Privacy Notice

Jump to section:

1. Who We Are

Vale and Mercer Ltd is a property estate agency providing property sales, lettings, related property management services, and property deal sourcing for investors, in England.

Vale and Mercer Ltd is registered with the Information Commissioner's Office (ICO) as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We do not have a formally appointed Data Protection Officer (DPO), as we are not legally required to designate one as a small private estate agency that does not carry out large-scale systematic processing or processing of special category data. All data protection enquiries should be directed to the contact above, which is monitored by the company director.

2. What This Notice Covers and Who It Applies To

This Privacy Notice explains what personal data we collect, why we collect it, the legal basis on which we process it, how we protect it, who we share it with, how long we keep it, and what your rights are. It applies to all the following individuals:

• Vendors and sellers instructing us to market their property for sale
• Buyers and applicants registering with us to find a property to purchase
• Landlords instructing us to let or manage their property
• Tenants, residents, and guarantors applying for or occupying properties we manage
• Visitors to our website
• Anyone who contacts us by email, telephone, or contact form

A separate internal privacy notice applies to our staff and contractors.

3. The Data We Collect and Why

Our legitimate interest: We process buyer contact and preference data to match individuals to suitable properties and arrange viewings. We have assessed this against a three-part Legitimate Interests Assessment (LIA), concluding that the processing is necessary, proportionate, and does not override individual rights. You may object to this processing at any time.

3.6 Prospective Landlords and Data We Obtain From Other Sources

We identify some prospective landlords through a lead generation service, Agent Extra. The data we receive is limited to lead information and your contact details. We did not collect this data from you directly.

We use it only to contact you about our lettings services. Our lawful basis is legitimate interests, Art. 6(1)(f), supported by a documented Legitimate Interests Assessment. We tell you where we obtained your data when we first contact you. We do not send marketing emails or text messages to an individual without their consent, in line with PECR 2003. If you ask us to stop, we stop and remove your details from our contact lists. We keep only a minimal suppression record so that we do not contact you again.

When you enquire about a property on Zoopla or OnTheMarket, the portal passes your enquiry details (name, contact details and message) to us. The portal is the controller of that data under its own privacy notice. We use what we receive only to reply to you and to arrange viewings.

3.7 Investor Clients

We source investment properties for investors and, where a developer pays us an agent referral fee, introduce investors to developer schemes. We collect your name and contact details, your investment criteria (budget, areas and property type), photo ID and proof of address, and source of funds documentation. Our lawful bases are contract, for sourcing and introductions, and legal obligation under the Money Laundering Regulations 2017, for ID and source of funds checks. We share your details with a developer only to make an introduction you have asked for, and we tell you before we do.

4. How We Use Your Data: Further Detail on Legitimate Interests

Where we rely on legitimate interests as our lawful basis, we have carried out and documented a Legitimate Interests Assessment (LIA) for each activity to confirm that our interests are proportionate and do not override your rights. The activities where we rely on legitimate interests are:

• Buyer and applicant property matching: We process your contact details and preferences to identify and share suitable properties. This is a core service function that you would reasonably expect us to carry out when you register with us.
• Website enquiry responses: We process contact form data solely to respond to your specific enquiry.
• Emergency contact use: We retain your nominated emergency contact solely for genuine emergency situations during your tenancy. This data is not used for any other purpose.

You have the right to object to processing based on legitimate interests at any time. Where you object and we cannot demonstrate compelling legitimate grounds that override your interests, we will stop that processing.

5. Who We Share Your Personal Data With

We only share your personal data where necessary and with appropriate safeguards in place. We do not sell personal data to any third party.

6. International Data Transfers

Some of our suppliers operate outside the UK, including Vercel (website hosting), Google (analytics), Meta (advertising pixel) and Dropbox (Dropbox Sign). Rex Software, our CRM, hosts our data on Google Cloud Platform and uses sub-processors that may process some data in Australia and the United States. Transfers are made under Standard Contractual Clauses with the UK Addendum approved by the ICO, under the UK-US data bridge where the recipient is certified, or under other safeguards in UK GDPR Chapter V. Details are available on request.

Vercel Inc (website infrastructure): Vale and Mercer Ltd's website is built and hosted on Vercel's platform. Vercel may process technical data (including connection data and security tokens) in the United States as part of delivering the website. This transfer is made under Standard Contractual Clauses with the UK Addendum approved by the ICO. Vercel acts solely as our data processor and does not use this data for its own purposes.

Our other processors and recipients are based in the United Kingdom or process our data under the safeguards described above.

7. How Long We Keep Your Data

We apply the principle of storage limitation under UK GDPR Article 5(1)(e): we do not keep your data for longer than is necessary for the purpose it was collected, or as required by law.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data held by Vale and Mercer Ltd. We will respond to all requests within one calendar month, free of charge.

1. Right of Access (Subject Access Request)
   You may request a copy of all personal data we hold about you. We will provide this in a clear format within one calendar month. We may ask you to verify your identity before responding.
2. Right to Rectification
   If any data we hold about you is inaccurate or incomplete, you may ask us to correct it. We will update our records and notify any relevant third parties where applicable.
3. Right to Erasure ("Right to be Forgotten")
   You may request that we delete your personal data. We will comply unless we are required to retain it by law, for example, AML identity records, contract documents, or financial records, which we are legally obliged to keep.
4. Right to Restrict Processing
   You may ask us to pause our use of your personal data while a concern or dispute is being resolved. We will flag the record accordingly and suspend active processing.
5. Right to Data Portability
   Where our lawful basis is consent or contract, you may request your data in a structured, commonly used, machine-readable format (e.g. CSV or PDF).
6. Right to Object
   You have an absolute right to object to your data being used for direct marketing: we will stop immediately on receipt of your objection. You may also object to processing based on legitimate interests, and we will assess your objection and respond within one calendar month.
7. Rights Related to Automated Decision-Making
   We do not currently make any automated decisions that produce legal or similarly significant effects on you. We will update this notice if this changes.

To exercise any of these rights, please contact: privacy@valeandmercer.co.uk

If you are unsatisfied with our response, you may escalate your complaint to the ICO (see Section 13 below).

9. Cookies

Our website uses cookies. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies: Required for core website functions (e.g. security, login sessions). These do not require your consent and cannot be disabled.
• Analytics cookies (Google Analytics 4): These help us understand how visitors use our website so we can improve it. They require your prior consent, which you can give or withdraw via our cookie consent banner at any time.
• Marketing and remarketing cookies (Meta Pixel and, if activated, Google Ads): These allow us to measure our advertising and to display relevant advertisements to you when you use other websites and social media. They require your prior consent via our cookie consent banner.

You can manage and withdraw your cookie consent at any time using the cookie settings link in our website footer. Withdrawing consent will not affect the lawfulness of any processing that took place before you withdrew it.

For full details of every cookie used on this website, including names, durations, and how to withdraw consent, see our Cookie Policy.

10. Direct Marketing and Electronic Communications

We will only send you marketing emails, text messages, or other electronic marketing communications if you have explicitly opted in to receive them from us. This is a requirement of the Privacy and Electronic Communications Regulations 2003 (PECR).

Every marketing communication we send will include a prominent and easy unsubscribe mechanism. You may withdraw your consent to receive marketing at any time by:

• Clicking the unsubscribe link in any marketing email, or
• Contacting us at privacy@valeandmercer.co.uk

Withdrawal of consent for marketing does not affect any other processing we carry out on a different lawful basis (e.g. managing your tenancy under contract).

11. How We Keep Your Data Secure

We implement appropriate technical and organisational security measures as required by UK GDPR Article 32, including encryption, access controls, two-factor authentication, and secure cloud processing under Data Processing Agreements with our providers. We maintain a documented breach response procedure and will notify the ICO within 72 hours of any notifiable breach.

12. Changes to This Privacy Notice

We review this notice at least annually and whenever the law changes or our processing activities change materially. The version number and date at the top of this notice show when it was last updated. Where changes are significant, we will notify you directly by email or by a prominent notice on our website.

13. How to Complain

If you have any concerns about how Vale and Mercer Ltd handle your personal data, please contact us in the first instance:

Email: privacy@valeandmercer.co.uk
Post: Vale and Mercer Ltd, 124 City Road, London EC1V 2NX

We will acknowledge your complaint within 3 working days and aim to give you a full written response within 15 working days.

You can raise a data protection complaint with us in any way that suits you, including by email, post, telephone or through our website. We will keep you informed of progress and tell you the outcome.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

You also have the right to seek judicial remedy through the courts.

Vale and Mercer Ltd, Registered in England and Wales

Company Registration No: 17212434 | ICO Registration No: ZC155397

Document Reference: VM-PN-001 | Version 2.1 | October 2026