Legal
Privacy Notice
VM-PN-001 | Version 2.0 | May 2026 | Company Registration No: 17212434
"In short: we collect only the data we need to provide your property services, comply with anti-money laundering law, and run our business. We do not sell your data. We keep it securely for defined periods. You can ask us to access, correct, or delete it at any time. Full details are below."
Jump to section:
1. Who We Are
Vale and Mercer Ltd is a property estate agency providing property sales, lettings, and related property management services in England.
| Company Name | Vale and Mercer Ltd |
|---|---|
| Company Registration No | 17212434 (registered in England and Wales) |
| Data Enquiries Contact | privacy@valeandmercer.co.uk |
| ICO Registration Number | ZC155397 |
Vale and Mercer Ltd is registered with the Information Commissioner's Office (ICO) as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We do not have a formally appointed Data Protection Officer (DPO), as we are not legally required to designate one as a small private estate agency. All data protection enquiries should be directed to the contact above, which is monitored by the company director.
2. What This Notice Covers and Who It Applies To
This Privacy Notice explains what personal data we collect, why we collect it, the legal basis on which we process it, how we protect it, who we share it with, how long we keep it, and what your rights are. It applies to:
- Vendors and sellers instructing us to market their property for sale
- Buyers and applicants registering with us to find a property to purchase
- Landlords instructing us to let or manage their property
- Tenants, residents, and guarantors applying for or occupying properties we manage
- Visitors to our website
- Anyone who contacts us by email, telephone, or contact form
A separate internal privacy notice applies to our staff and contractors.
3. The Data We Collect and Why
3.1 Vendors and Sellers
We collect this data to carry out your instruction to sell your property and to comply with our legal obligations as an estate agency.
| Data Collected | Purpose | Lawful Basis |
|---|---|---|
| Full name, home address, contact telephone and email | Property instruction management and communication | Contract: Art. 6(1)(b) |
| Property address and property particulars | Marketing and advertising your property for sale | Contract: Art. 6(1)(b) |
| Government-issued photo ID (passport or driving licence) and proof of address | Anti-money laundering (AML) identity verification: required by law before we can act | Legal Obligation: Art. 6(1)(c), Money Laundering Regulations 2017 |
| Source of funds documentation | AML verification: required before completion | Legal Obligation: Art. 6(1)(c), Money Laundering Regulations 2017 |
| Solicitor name and contact details | To facilitate legal completion of the sale | Contract: Art. 6(1)(b) |
3.2 Buyers and Purchasing Applicants
We collect this data to register you and match you to suitable properties on the market.
| Data Collected | Purpose | Lawful Basis |
|---|---|---|
| Full name, address, contact telephone and email | Applicant registration and property matching | Legitimate Interests: Art. 6(1)(f) |
| Property search preferences (budget, area, bedrooms, type) | Identifying suitable properties and arranging viewings | Legitimate Interests: Art. 6(1)(f) |
| Financial pre-qualification information (e.g. mortgage agreement in principle) | To assess suitability to proceed with a purchase | Contract: Art. 6(1)(b) |
| Government-issued photo ID and proof of address | AML identity verification required before exchange of contracts | Legal Obligation: Art. 6(1)(c), Money Laundering Regulations 2017 |
| Source of funds documentation | AML verification at point of sale | Legal Obligation: Art. 6(1)(c), Money Laundering Regulations 2017 |
3.3 Landlords
We collect this data to manage your lettings instruction and comply with our legal obligations.
| Data Collected | Purpose | Lawful Basis |
|---|---|---|
| Full name, home address, contact telephone and email | Lettings instruction management and communication | Contract: Art. 6(1)(b) |
| Bank account details (for rental income remittance) | To pay rental income to you | Contract: Art. 6(1)(b) |
| Property address and related certificates (Gas Safety Certificate, EICR, EPC) | Property management and legal compliance as a letting agent | Contract: Art. 6(1)(b) + Legal Obligation: Art. 6(1)(c) |
| National Insurance number or Tax reference (Non-Resident Landlord scheme where applicable) | HMRC Non-Resident Landlord tax reporting | Legal Obligation: Art. 6(1)(c), Finance Act / HMRC NRL Scheme |
| Government-issued photo ID and proof of address | AML identity verification: required before we can act | Legal Obligation: Art. 6(1)(c), Money Laundering Regulations 2017 |
3.4 Tenants, Residents, and Guarantors
We collect this data to process your tenancy application and to manage and administer your tenancy.
| Data Collected | Purpose | Lawful Basis |
|---|---|---|
| Full name, date of birth, current and all previous addresses (3 years) | Tenancy application processing and tenancy agreement | Contract: Art. 6(1)(b) |
| Contact telephone number and email address | Communication throughout the application and tenancy | Contract: Art. 6(1)(b) |
| National Insurance number, employer name and address, pay slips, and bank statements | Referencing: affordability and suitability assessment | Contract: Art. 6(1)(b) |
| Credit check results (obtained via referencing platform) | Assessing financial suitability as a tenant | Contract: Art. 6(1)(b) |
| Employer reference and previous landlord reference | Verifying employment and previous tenancy history | Contract: Art. 6(1)(b) |
| Government-issued photo ID and proof of right to rent | Right to Rent check: required by law before tenancy begins | Legal Obligation: Art. 6(1)(c), Immigration Act 2014 |
| Emergency contact name and telephone number | To contact in an emergency situation during the tenancy | Legitimate Interests: Art. 6(1)(f) |
| Tenancy deposit amount and deposit protection scheme reference | To register your deposit with a government-approved protection scheme | Legal Obligation: Art. 6(1)(c), Housing Act 2004 |
| Details of any maintenance requests, complaints, or inspections | Property management and record-keeping during the tenancy | Contract: Art. 6(1)(b) |
3.5 Website Visitors
| Data Collected | Purpose | Lawful Basis |
|---|---|---|
| Contact form submissions (name, email, telephone, message) | Responding to your enquiry | Legitimate Interests: Art. 6(1)(f) |
| IP address and cookie/browsing data (analytics) | Understanding how visitors use our website to improve it | Consent: Art. 6(1)(a), PECR 2003 (via our cookie consent banner) |
| IP address and cookie data (advertising/remarketing via Google Ads) | Displaying relevant advertisements to previous website visitors | Consent: Art. 6(1)(a), PECR 2003 (via our cookie consent banner) |
| Email address (if you subscribe to property updates) | Sending you property market updates and listings you have requested | Consent: Art. 6(1)(a), PECR 2003 |
4. How We Use Your Data: Further Detail on Legitimate Interests
Where we rely on legitimate interests as our lawful basis, we have carried out and documented a Legitimate Interests Assessment (LIA) for each activity. The activities where we rely on legitimate interests are:
- Buyer and applicant property matching: We process your contact details and preferences to identify and share suitable properties. This is a core service function you would reasonably expect us to carry out when you register with us.
- Website enquiry responses: We process contact form data solely to respond to your specific enquiry.
- Emergency contact use: We retain your nominated emergency contact solely for genuine emergency situations during your tenancy.
You have the right to object to processing based on legitimate interests at any time.
5. Who We Share Your Personal Data With
We only share your personal data where necessary and with appropriate safeguards in place. We do not sell personal data to any third party.
| Recipient | Purpose | Basis for Sharing |
|---|---|---|
| Rightmove Ltd (when subscribed) | To list and advertise your property on Rightmove | Contract: listing instruction |
| Zoopla Ltd (when subscribed) | To list and advertise your property on Zoopla | Contract: listing instruction |
| Lettings Hub (tenant referencing, when subscribed) | To conduct independent tenant referencing and credit checks | Contract: tenancy application |
| Government-approved tenancy deposit protection scheme (DPS, TDS, or MyDeposits) | To register and protect tenant deposits as required by law | Legal Obligation: Housing Act 2004 |
| Solicitors and conveyancers | To facilitate the legal completion of sales transactions | Contract |
| HMRC | Anti-money laundering reporting, PAYE, Non-Resident Landlord scheme reporting | Legal Obligation |
| Home Office | Right to Rent verification (if required) | Legal Obligation: Immigration Act 2014 |
| Property maintenance contractors | To arrange and carry out repairs and inspections (name and address only) | Contract: property management |
| Microsoft Corporation (Microsoft 365 / Outlook) | Cloud email platform used for client correspondence | Contract. Microsoft acts as our data processor |
| Google LLC (Google Workspace, Google Ads, when activated) | Cloud storage and digital advertising | Contract / Consent. Google acts as our data processor |
| DocuSign Inc (when subscribed) | Electronic signature processing for tenancy agreements | Contract. DocuSign acts as our data processor |
| Accountants and financial advisers | Bookkeeping, financial compliance, and tax filing | Legal Obligation / Contract |
| ICO | Regulatory compliance: registration and mandatory breach reporting | Legal Obligation: DPA 2018 |
6. International Data Transfers
Some processors operate outside the UK. All international transfers are made under Standard Contractual Clauses with the UK Addendum approved by the ICO, or equivalent safeguards under UK GDPR Chapter V. Details are available on request.
Vercel Inc (website infrastructure): Vale and Mercer Ltd's website is built and hosted on Vercel's platform. Vercel may process technical data in the United States as part of delivering the website. This transfer is made under Standard Contractual Clauses with the UK Addendum approved by the ICO. Vercel acts solely as our data processor.
All other processors and recipients used by Vale and Mercer Ltd are based in the United Kingdom and process data within the UK only.
7. How Long We Keep Your Data
We apply the principle of storage limitation under UK GDPR Article 5(1)(e). We do not keep your data for longer than is necessary for the purpose it was collected, or as required by law.
| Data Category | Retention Period | When Clock Starts | Legal Basis |
|---|---|---|---|
| Completed sale files (vendor and buyer) | 6 years | Date of sale completion or instruction withdrawal | Limitation Act 1980 |
| AML identity verification documents (mandatory, cannot be deleted early) | 5 years minimum | Date business relationship ends | Money Laundering Regulations 2017, Reg. 40 (mandatory) |
| Tenancy files (landlord and tenant data) | 6 years | Date tenancy ends | Limitation Act 1980 |
| Right to Rent check documents | 1 year | Date tenancy ends | Immigration Act 2014 |
| Tenancy deposit protection records | 6 years | Date tenancy ends | Housing Act 2004 |
| Buyer/applicant records (no transaction formed) | 12 months | Date of last contact | Legitimate interests (proportionate) |
| Website contact form enquiries (no relationship formed) | 12 months | Date of submission | Legitimate interests (proportionate) |
| Email marketing consent records | Duration of consent + 1 year | Date of unsubscription or withdrawal | PECR 2003 |
| Financial records (invoices, bank statements) | 6 years | End of financial year to which records relate | Companies Act 2006; HMRC requirements |
Important regarding AML documents: We are required by the Money Laundering Regulations 2017 to retain your identity verification documents for a minimum of five years following the end of our business relationship with you. A request for erasure of these documents cannot be fulfilled during this mandatory retention period. We will inform you of this if you make such a request.
8. Your Rights Under UK GDPR
You have the following rights in relation to your personal data held by Vale and Mercer Ltd. We will respond to all requests within one calendar month, free of charge.
- Right of Access (Subject Access Request)
You may request a copy of all personal data we hold about you. We will provide this in a clear format within one calendar month. We may ask you to verify your identity before responding. - Right to Rectification
If any data we hold about you is inaccurate or incomplete, you may ask us to correct it. We will update our records and notify any relevant third parties where applicable. - Right to Erasure ("Right to be Forgotten")
You may request that we delete your personal data. We will comply unless we are required to retain it by law. For example, AML identity records, contract documents, or financial records. - Right to Restrict Processing
You may ask us to pause our use of your personal data while a concern or dispute is being resolved. - Right to Data Portability
Where our lawful basis is consent or contract, you may request your data in a structured, commonly used, machine-readable format (e.g. CSV or PDF). - Right to Object
You have an absolute right to object to your data being used for direct marketing. We will stop immediately on receipt of your objection. - Rights Related to Automated Decision-Making
We do not currently make any automated decisions that produce legal or similarly significant effects on you. We will update this notice if this changes.
To exercise any of these rights, please contact: privacy@valeandmercer.co.uk
9. Cookies
Our website uses cookies. A cookie is a small text file placed on your device when you visit a website. We use the following categories:
- Strictly necessary cookies: Required for core website functions. These do not require your consent and cannot be disabled.
- Analytics cookies (e.g. Google Analytics): help us understand how visitors use our website. They require your prior consent, which you can give or withdraw via our cookie consent banner at any time.
- Marketing and remarketing cookies (e.g. Google Ads): allow us to display relevant advertisements. They require your prior consent via our cookie consent banner.
You can manage and withdraw your cookie consent at any time using the cookie settings link in our website footer. Withdrawing consent will not affect the lawfulness of any processing that took place before you withdrew it.
For full details of every cookie used on this website, including names, durations, and how to withdraw consent, see our Cookie Policy.
10. Direct Marketing and Electronic Communications
We will only send you marketing emails, text messages, or other electronic marketing communications if you have explicitly opted in to receive them from us. This is a requirement of the Privacy and Electronic Communications Regulations 2003 (PECR).
Every marketing communication we send will include a prominent and easy unsubscribe mechanism. You may withdraw your consent to receive marketing at any time by clicking the unsubscribe link in any marketing email, or contacting us at privacy@valeandmercer.co.uk
11. How We Keep Your Data Secure
We implement appropriate technical and organisational security measures as required by UK GDPR Article 32, including encryption, access controls, two-factor authentication, and secure cloud processing under Data Processing Agreements with our providers. We maintain a documented breach response procedure and will notify the ICO within 72 hours of any notifiable breach.
12. Changes to This Privacy Notice
We review this notice at least annually and whenever the law changes or our processing activities change materially. The version number and date at the top of this notice show when it was last updated. Where changes are significant, we will notify you directly by email or by a prominent notice on our website.
13. How to Complain
If you have any concerns about how Vale and Mercer Ltd handle your personal data, please contact us in the first instance:
Email: privacy@valeandmercer.co.uk
Post: Vale and Mercer Ltd, 124 City Road, London EC1V 2NX
We aim to respond to all complaints within 14 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113 (Monday to Friday, 9am–5pm)
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You also have the right to seek judicial remedy through the courts.
Vale and Mercer Ltd, Registered in England and Wales
Company Registration No: 17212434 | ICO Registration No: ZC155397
Document Reference: VM-PN-001 | Version 2.0 | May 2026