Legal
Privacy Policy
How UPBSS collects, uses and protects the personal data you give us.
Who we are
UPBSS Property Group is the controller of the personal data described in this policy. We are a company registered in Scotland, company number [SC company number], registered office [registered office address], Edinburgh.
We are registered with the Information Commissioner’s Office under number [ICO registration]. As an estate agency business we are supervised for anti-money-laundering purposes by [HMRC], and we are a member of the [redress scheme] redress scheme, membership number [number].
For any question about this policy, contact our data protection contact at customerservice@upbss.com.
The law that applies
We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. Electronic marketing, cookies and similar technologies are also governed by the Privacy and Electronic Communications Regulations 2003 — see our Cookie Policy.
Data protection is reserved to the UK Parliament and applies identically in Scotland. The Information Commissioner’s Office regulates it throughout the UK.
What we collect
We collect only what we need in order to answer your enquiry and, where relevant, to market or purchase a property.
- Identity and contact data — name, email address, telephone number and postal address
- Enquiry content — what you asked us and about which property
- Property details you enter into the appraisal tool — type, location, area, age and condition
- Transaction data — your financial position, confirmation of funds, mortgage arrangements and your solicitor’s details
- Identity verification data — where required by law, passport, driving licence, proof of address and source-of-funds evidence
- Technical data — IP address, browser type and pages visited, in aggregate
- Marketing preferences — whether you have opted in to property alerts, and any opt-out you have exercised
We do not seek special category data such as health information. If you volunteer it, we record only what is necessary and use it for no other purpose.
Why we use it, and our lawful basis
UK GDPR requires a lawful basis for each use of your data. Ours are set out below.
| Responding to your enquiry | Legitimate interests, or steps prior to entering a contract |
|---|---|
| Providing agency services | Performance of a contract |
| Identity and source-of-funds checks | Legal obligation — Money Laundering Regulations 2017 |
| Providing an indicative appraisal | Consent, or legitimate interests |
| Property alerts and marketing | Consent, or the PECR soft opt-in |
| Obligations under the Estate Agents Act 1979 | Legal obligation |
| Keeping records to answer a claim | Legitimate interests |
| Website analytics, if enabled | Consent |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You may object at any time.
Marketing
We send marketing email or SMS only where you have opted in, or where you previously enquired about a similar service and have not opted out. Every message carries a working unsubscribe link. Opting out does not stop service messages about a transaction you are actively involved in. We do not sell your personal data, and we do not share it for third-party marketing.
Who we share it with
We share data only where it is necessary:
- The other side of a transaction — the owner, or a prospective buyer or tenant
- Your solicitor, who in Scotland conducts the offer and missives process on your behalf
- The chartered surveyor preparing your Home Report, where you ask us to arrange it
- Chartered surveyors and mortgage brokers you have asked us to deal with
- Property portals on which a listing appears — published listing data is, by design, public
- Identity verification providers, for anti-money-laundering checks
- Our IT, hosting and email providers, under written data processing agreements
- Regulators, law enforcement and HMRC where we are legally required to disclose. Where a disclosure concerns a suspicion of money laundering, we may be prohibited by law from telling you it has been made
We do not sell personal data.
International transfers
We aim to keep personal data within the UK. Where a supplier stores or accesses data outside the UK, we rely on UK adequacy regulations for the destination country, or on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
How long we keep it
| Enquiries not leading to a transaction | 24 months from last contact |
|---|---|
| Appraisal submissions (non-clients) | 24 months |
| Client and transaction records | 5 years from settlement or termination |
| Home Report correspondence | 5 years |
| Anti-money-laundering records | 5 years from the end of the relationship |
| Marketing opt-outs | Kept indefinitely so we do not re-contact you |
| Accounting records | 6 years, per HMRC requirements |
The five-year figure reflects the short negative prescription under the Prescription and Limitation (Scotland) Act 1973. This differs from England and Wales, where the equivalent period is six years, so an English retention schedule should not simply be copied across.
Your rights
Under UK GDPR you have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to erasure, to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent. An objection to direct marketing is absolute.
Erasure does not override our legal duty to retain anti-money-laundering records. To exercise any right, email customerservice@upbss.com and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive, and we may ask you to verify your identity first.
The instant appraisal produces a figure automatically, but it makes no decision about you and has no legal or similarly significant effect. Every appraisal is reviewed by a person before it is acted on.
Security and complaints
Data is transmitted over TLS and stored on access-controlled systems, with access limited to staff who need it for their role. We keep a record of personal data breaches and, where a breach is likely to risk your rights, we report it to the ICO within 72 hours and tell you where the risk is high.
Please raise any concern with us first — see our complaints procedure. If you remain dissatisfied you may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, or at ico.org.uk/make-a-complaint. Complaining to the ICO does not affect your right to seek a remedy through the courts.
Questions about this document? Email customerservice@upbss.com or write to UPBSS Property Group, [registered office address], Edinburgh.