Privacy Policy

1. Who we are

M & K Estates and Consultancy ("M & K", "we", "us") is an estate agency based at 303 Purley Way, Croydon, CR0 4NU. We are the data controller for the personal information described in this notice. You can contact us about data protection by email at info@mkestatesandconsultancy.co.uk, by telephone on 07935 573 405, or by post at the address above.

2. The data we collect

Depending on how you use our services we may collect:

Contact details — name, email address, telephone number, postal address and your preferred method of contact.
Property information — the address, type, style, size, condition, parking and outside space of a property you ask us to value, sell, let or manage, together with the year purchased and your own estimate of value if you provide one.
Transaction information — offers, tenancy terms, rent and deposit records, inventory and inspection reports, and correspondence relating to a sale, letting or management instruction.
Identity and referencing information — for buyers, sellers, tenants and guarantors: photo identification, proof of address, Right to Rent evidence, employment and income details, credit checks and previous landlord references. These are collected only where the law or the transaction requires them.
Enquiry details — anything you include in a website form, email, WhatsApp message or telephone call.
Technical data — limited information about how you use this website, as described in section 9.

3. How we use your data

To respond to enquiries and arrange valuations, viewings and appointments.
To market properties for sale or to let, including on portals such as Zoopla and on our own website and social channels.
To reference prospective tenants and guarantors and to carry out Right to Rent checks required by law.
To carry out anti-money-laundering (AML) checks on buyers and sellers as required by the Money Laundering Regulations.
To administer tenancies, collect rent, protect deposits, arrange maintenance and prepare statements for landlords.
To manage guaranteed rent agreements and supported living or serviced accommodation arrangements.
To deliver remodelling and maintenance services and obtain quotations from contractors.
To keep records required by law, our redress scheme and our insurers, and to deal with complaints.
To tell you about our services where you have asked us to or would reasonably expect us to. You can opt out at any time.
To send our newsletter — occasional property news and market updates — only if you sign up and then confirm your address using the link we email you. Every newsletter includes a one-click unsubscribe link.
To email you a confirmation when you send us an enquiry, request a valuation or viewing, or register with us, so you have a record and a reference number.

4. Lawful basis

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 we rely on one or more of the following bases:

Contract — where processing is necessary to provide the service you have asked for, such as marketing your property or setting up a tenancy.
Legal obligation — for Right to Rent checks, AML checks, deposit protection, licensing and record keeping.
Legitimate interests — to run our business efficiently, respond to enquiries, prevent fraud and improve our website, provided your interests and rights are not overridden.
Consent — for marketing communications where required, which you may withdraw at any time.

We share personal data only where necessary and with appropriate safeguards, including with:

Property portals and marketing platforms (for example Zoopla) — property details and photographs only.
Referencing, credit-check and identity-verification providers.
Government-approved tenancy deposit protection schemes.
Solicitors, conveyancers, mortgage brokers, surveyors and other professionals involved in a transaction.
Contractors and tradespeople carrying out maintenance or remodelling work, limited to the details they need to access the property.
Landlords, tenants, buyers and sellers who are the other party to your transaction, to the extent necessary to progress it.
Supported living providers or accommodation operators where you have asked us to introduce your property to them.
Our website hosting and database provider (Vercel and Supabase), which store website enquiries, customer accounts and records on our behalf under a data-processing agreement.
Our email delivery provider (Resend), which sends enquiry confirmations, account emails, notifications and our newsletter on our behalf, and tells us when an email bounces or is marked as spam so we stop writing to that address.
Regulators, local authorities, our redress scheme, insurers and the courts where required by law.

We do not sell personal data. Where a provider processes data outside the UK we ensure an adequate level of protection through approved contractual safeguards.

6. How long we keep data

Enquiries that do not lead to an instruction: up to 12 months.
Sales files: six years after completion, in line with our legal and regulatory obligations.
Tenancy and management files: six years after the tenancy or agreement ends.
AML records: five years after the end of the business relationship, as required by the regulations.
Financial records: six years after the end of the relevant tax year.
Newsletter subscriptions: until you unsubscribe. We keep a record of your consent while you are subscribed, and a record that you have unsubscribed so that we never email you again by mistake.
Emails we send: the content is kept for up to 30 days so a message can be re-sent if delivery fails; a delivery log (recipient, subject, date and outcome) is kept for 12 months.

7. Security

We take appropriate technical and organisational measures to protect your data, including password-protected systems, restricted access on a need-to-know basis, secure disposal of paper records and encryption of website traffic. This website is served over HTTPS. Enquiries, account details and portal records are held in an access-controlled database in which every record is protected by row-level security, so customers, landlords and tenants can only see their own information and staff access is limited by role and permission. Changes to key records are logged for audit purposes. Links in our emails that act on your behalf — for example confirming or cancelling a newsletter subscription — are cryptographically signed, and the internet (IP) addresses we use to stop spam are stored only as irreversible keyed hashes.

8. Your rights

You have the right to:

Access the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to erase data, where we have no lawful reason to keep it.
Restrict or object to processing, including direct marketing.
Receive your data in a portable format.
Withdraw consent at any time where consent is the basis for processing.

To exercise any of these rights, contact us using the details in section 1. We will respond within one month. If you are unhappy with how we handle your data you may complain to the Information Commissioner's Office at ico.org.uk.

9. Cookies & analytics

This website uses only the cookies and browser storage strictly necessary for it to function. If you create an account, a secure session cookie keeps you signed in; the valuation form temporarily stores your progress in your browser's session storage so that an accidental refresh does not lose your answers, and this is cleared when you close the tab or submit the form. If we introduce analytics or marketing cookies in the future we will update this notice and, where required, ask for your consent.

10. Changes & contact

We may update this notice from time to time. The date at the top shows when it was last revised. Questions about this policy or our use of your data should be sent to info@mkestatesandconsultancy.co.uk. Our website Terms & Conditions are published separately.