- Version
- 2.0 — May 2026
- Data Controller
- Maplewood Property & Investments Ltd
c/o Calder & Co, 30 Orange Street, London WC2H 7HF
Company no. 10082285 - Contact
- hello@maplewoodproperty.co.uk
+44 (0) 203 488 0224 - ICO Registration
- ZA213016
- Applies to
- Buyers, Sellers, Landlords, Tenants, Prospective Clients, Website Visitors
1. Who We Are
Maplewood Property & Investments Ltd ("we", "us", "our") is a residential estate agent and lettings agent operating from London. We are registered with the Information Commissioner's Office (ICO) under registration number ZA213016.
We are committed to protecting your personal data and processing it fairly and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For any data protection queries, please contact us at hello@maplewoodproperty.co.uk or at the address above.
2. Personal Data We Collect
The personal data we collect depends on whether you are a buyer, seller, landlord, tenant, or prospective client.
All Clients
- Full name, date of birth, and contact details (address, email, telephone)
- Identity documents (passport, driving licence) for Anti-Money Laundering (AML) purposes
- Source of funds and financial information where required by AML regulations
- Correspondence and notes from our interactions with you
Buyers & Sellers
- Details of property requirements and search criteria
- Offer and negotiation correspondence
- Solicitor and conveyancer contact details
- Mortgage broker details (where provided)
Landlords
- Property ownership and management details
- Bank account details for rent payments
- Insurance and safety certificate information
- Tax and financial information (e.g. overseas landlord status for HMRC)
Tenants
- Rental application details and references
- Credit and financial referencing information
- Right to Rent identity documents (e.g. passport, visa, share code)
- Employment and income information
- Guarantor details where applicable
- Deposit protection information
Website Visitors
- IP address and device information
- Browsing behaviour on our website (via cookies and Squarespace analytics)
- Contact form submissions and enquiry details
- Marketing preferences
3. How We Collect Your Data
- Directly from you — when you register with us, make an enquiry, complete an application, or contact us by any means
- From third-party referencing agencies — such as Homelet, Let Alliance, or similar
- From credit reference agencies — when conducting financial checks
- From property portals — Rightmove, Zoopla, OnTheMarket, and LonRes
- From solicitors, conveyancers, and mortgage brokers — as part of a property transaction
- From our website — via enquiry forms, cookie tracking, and Squarespace analytics
- From social media — Facebook and Instagram, where you interact with our pages or advertising
4. Lawful Basis for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. Depending on the context, we rely on the following:
| Lawful Basis | When We Use It | Examples |
|---|---|---|
| Contract | Processing necessary for a contract with you | Tenancy agreements, sale contracts, fee agreements |
| Legal Obligation | Processing required by law | AML checks, Right to Rent, HMRC reporting, deposit protection |
| Legitimate Interests | Processing in our or a third party's legitimate interests, balanced against your rights | Property marketing, fraud prevention, business administration, referrals to contractors |
| Consent | Where you have given clear consent | Email newsletters, marketing communications, non-essential cookies |
5. Anti-Money Laundering (AML) Obligations
As an estate and lettings agent, we are subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). We are legally required to:
- Verify the identity of clients (buyers, sellers, landlords) before or as soon as reasonably practicable after entering into a business relationship
- Screen against sanctions lists and politically exposed persons (PEPs) databases
- Carry out ongoing monitoring of business relationships
- Report suspicions of money laundering to the National Crime Agency (NCA)
We process this data on the basis of legal obligation. You are required to provide this information — failure to do so may mean we cannot act for you. AML records are retained for five years after the end of the business relationship.
6. Right to Rent Checks
Under the Immigration Act 2014, we are legally required to verify that all adults (aged 18 or over) named on or occupying a residential tenancy in England have the right to rent in the UK before a tenancy commences. This involves collecting and retaining copies of relevant identity and immigration documents, which are kept for one year after the tenancy ends.
7. Who We Share Your Data With
Referencing & Credit Agencies
We use third-party referencing agencies (such as Homelet, Let Alliance, or similar) to conduct tenant and buyer financial checks. These agencies act as independent data controllers.
Solicitors & Conveyancers
Where you are involved in a property sale or purchase, we share relevant information with your solicitor or conveyancer and the other party's legal representatives to facilitate the transaction.
Mortgage Brokers & Financial Advisers
Where you have engaged with a mortgage broker or financial adviser, we may share contact and property details as necessary.
Maintenance Contractors
For managed lettings properties, we share tenant contact details with vetted maintenance contractors for the purposes of arranging access and carrying out works.
Property Portals
Property details are published on Rightmove, Zoopla, OnTheMarket, and LonRes. These portals do not receive your personal contact data unless you enquire through them directly.
Overseas Landlords
Where a landlord is based outside the UK, we comply with HMRC's Non-Resident Landlord Scheme and may share relevant information with HMRC.
Regulatory & Government Bodies
We may disclose data to HMRC, the Home Office, the National Crime Agency, our redress scheme, deposit protection schemes (e.g. DPS, TDS, MyDeposits), and other regulators where required by law.
Squarespace
We use Squarespace to host our website and send marketing newsletters. Squarespace processes data on our behalf under a data processing agreement. Data may be transferred outside the UK under appropriate safeguards (Standard Contractual Clauses).
Social Media Platforms
We use Facebook and Instagram for property marketing and advertising. These platforms act as independent data controllers. You can manage your advertising preferences through those platforms' settings.
IT & Software Providers
We use third-party software for our CRM, accounts, and operations (including Microsoft 365 and SME Professional). These providers act as data processors under written agreements.
8. International Transfers
Some of our service providers (including Squarespace and social media platforms) may transfer personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs). You may request further information by contacting us at hello@maplewoodproperty.co.uk.
9. Your Data Protection Rights
Under UK GDPR, you have the following rights. To exercise any of them, please contact us — we will respond within one calendar month, free of charge.
| Right | What This Means |
|---|---|
| Right of Access | Request a copy of the personal data we hold about you (Subject Access Request) |
| Right to Rectification | Ask us to correct inaccurate or incomplete data |
| Right to Erasure | Ask us to delete your data where there is no compelling reason to continue holding it (subject to legal obligations) |
| Right to Restrict Processing | Ask us to limit how we use your data in certain circumstances |
| Right to Data Portability | Receive your data in a structured, commonly used format where processing is based on consent or contract |
| Right to Object | Object to processing based on legitimate interests or for direct marketing |
| Right to Withdraw Consent | Where we rely on consent, withdraw it at any time without affecting prior processing |
To exercise any of these rights, contact us at:
hello@maplewoodproperty.co.uk | +44 (0) 203 488 0224
Maplewood Property & Investments Ltd, c/o Calder & Co, 30 Orange Street, London WC2H 7HF
10. Marketing Communications
Where you have opted in, we may send you property updates, market reports, and newsletters by email via Squarespace. You can unsubscribe at any time by clicking the unsubscribe link in any email, or by emailing hello@maplewoodproperty.co.uk with 'REMOVE' in the subject line.
We also run targeted advertising on Facebook and Instagram. You can manage your advertising preferences through those platforms' settings. We will not share your contact details with any third party for their own marketing purposes.
11. How We Store & Retain Your Data
We take appropriate technical and organisational measures to protect your personal data, including password-protected and encrypted systems, restricted access on a need-to-know basis, and secure disposal of paper records.
We retain data only as long as necessary. Key retention periods are set out below:
| Category of Data | Retention Period |
|---|---|
| AML records (identity documents, sanctions & PEPs screening) | 5 years after end of business relationship (legally required) |
| Right to Rent documents | 1 year after tenancy ends (legally required) |
| Tenancy agreements & sales records | 7 years after completion or tenancy end |
| Credit & financial referencing | 1 year if tenancy proceeds; 6 months if not |
| Employee HR records | 7 years after employment ends |
| Marketing contact lists | Until unsubscribe, then 1 year |
| Website analytics & cookies | Up to 2 years |
| Complaints & dispute records | 7 years |
After the relevant retention period, data is securely deleted or anonymised. A full Data Retention Schedule is available on request.
12. Cookies
Our website uses cookies — small text files placed on your device to help the site function and to collect analytics data. We use the following types:
- Strictly necessary cookies — essential for the website to function (e.g. session cookies)
- Analytics cookies — to understand how visitors use our site (via Squarespace Analytics)
- Advertising cookies — to show relevant advertising on other platforms (e.g. Facebook Pixel)
Non-essential cookies are only set with your consent, which you can manage via our cookie banner. You can also adjust or remove cookies at any time through your browser settings. For more information, visit www.allaboutcookies.org.
13. Links to Other Websites
Our website contains links to other websites. This privacy policy applies only to our website. If you follow a link to another site, please read their privacy policy.
14. Data Breaches
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where appropriate, inform you directly.
15. Changes to This Privacy Policy
We keep this policy under regular review. Any updates will be published on this page. This policy was last updated on the 4th May 2026.
16. How to Contact Us
If you have any questions about this policy or how we handle your personal data:
- hello@maplewoodproperty.co.uk
- Phone
- +44 (0) 203 488 0224
- Post
- Maplewood Property & Investments Ltd
c/o Calder & Co, 30 Orange Street, London WC2H 7HF - ICO
- If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk or call 0303 123 1113
Version 2.0 — May 2026 — Maplewood Property & Investments Ltd — ICO Reg. ZA213016
This policy is reviewed at least annually or whenever there is a material change to business operations or legislation.