1. About this policy

This Privacy Policy explains how Merco Estate (“we”, “us”, “our”) processes personal data when you visit our website, contact us, or use our services (sales, lettings, property management and introductions to mortgage advisers/solicitors). We are a data controller for this processing and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

Depending on your interaction with us, we may collect:

• Identity and contact data — name, title, address, email, telephone number.
• Property data — property address, ownership/tenancy details, preferences, budgets, viewing/valuation notes.
• Tenancy and referencing data (lettings/management) — employment and income details, previous addresses, landlord/guarantor details, Right to Rent documentation, referencing and credit check results.
• Transaction data — offer details, fees, invoices, payments, client money records.
• AML/KYC data — identity documents, verification results, source of funds/wealth information, PEP/sanctions screening results.
• Marketing preferences — your choices about receiving updates.
• Technical and usage data — IP address, device/browser information, pages viewed and interactions (see Cookies Policy).

3. How we collect data

• Directly from you — online forms, phone/email, in-branch appointments, viewings and valuations.
• Automatically — via cookies/analytics when you use our website (see Cookies Policy).
• From third parties — referencing and credit agencies, fraud prevention agencies, identity verification providers, publicly available sources (e.g., Land Registry), mortgage advisers and solicitors (where you instruct them), previous landlords/employers (with your consent where required).

4. Purposes we use your data for and lawful bases

We process personal data only where a lawful basis applies. The table below summarises typical purposes and bases:

Purpose	Examples	Lawful basis
Respond to enquiries; provide quotes	Valuations, viewing bookings, landlord service enquiries	Contract (Article 6(1)(b)) or legitimate interests (6(1)(f))
Provide sales/lettings/management services	Marketing properties, conducting viewings, tenant-find, deposit handling, maintenance coordination	Contract (6(1)(b)); legal obligation (6(1)(c)) for certain duties
Carry out AML/KYC and Right to Rent checks	Identity verification, PEP/sanctions screening, source-of-funds, Right to Rent	Legal obligation (6(1)(c)); substantial public interest where applicable
Introduce you to advisers/solicitors (on request)	Sharing your details to arrange an introduction to FCA-authorised mortgage advisers or DCD Solicitors	Consent (6(1)(a)) or legitimate interests (6(1)(f))
Manage our relationship and your account	Updates, statements, renewals, arrears management	Contract (6(1)(b)); legitimate interests (6(1)(f))
Improve our website and services	Analytics, troubleshooting, testing	Legitimate interests (6(1)(f))
Marketing communications	Property alerts, service updates	Consent (6(1)(a)); soft opt‑in (PECR) where applicable with opt‑out options

5. Special category data

We do not intentionally collect special category data. If documentation incidentally reveals such data (e.g., on ID documents), we process only what is necessary and proportionate for legal/contractual purposes. We do not use it for profiling or marketing.

6. Automated decision‑making and profiling

We do not make solely automated decisions that have legal or similarly significant effects. Basic screening (e.g., referencing scores) supports human decision‑making by landlords or us in management contexts.

7. Who we share your data with

We may share data with:

• Service providers processing data on our behalf (IT hosting, CRM, email, analytics, referencing, ID verification, payment processing).
• Prospective buyers/tenants/landlords as necessary to progress viewings and transactions (limited details and only where appropriate).
• FCA‑authorised mortgage advisers and DCD Solicitors where you ask us to introduce you (or where you consent).
• Contractors (e.g., photographers, inventory providers, trades) to deliver instructed services.
• Professional advisers (lawyers, accountants) and insurers.
• Authorities and regulators (e.g., HMRC, law enforcement, the ICO) where required by law or to exercise/defend legal claims.

Where we use processors, we require them by contract to keep your data secure and to act only on our instructions.

8. International transfers

Your data is generally processed in the UK. If any processing or storage involves a destination outside the UK, we will ensure appropriate safeguards under the UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus any additional measures recommended by the ICO.

9. Retention

We keep personal data only for as long as necessary for the purposes set out above, and to meet legal, accounting and reporting requirements. Typical retention periods are:

Data type	Typical retention
Initial enquiry data	Up to 24 months from last contact
Sales/lettings/management files	6 years from end of matter/tenancy (longer where disputes reasonably anticipated)
Client money and financial records	7 years for accounting/tax
AML/KYC records	5 years from end of relationship (unless law permits/requires longer)
Right to Rent checks	Up to 1 year after tenancy ends (or as required by law)
Marketing preferences	Retained until you withdraw consent or object

10. Marketing

We will only send you marketing where permitted by law and your preferences. You can opt out at any time by using the unsubscribe link in our emails or by contacting us at info@merco.estate.

11. Cookies and similar technologies

We use cookies to make our website work and to understand usage. For details of the cookies we use and how to change your preferences, see our Cookies Policy.

12. Your rights

Under the UK GDPR you have the following rights, subject to conditions and exemptions:

• Right of access — to obtain a copy of your personal data.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion in certain circumstances.
• Right to restriction — to limit processing in certain cases.
• Right to data portability — to receive data in a structured, commonly used and machine‑readable format.
• Right to object — to processing based on our legitimate interests or for direct marketing.
• Rights related to automated decision‑making — where applicable.

To exercise any right, email info@merco.estate. We will respond within one month (extendable by two further months for complex requests, in which case we will inform you). We may need to verify your identity.

13. Keeping your data secure

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit where practicable, staff training and supplier due diligence.

14. Third‑party links

Our website may include links to third‑party sites and services. Those sites have their own privacy policies, and we are not responsible for them.

15. Children’s data

Our services are not directed at children. We do not knowingly collect data relating to children except where necessary for a tenancy/household and only with appropriate authority.

16. Contact and complaints

Questions or concerns about privacy should be sent to info@merco.estate or by post to the address above.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF | ico.org.uk | 0303 123 1113.

17. Changes to this policy

We may update this policy from time to time. The latest version will always be available on our website. Where appropriate, we will notify you of significant changes by email or site notice.