Privacy Notice

1. About this Privacy Notice

Jeffrey Ross Limited ("Jeffrey Ross", "we", "us" or "our") is an estate and lettings agency operating across Cardiff, the Vale of Glamorgan and surrounding areas, including Pontcanna, Penylan, Llanishen, Penarth and Caerphilly.

This Privacy Notice explains how we collect, use, store and share personal information about individuals who interact with us, including people who:

• sell or are considering selling a property;
• buy or are considering buying a property;
• let or are considering letting a property;
• rent or are considering renting a property;
• act as guarantors;
• contact us with enquiries;
• use our website;
• subscribe to our mailing lists;
• provide services to us;
• communicate with us through social media; or
• appear on our CCTV systems.

It also explains your rights in relation to your personal information and how you can exercise those rights or make a complaint.

This Privacy Notice should be read together with any other privacy information we provide to you at the point at which we collect your personal information, including application forms, referencing information, CCTV notices and cookie notices.

We may update this Privacy Notice from time to time. The version published on our website will be the current version.

2. Who are we?

For the purposes of applicable data protection legislation, Jeffrey Ross Limited is generally the data controller of the personal information described in this Privacy Notice.

Our contact details are:

Jeffrey Ross Limited

11-13 Penhill Road, Cardiff, CF11 9PQ

Email: info@jeffreyross.co.uk

Telephone: 029 2049 9680

We have appointed Laura Geach as our Data Privacy Manager.

If you have questions about this Privacy Notice or how we use your personal information, you can contact our Data Privacy Manager using the contact details above.

Unless we specifically state otherwise, our Data Privacy Manager is not a statutory Data Protection Officer.

3. The data protection law we follow

We will comply with applicable UK data protection and privacy legislation, including:

• the UK General Data Protection Regulation ("UK GDPR");
• the Data Protection Act 2018;
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR");
• the Data (Use and Access) Act 2025, insofar as applicable; and
• other legislation and regulatory requirements applicable to our business and the processing we carry out.

We will process personal information in accordance with the applicable data protection principles, including requirements relating to lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

4. What personal information do we collect?

The information we collect depends on our relationship with you and the services we provide.

It may include:

• name and title;
• postal address;
• email address;
• telephone number;
• date of birth;
• identification documents;
• proof of address;
• financial and affordability information;
• bank and payment details;
• employment information;
• income and benefits information;
• references;
• previous landlord information;
• credit-reference information;
• information about property ownership;
• property details;
• property-search preferences;
• information about household members where relevant;
• information about pets or smoking where relevant to a particular property or tenancy;
• information required for anti-money-laundering checks;
• information concerning your interaction with our website;
• CCTV images;
• correspondence and records of enquiries or complaints; and
• information you provide through social-media platforms.

We will only collect information that is relevant and reasonably necessary for the purposes for which we use it.

5. Where do we get personal information from?

We may obtain personal information:

• directly from you;
• from another person acting on your behalf;
• from a joint purchaser, vendor, landlord, contract-holder or guarantor;
• from property portals such as Rightmove or Zoopla;
• from referees, previous landlords or employers;
• from credit-reference agencies;
• from referencing providers;
• from contractors and professional advisers;
• from public sources, where appropriate;
• from local authorities, regulators or other public bodies where lawful;
• from our website and related technologies;
• from social-media platforms; and
• through CCTV.

Where we obtain information about you from another source, we will provide the privacy information required by law, including information about the categories of information obtained and its source, unless a lawful exception applies.

6. Our lawful bases for using personal information

We must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on one or more of the following:

Contract or steps before entering into a contract

We may need to use your information to take steps at your request before entering into a contract or to perform a contract with you.

For example, this may apply when:

• marketing your property;
• progressing a sale or letting;
• administering a tenancy or occupation contract;
• arranging payments;
• communicating with you about services you have requested; or
• providing services you have contracted us to provide.

Legal obligation

We may use your personal information where necessary to comply with a legal or regulatory obligation.

Examples include:

• anti-money-laundering requirements;
• accounting and tax requirements;
• responding to lawful requests from regulators or law-enforcement bodies;
• complying with court orders; and
• other legal obligations applicable to our business.

Legitimate interests

We may use personal information where it is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and managing our estate and lettings business;
• providing effective services to vendors, landlords, purchasers and contract-holders;
• managing property transactions;
• maintaining accurate records;
• communicating with customers and prospective customers;
• preventing fraud and crime;
• maintaining IT and information security;
• managing complaints;
• enforcing or defending legal rights;
• managing suppliers;
• improving our services and website; and
• marketing our services where permitted by law.

Where we rely on legitimate interests, we will consider the impact of the processing on individuals and whether our interests are appropriately balanced against their rights and freedoms.

Consent

We will rely on consent where consent is the appropriate lawful basis.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Consent will not be used where another lawful basis is more appropriate.

7. Vendors

Information we may collect

If you instruct us to market your property, we may collect:

• your name;
• property address;
• contact details;
• identification documents;
• proof of address;
• information concerning ownership of the property;
• information required for anti-money-laundering checks; and
• other information reasonably required to provide our services.

How we obtain it

Normally, you provide this information directly to us.

Why we use it

We may use your information to:

• market your property;
• communicate with you about the marketing and sale;
• arrange viewings and offers;
• progress the transaction;
• prepare and circulate transaction documentation;
• provide relevant information to the purchaser and the purchaser's conveyancer;
• comply with legal and regulatory obligations;
• prevent fraud and money laundering;
• maintain business records;
• administer our relationship with you; and
• establish, exercise or defend legal claims.

Your name and address may appear on transaction documents, including a memorandum of sale, where necessary to facilitate the transaction.

Lawful bases

Depending on the purpose, we may rely on:

• performance of a contract or taking steps before entering into a contract;
• legal obligation;
• legitimate interests; and
• where applicable, establishment, exercise or defence of legal claims.

Retention

We retain transaction records for as long as reasonably necessary for the purposes for which they are held, taking account of contractual, legal, regulatory, tax, accounting and limitation-period requirements.

Where a particular statutory retention period applies, we will retain the information for that period.

8. Landlords

Information we may collect

We may collect:

• name;
• address;
• email address;
• telephone number;
• bank and payment details;
• photographic identification;
• proof of address;
• Rent Smart Wales registration and licence information, where applicable;
• deposit-related information;
• property information;
• information required for anti-money-laundering checks; and
• other information required to provide our services.

How we use it

We may use your information to:

• market and let your property;
• communicate with you about your property;
• administer a tenancy or occupation contract;
• manage rent and other payments;
• communicate with tenants and contractors;
• arrange repairs and maintenance;
• provide relevant information to utility providers and local authorities;
• comply with Rent Smart Wales and other applicable legal and regulatory requirements;
• comply with anti-money-laundering requirements;
• make payments to you;
• maintain business records; and
• establish, exercise or defend legal claims.

Where necessary, your name and address may appear on a tenancy or occupation contract and may be provided to the relevant tenant or contract-holder.

Where we are not managing your property, we may provide your relevant contact details to the tenant or contract-holder so that they can contact you and, where appropriate, make payments directly to you.

Lawful bases

Depending on the purpose, we may rely on:

• performance of a contract;
• legal obligation;
• legitimate interests; and
• establishment, exercise or defence of legal claims.

Retention

We retain landlord and property-management records for as long as reasonably necessary, taking account of contractual, legal, regulatory, tax, accounting and limitation-period requirements.

Bank details will be retained only for as long as reasonably necessary for payment, accounting, fraud-prevention, legal or regulatory purposes.

9. Purchasers

Information we may collect

We may collect:

• name;
• address;
• email address;
• telephone number;
• identification documents;
• proof of address;
• information concerning your proposed funding;
• mortgage or cash-buyer information;
• gift-funding information;
• identification and proof-of-address information concerning a person providing gifted funds; and
• information required for anti-money-laundering and fraud-prevention checks.

Why we use it

We may use this information to:

• communicate with you about properties;
• arrange viewings and offers;
• assess and record information concerning your ability to proceed with a transaction;
• comply with anti-money-laundering requirements;
• prepare transaction documentation;
• provide relevant information to the vendor and the vendor's conveyancer;
• administer the transaction;
• maintain business records; and
• establish, exercise or defend legal claims.

Your name and address may be included in a memorandum of sale and provided to the vendor and relevant conveyancers where necessary to progress the transaction.

Lawful bases

We may rely on:

• legitimate interests;
• taking steps at your request before entering into a contract;
• legal obligation; and
• establishment, exercise or defence of legal claims.

10. Contract-holders and prospective contract-holders

For properties in Wales, we use the term "contract-holder" where applicable under the Renting Homes (Wales) framework.

Information we may collect

Depending on the circumstances, we may collect:

• name;
• address;
• email address;
• telephone number;
• date of birth;
• employment information;
• employer details;
• income and affordability information;
• benefits information where relevant;
• previous landlord details;
• references;
• credit-reference information;
• bank details where required for payments;
• photographic identification;
• information concerning immigration or other legal requirements where applicable;
• information concerning pets or smoking where relevant to the property and lawful property requirements; and
• other information reasonably required for referencing and administration.

We will review the information we request to ensure that it is relevant and necessary for the particular purpose.

We will not collect information simply because it appears on a standard referencing form where there is no appropriate purpose for collecting it.

Sources

Information may be provided:

• by you;
• by a guarantor or other person involved in your application;
• by referees;
• by previous landlords;
• by employers;
• by credit-reference agencies;
• by referencing providers; and
• by other lawful sources relevant to the application.

Why we use it

We may use your information to:

• communicate with you;
• process a rental application;
• obtain references;
• carry out credit and affordability checks;
• assess whether you meet the landlord's lawful and proportionate requirements;
• administer an occupation contract;
• manage the property;
• arrange repairs and maintenance;
• communicate with contractors;
• provide relevant information to utility providers and local authorities;
• communicate with the landlord or managing agent where necessary;
• make payments to you;
• comply with legal and regulatory requirements;
• prevent fraud and money laundering;
• maintain records; and
• establish, exercise or defend legal claims.

Information concerning benefits, employment, household circumstances or other financial information will not be used to unlawfully discriminate against applicants.

Lawful bases

Depending on the purpose, we may rely on:

• taking steps at your request before entering into an occupation contract;
• legitimate interests;
• performance of a contract;
• legal obligation; and
• establishment, exercise or defence of legal claims.

Where special-category or criminal-offence data is processed, we will only do so where an additional lawful condition required by law applies.

11. Guarantors

Information we may collect

We may collect:

• name;
• address;
• email address;
• telephone number;
• date of birth;
• employment information;
• employer details;
• income and affordability information;
• references;
• credit-reference information; and
• other information reasonably required to assess your ability to act as guarantor.

Sources

Information may come from:

• you;
• the proposed contract-holder;
• referees;
• previous landlords;
• employers;
• credit-reference agencies; and
• referencing providers.

Why we use it

We use this information to:

• assess your suitability and financial ability to act as guarantor;
• obtain references;
• carry out credit and affordability checks;
• communicate with you and the landlord;
• administer the proposed guarantee and occupation contract;
• comply with legal obligations; and
• establish, exercise or defend legal claims.

Lawful bases

We may rely on legitimate interests, steps taken at your request before entering into a contract, legal obligation and/or establishment, exercise or defence of legal claims, depending on the processing.

12. People who contact us with enquiries

Information we may collect

We may collect:

• name;
• telephone number;
• email address;
• postal address;
• property details;
• property-search requirements;
• details of your enquiry; and
• correspondence with you.

Sources

Information may be provided directly by you or by a third-party property portal through which you contact us, such as Rightmove or Zoopla.

Why we use it

We use this information to:

• respond to your enquiry;
• provide information about properties and services you have requested;
• arrange viewings;
• administer the enquiry;
• maintain appropriate business records; and
• where permitted by law, communicate relevant marketing.

An enquiry will not automatically result in your details being added to our marketing database unless we have a lawful basis to do so.

Lawful bases

Depending on the circumstances, we may rely on:

• taking steps at your request before entering into a contract;
• legitimate interests; and
• consent, where we specifically request and rely on it.

Retention

We retain enquiry information only for as long as reasonably necessary for the relevant enquiry and associated legal, business or regulatory purposes.

13. Website users and cookies

Our website may use cookies and similar technologies.

Some technologies are necessary for the website to operate, maintain security or provide a service you have requested.

Other technologies, including analytics or advertising technologies, may require your consent under PECR.

Where we use Google Analytics or other non-essential analytics technologies, we will configure and deploy them in accordance with applicable law and our cookie preferences.

Our cookie notice will explain:

• which cookies and similar technologies we use;
• what they do;
• why we use them;
• how long they remain active; and
• how you can accept, reject or change your preferences.

Where consent is required, we will not place or access non-essential cookies or similar technologies before obtaining valid consent.

Our use of cookies and similar technologies is subject to our separate Cookie Notice.

14. Mailing lists and direct marketing

We may use personal information to send information about:

• properties that may be relevant to your stated requirements;
• our estate and lettings services;
• market updates;
• services and events; and
• other products or services where permitted by law.

Direct marketing is subject to both data protection legislation and PECR.

Electronic marketing

We will only send direct marketing by email, text message or other electronic means where permitted by PECR and the UK GDPR.

This may include obtaining your consent or, where all applicable requirements are satisfied, relying on the existing-customer "soft opt-in".

We will not assume that simply providing an email address or telephone number amounts to consent to marketing.

Every electronic marketing message will provide an appropriate means of opting out.

Telephone marketing

We will comply with applicable PECR requirements when making direct marketing calls, including requirements concerning telephone preference services and any consent requirements that apply.

Postal marketing

We may send postal marketing where we have a lawful basis to do so.

For example, we may contact homeowners whose properties are being marketed by another agent where we consider that we have a legitimate interest in promoting our services.

Where we obtain personal information from another source for marketing, we will comply with the applicable transparency requirements.

Your right to object

You have an absolute right to object to the use of your personal information for direct marketing.

If you object to direct marketing, we will stop using your information for that purpose, subject to retaining limited information where necessary to ensure that we respect your marketing preference.

You can unsubscribe at any time by:

• using the unsubscribe facility in an electronic marketing message;
• contacting us at info@jeffreyross.co.uk; or
• contacting us using the details in section 25.

15. Profiling and automated decision-making

We may use profiling or automated processing as part of services provided by third-party referencing or credit-reference providers.

For example, a third-party provider may use automated processes to assess creditworthiness or affordability.

We do not currently intend to make decisions about individuals solely by automated means where the decision has a legal or similarly significant effect.

Where we use a third party that carries out automated decision-making or profiling, we will take reasonable steps to understand the nature and effect of that processing and will provide the information and safeguards required by applicable law.

Where the law gives you rights in relation to a significant solely automated decision, these may include rights to:

• receive information about the decision and the processing involved;
• make representations;
• obtain human intervention;
• challenge the decision; and
• exercise other applicable data protection rights.

The precise safeguards depend on the nature and legal basis of the automated processing.

16. Credit reference and affordability checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority

FCA Firm Reference Number: 742313

• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority

FCA Firm Reference Number: 737740

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

• Creditsafe Privacy / Transparency Notice:

Transparency Notice | Customers & Suppliers

• TransUnion Bureau Privacy Notice:

https://www.transunion.co.uk/legal/privacy-centre/pc-bureau

17. Who do we share personal information with?

We do not sell your personal information.

We may share personal information where necessary, lawful and proportionate, including with the following categories of recipients.

Vendors, purchasers, landlords and contract-holders

In property transactions it may be necessary to share relevant information between the parties.

For example:

• purchaser information may be provided to a vendor;
• vendor information may be provided to a purchaser;
• contract-holder information may be provided to a landlord or managing agent; and
• landlord information may be provided to a contract-holder where necessary.

The information shared will be limited to what is reasonably necessary for the relevant purpose.

Conveyancers and solicitors

We may share relevant transaction information with solicitors, conveyancers and other professional representatives involved in a transaction.

Referencing and credit-reference providers

We may share applicant and guarantor information with appropriate referencing and credit-reference providers to obtain references and assess creditworthiness or affordability.

These organisations may act as independent controllers for some of their processing. Their own privacy information may therefore also apply.

Contractors

We may provide relevant tenant or contract-holder information to contractors carrying out repairs, inspections, maintenance or other property services.

Utility providers and local authorities

We may share relevant information with utility providers and local authorities where necessary to facilitate the provision and billing of services or to comply with legal requirements.

Regulatory and public authorities

We may share information with:

• HMRC;
• Rent Smart Wales;
• local authorities;
• law-enforcement bodies;
• regulators;
• courts and tribunals; and
• other public authorities,

where required or permitted by law.

Professional advisers

We may share information with lawyers, accountants, insurers and other professional advisers where necessary to obtain professional advice, manage our business or establish, exercise or defend legal claims.

Technology and service providers

We use suppliers that provide services such as:

• CRM and property-management systems;
• cloud storage;
• email and communications;
• website hosting;
• IT support;
• cybersecurity;
• data backup;
• analytics;
• payment processing;
• referencing; and
• document management.

Where a supplier processes personal information on our behalf, we will put appropriate contractual requirements in place.

Where a supplier is an independent controller, it will be responsible for its own processing in accordance with applicable law.

18. Business transfers

If we sell, transfer, restructure or merge all or part of our business or assets, personal information may need to be disclosed to prospective purchasers, investors, professional advisers or other parties involved in the transaction.

Where this occurs, we will take appropriate steps to protect personal information and ensure that any subsequent processing is lawful.

19. International transfers

Some of our service providers may process personal information outside the United Kingdom.

Before making a restricted international transfer, we will ensure that the transfer is covered by an applicable UK adequacy regulation, appropriate safeguards or a lawful exception.

Where appropriate safeguards are required, these may include the ICO's International Data Transfer Agreement (IDTA) or International Data Transfer Addendum, together with the required assessment of the level of protection available following the transfer.

Where appropriate, we will provide further information about relevant international transfers and safeguards on request.

The fact that another party to a property transaction lives outside the UK does not, by itself, determine whether a restricted international transfer has taken place. We will assess international data flows in accordance with the applicable UK transfer rules.

20. CCTV

We operate CCTV at certain premises for security and safety purposes.

Information collected

CCTV may capture images of individuals entering, leaving or moving around our premises and surrounding areas covered by the cameras.

Purposes

We use CCTV to:

• protect staff, visitors and members of the public;
• protect buildings and property;
• prevent and detect crime;
• investigate incidents;
• assist law-enforcement bodies where appropriate;
• support the establishment, exercise or defence of legal claims; and
• investigate health and safety incidents.

Lawful basis

Our primary lawful basis for ordinary CCTV processing is our legitimate interests in protecting people and property, preventing and detecting crime and managing the security of our premises.

CCTV footage is not automatically special-category personal data.

If CCTV processing involves special-category data, biometric identification or criminal-offence data, we will ensure that any additional legal requirements are satisfied before carrying out that processing.

Retention

Our normal CCTV retention period is 30 days, unless footage needs to be retained for a longer period because of an incident, investigation, legal claim, law-enforcement request or other legitimate and lawful reason.

Where footage is retained beyond the normal period, we will keep it only for as long as reasonably necessary.

Disclosure

CCTV footage may be disclosed to:

• the police;
• law-enforcement bodies;
• courts or tribunals;
• insurers;
• legal advisers;
• other authorised persons where there is a lawful basis for disclosure; and
• individuals exercising applicable data protection rights.

Access to CCTV footage will be restricted to authorised personnel.

21. Social media

If you communicate with us through a social-media platform, the platform operator may process your personal information independently of us.

You should review the privacy notice and terms of the relevant platform.

Where you send us a private message or otherwise provide personal information directly to us through social media, we may use that information to respond to you, administer your enquiry, maintain appropriate records and, where lawful, provide our services.

Public comments or posts may be visible to other users in accordance with the settings and operation of the relevant platform.

22. Security

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include:

• access controls;
• password and authentication controls;
• staff training;
• secure systems and software;
• backups;
• physical security;
• supplier due diligence;
• contractual confidentiality and security requirements; and
• procedures for responding to suspected personal-data breaches.

No method of transmitting or storing information is completely secure. We will nevertheless take reasonable and appropriate steps to protect the information we hold.

If you receive a suspicious communication purporting to be from us, particularly one asking you to provide or transfer bank details, you should contact us using a trusted telephone number or email address before taking any action.

23. How long do we keep personal information?

We do not retain personal information indefinitely.

We determine retention periods by considering:

• the purpose for which the information was collected;
• whether the purpose continues;
• contractual requirements;
• statutory and regulatory retention periods;
• tax and accounting requirements;
• limitation periods for potential legal claims;
• the risk of fraud or disputes;
• the nature and sensitivity of the information; and
• whether the information can be securely deleted or anonymised.

Different types of information may therefore be retained for different periods.

For example:

Anti-money-laundering records

Where AML legislation prescribes a retention period, we will comply with that requirement.

Property transaction records

Sales, lettings and property-management records may be retained for an appropriate period after completion of the relevant transaction to deal with contractual, legal, regulatory, tax, accounting and potential claims-related matters.

Marketing information

Marketing information will generally be retained while we have a lawful basis to continue marketing to you, subject to periodic review.

Where you opt out, we may retain limited suppression information so that we do not inadvertently send you further marketing.

CCTV

Our normal CCTV retention period is 30 days, subject to the exceptions described above.

Enquiries

Enquiry information will normally be deleted when it is no longer reasonably required for the enquiry, related transaction, legal, regulatory or legitimate business purposes.

Where there is no fixed statutory retention period, we will periodically review whether information remains necessary.

24. Your data protection rights

Depending on the circumstances and the lawful basis for processing, you may have the following rights.

Right of access

You can ask us for a copy of your personal information and certain supplementary information about how we use it.

Right to rectification

You can ask us to correct inaccurate or incomplete personal information.

Right to erasure

In certain circumstances, you can ask us to delete your personal information.

This is not an absolute right. For example, we may need to retain information to comply with a legal obligation or establish, exercise or defend legal claims.

Right to restrict processing

In certain circumstances, you can ask us to restrict the processing of your personal information.

Right to data portability

In certain circumstances, you can ask us to provide personal information you have supplied to us in a structured, commonly used and machine-readable format or to transmit it to another organisation.

Right to object

You have a right to object to certain processing based on legitimate interests or other applicable grounds.

You have an absolute right to object to the processing of your personal information for direct marketing.

Rights relating to automated decision-making

Where applicable, you may have rights in relation to significant decisions based solely on automated processing.

The precise rights depend on the circumstances and the applicable legal provisions.

25. How to exercise your rights

To exercise a right, contact:

Data Privacy Manager

Jeffrey Ross Limited

11-13 Penhill Road, Cardiff, CF11 9PQ

Email: info@jeffreyross.co.uk

Telephone: 029 2049 9680

We may need to ask you for information to verify your identity and locate the relevant personal information.

We will normally respond to a valid request without undue delay and within the applicable statutory time limit.

For many individual-rights requests, this is normally one month, although the applicable legislation provides for certain circumstances in which the time period may be extended or stopped while we obtain information reasonably required to identify the information or individual concerned.

We will not normally charge for exercising your rights. We may charge a reasonable fee or refuse a request where permitted by law, for example where a request is manifestly unfounded or excessive.

26. Property alerts

If you tick the box on one of our forms asking us to email you about matching properties, we build a record of what you appear to be looking for and use it to send you property alerts.

What we hold

• your name, email address and telephone number, as you gave them to us;
• what we have worked out you are looking for — bedrooms, price range, areas and property type — from the properties you have enquired about;
• anything you have told us yourself on your preferences page, which replaces what we worked out;
• a record of the alerts we have sent you, which properties you opened from them, how long a property page was open and visible when you arrived from one of our emails, and whether you passed a property on to somebody else.

We measure this by giving each link in our alert emails its own address, which records the click and then takes you to the property. There is no tracking pixel and no cookie involved, and none of it runs for anyone who has not arrived from one of our emails — an ordinary visitor to our website is not measured this way.

If you pass a property on using the link we give you, we record that the link was opened, and that it was opened from a link you shared. We do not know who you sent it to. If you use the “Email it” button, the message is sent by your own email program from your own address — we never see the recipient and we never email them ourselves.

Our lawful basis for sending you these emails is your consent. The underlying record of your enquiry is held under our legitimate interests as an estate agent, and is separate from this.

How long we keep it

We keep your property alerts profile for 24 months from the last time you engaged with us — an enquiry, an email you opened or clicked, or a change you made to your preferences. After 24 months of no engagement we delete the profile automatically. We will email you before we do, so you can tell us to keep it.

Deleting the alerts profile does not delete the record of an enquiry you made, which we hold separately and for the reasons set out elsewhere in this notice.

Changing what we send you, or stopping it

Every alert we send carries a link to your own preferences page. From there you can see what we hold, change what you are looking for, stop the emails, or delete your alerts profile. Every alert also carries a one-click unsubscribe.

Unsubscribing stops the emails and keeps the record. Deleting removes the profile and the engagement history permanently, and adds your email address to a suppression list so that no later import or form can rebuild it. We cannot undo a deletion.

27. Withdrawing consent

Where we rely on your consent to process personal information, you may withdraw your consent at any time.

You can do this by contacting:

Email: info@jeffreyross.co.uk

Telephone: 029 2049 9680

Post: Jeffrey Ross Limited, 11-13 Penhill Road, Cardiff, CF11 9PQ

Withdrawal of consent will not affect the lawfulness of processing carried out before you withdrew your consent.

If another lawful basis applies to the processing, withdrawing consent may not require us to stop the processing.

28. Data protection complaints

We take complaints about our use of personal information seriously.

If you have concerns about how we have handled your personal information, you should first contact our Data Privacy Manager:

Data Privacy Manager

Jeffrey Ross Limited

11-13 Penhill Road, Cardiff, CF11 9PQ

Email: info@jeffreyross.co.uk

Telephone: 029 2049 9680

We will provide a clear process for making a data protection complaint.

We will acknowledge a data protection complaint within 30 days and investigate it appropriately. We will communicate the outcome to you without undue delay.

Making a complaint to us does not prevent you from complaining to the Information Commissioner's Office.

29. Complaints to the information commissioner's office

If you remain dissatisfied with our response, or if you believe that we have processed your personal information unlawfully, you can complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

The ICO's website is:

https://ico.org.uk/

The ICO's postal address is:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

The ICO can provide information about your data protection rights and investigate concerns about how organisations handle personal information.

30. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes to our business;
• changes to the personal information we process;
• changes to our technology or suppliers;
• changes to applicable legislation or regulatory guidance; or
• changes to how we use personal information.

Where we make material changes to the way we use personal information, we will take appropriate steps to bring those changes to your attention before the new processing begins where required by law.

The date at the beginning of this Privacy Notice shows when it was last updated.

31. Contact details

If you have any questions about this Privacy Notice or our use of personal information, please contact:

Jeffrey Ross Limited

11-13 Penhill Road, Cardiff, CF11 9PQ

Email: info@jeffreyross.co.uk

Telephone: 029 2049 9680

Data Privacy Manager: Laura Geach

DOCUMENT CONTROL

Document: Privacy Notice

Organisation: Jeffrey Ross Limited

Version: 2026.1

Effective date: August 2026

Review date: August 2027, or earlier if there is a material change in law, guidance, processing activities, technology or business operations.

Your cookie choice

You can accept or decline analytics cookies at any time. Declining also deletes the ones already set.