Cardiff Estates & Lettings Ltd – Privacy Notice
Last updated: 30 September 2026
Cardiff Estates & Lettings Ltd respects your privacy and is committed to protecting your personal information.
This Privacy Notice explains how we collect, use, store and protect personal information and the rights you have in relation to your personal information.
1. Who we are
Cardiff Estates & Lettings Ltd is the data controller for the personal information we process.
Cardiff Estates & Lettings Ltd
Company number: 4977658
27 Caerphilly Road
Cardiff
South Glamorgan
CF14 4AD
For data protection enquiries, please contact:
Email: info@cardiffestatesandlettings.co.uk
Telephone: 02920 520 520
Mary Walsh has responsibility within the business for data protection matters and for dealing with data protection enquiries and requests.
2. What personal information we collect
Depending on our relationship with you and the services we provide, we may collect and process information including:
name;
postal address;
email address;
telephone numbers;
identification and verification information;
bank and payment details;
property ownership and property information;
occupation contract and tenancy information;
rental and payment information;
financial and account information;
tax and HMRC information where relevant;
correspondence and communications;
information contained in documents provided to us; and
other information necessary to provide our services or comply with our legal and regulatory obligations.
We only collect and use personal information that is relevant to the purposes for which it is processed.
3. Where we obtain personal information
We may obtain personal information:
directly from you;
from landlords, tenants, occupiers and other individuals connected with a property;
from contractors, suppliers and professional advisers;
from local authorities, government departments, HMRC and other public bodies where appropriate;
from publicly available sources where appropriate; and
from information generated through the provision of our services.
Where we obtain personal information from another source, we will provide the privacy information required by law where applicable.
4. How we use personal information
We may use personal information for purposes including:
providing letting and property management services;
managing properties and occupation contracts;
communicating with landlords, tenants, occupiers, contractors and other relevant parties;
collecting and accounting for rent and other payments;
maintaining financial, property and business records;
administering deposits and complying with deposit protection requirements;
preparing rental statements and other financial information;
dealing with HMRC and other government or regulatory bodies where necessary;
complying with legal and regulatory obligations;
dealing with enquiries and complaints;
dealing with disputes and legal claims;
obtaining professional advice where necessary;
protecting our business, property and systems;
preventing and detecting fraud or other unlawful activity; and
responding to requests made under data protection legislation.
5. Our lawful bases for using personal information
We process personal information where there is a lawful basis to do so.
Depending on the circumstances, these may include:
Contract
Where processing is necessary to enter or perform a contract with you, or to take steps at your request before entering into a contract.
Legal obligation
Where processing is necessary for us to comply with a legal or regulatory obligation.
Legitimate interests
Where processing is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and interests.
Our legitimate interests may include managing properties and business relationships, maintaining appropriate business records, communicating with customers and other relevant parties, recovering money owed, protecting our business and property, preventing fraud and dealing with disputes and legal claims.
Consent
Where we rely on your consent for a particular use of your personal information, we will explain this at the time and ask for your consent where required. Where consent is the lawful basis, you may withdraw it at any time.
6. Who we may share personal information with
Where necessary and lawful, we may share personal information with:
landlords, tenants, occupiers and other parties involved in the management of a property;
contractors, tradespeople and service providers;
deposit protection schemes;
banks and payment service providers;
accountants, auditors, insurers and professional advisers;
HMRC, local authorities and other government or regulatory bodies;
solicitors, courts, tribunals and legal representatives where necessary;
IT, software, cloud storage and other service providers who provide services to us; and
other organisations where disclosure is necessary and permitted by law.
We only share personal information where there is a lawful basis to do so and, where appropriate, only information necessary for the relevant purpose.
7. Use of software and service providers
We use electronic systems and service providers to operate our business, maintain records and provide our services. These may include email, property management, accounting, document storage, IT and security services.
Where a service provider processes personal information on our behalf, we take appropriate steps to ensure that the information is processed securely and in accordance with applicable data protection law.
8. International transfers
Some of the service providers we use may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable data protection law and that appropriate safeguards are used where required.
9. How long we keep personal information
We normally retain records for seven years after the end of the relevant service or business relationship, unless a longer period is required or permitted by law or is necessary for the establishment, exercise or defence of legal claims.
Different retention periods may apply to types of information where required by law or where there is a legitimate reason for retaining information for a different period.
When personal information is no longer required, it will be securely deleted, destroyed or otherwise disposed of where appropriate.
10. Keeping personal information secure
We take reasonable and appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Access to personal information is restricted to people who need it for legitimate business purposes.
We use appropriate security measures for electronic and paper records and take reasonable steps to ensure that personal information is kept accurate and up to date.
11. Your data protection rights
Depending on the circumstances and the lawful basis for processing, you may have rights including:
the right to be informed about how your personal information is used;
the right to request access to your personal information;
the right to request correction of inaccurate or incomplete information;
the right to request deletion of personal information in certain circumstances;
the right to request restriction of processing in certain circumstances;
the right to object to certain processing;
the right to data portability where applicable; and
the right to withdraw consent where we rely on consent as our lawful basis.
These rights are subject to certain legal conditions and exemptions.
12. Subject access requests
You have the right to request access to the personal information we hold about you, subject to the applicable legal requirements and exemptions.
Requests should be made to:
info@cardiffestatesandlettings.co.uk
You do not have to use a particular form to make a subject access request.
We will normally respond without undue delay and within one month of receiving the request, subject to the applicable data protection rules.
We do not normally charge for responding to a subject access request. A reasonable fee may only be charged, or a request refused, where permitted by applicable data protection law.
13. Automated decision-making and profiling
We do not routinely make decisions about individuals based solely on automated processing, including profiling, where those decisions have legal or similarly significant effects.
14. Complaints
If you have concerns about how we have handled your personal information, please contact us in the first instance using the details above.
You also have the right to complain to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection.
Further information about making a complaint is available from the ICO website:
https://ico.org.uk/make-a-complaint/
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, how we process personal information or changes in data protection law.
The latest version will be made available where appropriate.
Cardiff Estates & Lettings Ltd
27 Caerphilly Road
Cardiff
South Glamorgan
CF14 4AD
Email: info@cardiffestatesandlettings.co.uk
Telephone: 02920 520 520
