data

The property you are interested in or own, your requirements, viewing and offer history, and the content of your communications with us. Provided by you, or drawn from an agency instruction or property documentation.

Client, transaction and payment data

Instruction terms, offers, fees, invoices, rent, deposits and bank details where needed to operate a service. Provided by you and generated in the course of the transaction.

Applicant, tenancy and reference data

Household composition, employment, income, affordability, previous tenancy history and referee information. Provided by you, a guarantor, a referee, an employer, a previous landlord or a referencing provider.

Compliance, anti-money laundering and security data

Identity and verification documents, beneficial ownership information, source of funds and source of wealth evidence, sanctions and politically exposed person screening results, and records of the checks we carried out.

Technical and usage data

IP address, browser and device type, operating system, and pages viewed. See section 10 on cookies, which explains why this website currently collects very little of this.

Marketing and preference data

Your marketing preferences, the property alerts you have asked for, and your engagement with our communications.

Special category and criminal offence data

Only where necessary, for example accessibility information needed to arrange a suitable viewing, right to work evidence, safeguarding concerns, or financial crime and sanctions risk data. See section 7.

5. Data we obtain from other sources

We may receive personal data from property portals and listing services, referring partners, landlords, sellers, buyers, tenants and guarantors, employers and previous landlords, credit and referencing providers, identity, anti-money laundering, fraud and sanctions providers, Companies House, HM Land Registry, electoral and other public registers, solicitors, surveyors, mortgage brokers, insurers, maintenance contractors, regulators, local authorities, and publicly available sources.

Where we collect data from a source other than you, this policy sets out the categories, purposes, lawful bases and recipients. We will provide further information at the appropriate time unless an exception under data protection law applies.

6. Why we use personal data, and our lawful bases

We use personal data only where UK data protection law allows. The bases we rely on are:

Contract

Processing is necessary to enter into or perform a contract with you, or to take steps at your request before a contract. This covers most of what we do for clients, applicants and tenants.

Legal obligation

Processing is necessary to comply with a legal or regulatory duty, for example anti-money laundering, sanctions, tax, client money, Right to Rent, housing or record-keeping requirements.

Legitimate interests

Processing is necessary for our interests or a third party's, where your rights and interests do not override them. We assess necessity, proportionality and impact before relying on this basis. Our legitimate interests include operating and securing our systems, responding to genuine enquiries, managing our business and client relationships, preventing fraud and financial crime, protecting people and property, resolving complaints and disputes, establishing or defending legal claims, and improving our services.

Consent

You have given clear, voluntary and specific consent, typically for optional electronic marketing. You can withdraw consent at any time, and doing so does not affect processing carried out before you withdrew it.

Vital interests

Rarely, processing is necessary to protect someone's life, for example in a property emergency.

What we use data for

  • Operating, protecting and maintaining our website and systems
  • Responding to enquiries and to valuation and viewing requests
  • Providing sales, lettings, commercial, management and valuation services
  • Managing listings, viewings, offers and transactions
  • Processing tenant, applicant and guarantor information
  • Carrying out referencing, identity, anti-money laundering, sanctions and fraud checks
  • Administering deposits, rent, fees, invoices and related payments
  • Managing repairs, inspections, safety, property access and emergencies
  • Sending marketing, property alerts and service updates
  • Improving our services and understanding how our website is used
  • Handling complaints, disputes, claims, insurance and regulatory matters
  • Managing referrals, partners, suppliers and professional advisers
  • Recruitment and workforce administration
  • Corporate transactions and business planning

We do not use personal data for a new, incompatible purpose unless the law permits it and we give you any notice required.

7. Special category and criminal offence data

We process special category or criminal offence data only where necessary and where a separate condition under data protection law applies. Depending on the context that may be explicit consent, employment or social protection law, substantial public interest, legal claims, vital interests, safeguarding, or the exercise or defence of legal rights.

We minimise access to this data, apply additional security, and give a more specific notice where appropriate.

8. Marketing, property alerts and your choices

We may send information about our services, available properties, market updates and guides. We comply with the UK GDPR and the Privacy and Electronic Communications Regulations.

For electronic marketing by email or text to individuals, sole traders and most partnerships, we obtain consent unless the soft opt-in applies. Where we rely on the soft opt-in, we use contact details obtained during a sale or negotiation for similar services only, give a clear opportunity to opt out when we collect the details, and include an easy opt-out in every message.

We may rely on legitimate interests for postal marketing or other activity where the Regulations do not require consent, subject to an assessment of your rights and expectations. We check the Telephone Preference Service and Corporate Telephone Preference Service and respect our own suppression lists before making live marketing calls where required.

You can object to direct marketing at any time. Unsubscribe using the link in any marketing email, or email marketing@sableandstonerealestate.com with the subject line "Marketing opt out". An opt-out does not stop service, legal, security, property management, transaction, payment or complaint communications that we need to send.

We do not sell personal data, and we do not share it with third parties for their own direct marketing unless we have told you about the sharing and have a lawful basis, including consent where that is required.

9. The website assistant

Our website carries an automated assistant that answers questions using the content published on this site.

What happens to what you type. Your question, and the earlier messages in that conversation, are sent to our server and then to an AI model provider through the Vercel AI Gateway, which generates the reply. We use that only to answer you.

What we do not do. We do not store your conversation. Nothing is written to your device: the assistant sets no cookie and uses no local or session storage, and the conversation is discarded when you close the tab. We do not use conversations to train any model, and we do not link them to you or to any other record we hold.

What you should not type into it. Please do not enter personal details you would not put in a public web form, and never enter payment details, passwords or identity documents. If you need to give us personal information, use the contact form, telephone or email instead.

What it is not. The assistant answers only from published website content. It is not advice, it cannot value a property, and it cannot deal with your particular circumstances. For anything that matters, speak to a member of the team.

Our lawful basis is our legitimate interest in answering enquiries efficiently. You are never required to use it, and every question it can answer is also answerable by a person on the telephone.

10. Automated tools, profiling and decisions

We may use technology to route enquiries, match property search preferences, generate a digital estimate, identify potential fraud or security concerns, and prioritise work.

A digital estimate, including the instant valuation tool and the calculators on this website, is indicative only. It is not a formal valuation, survey, mortgage valuation, investment recommendation, guarantee of value or binding offer.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Where a referencing, fraud, anti-money laundering or application process includes automated tools, a suitably trained person reviews the result before a significant decision is made, unless a lawful exception applies.

11. Cookies and similar technologies

This website currently sets no cookies. It uses no analytics, no advertising or remarketing tags, no social media pixels, no embedded third-party media, no chat widget and no tag manager, and it makes no requests to any third-party host. Nothing is written to local or session storage, and there is no service worker.

Because nothing non-essential is set, there is currently no consent banner and nothing for you to accept, refuse or withdraw.

If we later add analytics, advertising, embedded media, mapping, chat or any other technology that sets non-essential cookies or similar technologies, we will publish an accurate cookie table, deploy a consent mechanism that blocks those technologies by default, and make refusing as easy as accepting, before anything is set. Our cookie policy is the authoritative statement of the current position and will be updated first.

12. Who we share data with

We share personal data only where it is relevant, necessary and lawful. Recipients act either as processors on our behalf or as independent controllers with their own obligations.

  • Clients and transaction parties. Sellers, buyers, landlords, tenants, contract-holders, guarantors, property owners, authorised representatives and occupiers. Usually independent controllers.
  • Property marketing and portal providers. Property portals, listing providers, photography, video and floorplan suppliers, and mapping or virtual tour providers. Processor or independent controller depending on the service.
  • Reference, verification and risk providers. Identity, credit and referencing, anti-money laundering, fraud prevention, sanctions and document verification providers. Usually independent controllers.
  • Professional advisers and service providers. Solicitors, surveyors, mortgage brokers, insurers, accountants, inventory providers, EPC assessors and maintenance contractors. Usually independent controllers.
  • Technology suppliers. Hosting, cloud storage, CRM, email, telephony, cybersecurity, payment, document signing and support providers. Normally processors.
  • Deposit, redress and regulatory bodies. Deposit protection schemes, The Property Ombudsman, HMRC, the Information Commissioner's Office, local authorities, Rent Smart Wales, courts, tribunals, police and other regulators. Independent controllers or public bodies.
  • Business partners and introducers. Approved referral partners, where a referral is requested or authorised, and only under approved data sharing terms.
  • Insurers, auditors and corporate advisers. Including funders and prospective purchasers of the business and their advisers, where a corporate transaction is contemplated.

We require processors to use personal data only on our documented instructions, to apply appropriate security, and to assist us with our data protection duties. We apply data sharing, confidentiality and due diligence controls where we share data with independent controllers.

13. International transfers

Some suppliers may process personal data outside the United Kingdom. Before any transfer we ensure a lawful transfer mechanism is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another lawful safeguard, together with a transfer risk assessment and supplementary measures where needed.

You can request information about the relevant safeguards by emailing privacy@sableandstonerealestate.com with the subject "International transfer request".

14. How long we keep personal data

We keep personal data only for as long as necessary for the purpose it was collected for, including legal, regulatory, tax, accounting, insurance, complaint and claim requirements. We may keep data longer where a dispute, investigation, legal hold or statutory duty applies.

Two periods are set by law rather than by us:

  • Anti-money laundering and customer due diligence records are kept for five years from the end of the business relationship or the completion of the transaction, in accordance with the Money Laundering Regulations, and then deleted unless another legal requirement applies.
  • Payment, financial and tax records are kept for six years from the end of the relevant accounting period, in accordance with tax and accounting requirements, or longer where a claim requires it.

For every other category we apply the criteria below and delete, anonymise or archive at the end of the relevant period.

  • Website server and security logs: kept for as long as needed for security, troubleshooting and fraud prevention, and longer only where an incident or investigation requires it
  • Enquiries and valuation leads that do not become a client relationship: kept for enquiry follow-up, service quality and the limitation period for a dispute
  • Property alerts and marketing profiles: kept until you unsubscribe or become inactive, after which we retain a minimal suppression record so that we can continue to respect your opt-out
  • Unsuccessful applicant and referencing files: kept for the period needed to evidence the application decision, prevent fraud and handle any complaint
  • Client instruction, sale, letting and property management records: kept after the end of the relationship for the contractual, regulatory, tax, insurance and claims periods that apply
  • Complaint, incident, safety and legal claim records: kept until the applicable limitation period has expired or our insurer or legal adviser advises otherwise
  • Recruitment applications from candidates not appointed: kept for the period needed to handle any resulting claim, or longer where the candidate consents to being kept on file
  • Employee, worker and contractor records: managed under a separate workforce privacy notice and retention schedule

Our detailed retention schedule sits in our internal retention policy. If you would like to know the specific period that applies to your own records, email privacy@sableandstonerealestate.com and we will tell you.

15. Security and payment fraud prevention

We use appropriate technical and organisational safeguards to protect personal data, including access controls, role-based permissions, secure systems, confidentiality commitments, supplier controls, backups, monitoring, staff training, incident response and secure deletion.

No internet service is completely secure. Please use a secure connection, protect your devices and passwords, and verify any change to payment or bank account instructions using a trusted contact route you have independently confirmed.

We will never ask you to send money to a new bank account solely on the strength of an email or text message. If you suspect a fraudulent communication, a data breach or a payment redirection attempt, contact us using the details published on this website, and not any details contained only in the suspicious message. See property fraud.

16. Your rights

Subject to the conditions and exemptions in data protection law, you have the following rights.

  • Access. Ask for a copy of your personal data and information about how we use it.
  • Rectification. Ask us to correct inaccurate or incomplete data.
  • Erasure. Ask us to delete data in certain circumstances.
  • Restriction. Ask us to restrict particular processing in certain circumstances.
  • Data portability. Ask for certain data you provided in a structured, commonly used and machine-readable format, where applicable.
  • Object. Object to processing based on legitimate interests or public task grounds, where the law permits.
  • Object to direct marketing. Object at any time, and we will stop using your data for that purpose.
  • Withdraw consent. Withdraw consent at any time where consent is our basis. This does not affect processing carried out beforehand.
  • Automated decisions. Ask for the applicable safeguards, human intervention and a chance to challenge a solely automated significant decision.

To exercise a right, email privacy@sableandstonerealestate.com with the subject line "Privacy request" and the right you want to exercise. Please describe what you need and give us enough information to identify you and the relevant relationship, property or transaction. We will respond within the statutory timeframe, subject to any lawful extension or exemption.

You also have the right to complain to the Information Commissioner's Office. Its contact details are at ico.org.uk. We would welcome the chance to address your concern first, but that does not affect your right to complain.

17. Children, vulnerable people and household data

Our website is not intended for children to use independently for property, valuation or financial purposes. We process information about children, household members or vulnerable people only where necessary for a household, occupancy, tenancy, accessibility, safeguarding, legal or service purpose, and with appropriate safeguards.

If you provide another person's data you must have a lawful basis for doing so and, where appropriate, tell them you have given their information to us. We may contact that person directly or provide privacy information by another appropriate route.

18. Recruitment and work opportunities

If you apply to work with us, we use your information to assess your application, communicate with you, verify identity and right to work where appropriate, obtain references, arrange interviews, make fair recruitment decisions, meet legal obligations, and establish or defend claims. We use equality and diversity information only where it has been lawfully collected, and with restricted access.

We do not normally use solely automated recruitment decisions with legal or similarly significant effects. If you are appointed, we will give you a workforce privacy notice.

19. External websites, portals and social media

Our website may link to independent websites, property portals, maps, social networks and professional providers. Those third parties control their own services and privacy practices. Read their privacy notices before giving them personal data. We are not responsible for their privacy practices, content, availability or security.

20. Changes to this policy

We may update this policy to reflect changes in law, guidance, technology, our services or our processing. We will publish the updated policy here with a revised effective date. Where a change is material and requires direct notice or fresh consent, we will take the additional steps required.

21. Contact

For any privacy question, email privacy@sableandstonerealestate.com, write to Sable and Stone Real Estate Ltd, 124 City Road, London, England, EC1V 2NX, or call 020 4635 8543.