Privacy Policy
Last updated: 22 October 2026
We respect your privacy and take our responsibility for your personal information seriously. This policy explains what information we collect, why we use it, who we share it with, how long we keep it and the choices and rights available to you.
It applies to our website and estate agency, lettings, property management and related property services, including dealings with prospective, current and former clients, applicants, buyers, sellers, landlords, tenants, occupiers, guarantors, business contacts and people acting on their behalf. Separate privacy information may apply to employees and recruitment.
You do not consent to processing simply by reading this policy or visiting our website. Where we need your consent, we ask for it separately.
1: Who is responsible for your information
Durden And Hunt Ltd, trading as Durden & Hunt, operates our branches and is the controller of personal information processed for the purposes described in this policy. This means we decide why and how that information is used.
For privacy enquiries, requests or complaints, contact:
Privacy Team, Durden & Hunt
Email: info@durdenandhunt.co.uk
Post: 309 High Road, Loughton, IG10 1AH
Our clients and independent service providers may also be controllers of information they use for their own purposes. Their privacy notices explain their responsibilities.
We handle personal information under applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended.
2: Information we collect
The information we need depends on your relationship with us. It may include:
Identity and contact information: names, addresses, email addresses, telephone numbers, dates of birth, identification documents and details of representatives or relevant business interests.
Property information: ownership and tenancy details, property requirements, valuations, offers, viewing records, photographs, videos, floor plans, inventories, inspections, maintenance requests, access arrangements and relevant information about occupiers.
Financial and transaction information: payment and bank details, rent and deposit records, source-of-funds information, income, employment, affordability information, references, guarantees and transaction documents.
Compliance information: identity and verification results, right-to-rent information where applicable, sanctions and politically exposed person screening, and records needed to meet applicable legal duties.
Communications: enquiries, emails, messages, telephone notes and call recordings, correspondence, feedback, complaints and records of instructions or agreements.
Preferences: property interests, requested services, communication choices, consents and objections.
Website information: IP address, browser and device information, account information where applicable, pages viewed and interactions with our website. Some of this information can identify you or be linked to you; it is not necessarily anonymous.
We seek to collect only what is relevant to the purpose. Please avoid sending sensitive information or documents we have not requested. When arranging photography or marketing, please tell us about personal items or information that should not be visible.
3: Where information comes from
We receive information directly when you contact us, register an enquiry, view a property, use our website, instruct us or otherwise deal with our teams.
We may also receive relevant information from:
property portals and enquiry or referral services through which you contact us;
sellers, buyers, landlords, tenants, guarantors, co-applicants and authorised representatives;
solicitors, conveyancers, mortgage advisers, other agents and people involved in a transaction;
employers, previous landlords, referees, referencing providers and identity, credit or fraud-checking services;
contractors, inventory providers, managing agents and other providers involved in a property;
public sources such as HM Land Registry, Companies House and relevant public registers; and
a business whose operations or records we lawfully acquire or take over.
Where we obtain your information indirectly, we provide applicable privacy information within the legal timescales, unless a lawful exception applies. You may contact us to ask about the source of information we hold about you.
Acquired business records: This includes relevant records received from Diggins & Co Limited in connection with our acquisition of its estate agency business. Depending on your dealings with that business, records may include contact details, enquiries and preferences, correspondence, property, transaction, tenancy, financial and compliance records. We use necessary records to manage the transition, continue relevant services, meet legal obligations and maintain appropriate records. The lawful bases, retention criteria and rights in this policy apply. Acquisition of records does not itself give us unrestricted permission to send marketing, and we assess the permissions and preferences applicable to any marketing use.
4. Why we use information and our lawful bases
We identify a lawful basis for each purpose. Different bases may apply to different uses of the same information; we do not rely on every basis for every activity.
Responding to enquiries, arranging valuations and viewings, and taking steps you request before entering a contract with us
Steps towards a contract with you; otherwise our legitimate interests in responding to enquiries and operating our property services.
Providing services under an agreement with you, administering fees and payments, and managing that agreement
Performance of our contract with you. Separate statutory record-keeping duties are covered by legal obligation.
Handling offers, progressing transactions and carrying out lettings or management activities involving people who are not parties to our contract
Our legitimate interests and those of our clients in conducting transactions, managing properties, maintaining safety, arranging repairs and communicating with relevant parties; legal obligation where an applicable law requires the activity.
Referencing and assessing suitability or affordability
Steps towards a contract where this applies to our relationship with you; otherwise our legitimate interests and those of landlords in assessing applications, protecting property and managing payment risks.
Identity, anti-money-laundering, sanctions and other statutory checks and reporting
Legal obligation where duties apply to us. Where a check is not legally required of us, we assess whether legitimate interests in preventing fraud and managing risk provide a basis.
Managing complaints, disputes, insurance matters and legal claims
Our legitimate interests in investigating concerns, establishing facts and protecting legal rights; legal obligation where applicable.
Recording business calls to maintain an accurate record of communications, check service quality and investigate complaints or disputes
Our legitimate interests in reliable records, service quality and resolving disagreements, subject to necessity, proportionality and appropriate safeguards.
Maintaining secure systems, preventing misuse, administering suppliers and improving service delivery
Our legitimate interests in running a secure, effective and accountable business. Consent is obtained where required for associated cookies or similar technologies.
Managing a business acquisition, transfer or reorganisation
Our legitimate interests in managing business continuity and necessary records, subject to the rights and reasonable expectations of affected people; contract or legal obligation where separately applicable.
Sending marketing and relevant property updates
Consent where required; otherwise legitimate interests in promoting relevant services where PECR and other applicable rules permit the contact. See section 6.
Where we rely on legitimate interests, we assess the purpose, whether the processing is necessary, and its effect on your rights and reasonable expectations. We do not rely on this basis where your interests or fundamental rights override those interests. You can ask for information about the assessment relevant to your data.
Some information is needed by law or to provide a requested service, such as identity documents for applicable checks or information needed to administer a tenancy. We will explain when information is required. Without it, we may be unable to proceed with an instruction, transaction or service. Marketing consent is not a condition of receiving our services.
5: Sensitive information and information about other people
Health, disability or accessibility information may be relevant to a property requirement, reasonable adjustment or complaint. We use special category information only where necessary, with an Article 6 lawful basis and an applicable additional condition under Article 9 of the UK GDPR. Depending on the purpose, this may be your explicit consent, necessity for legal claims, or a specific statutory substantial-public-interest condition where its requirements are met. We explain the relevant condition when collecting or using this information; a general business interest alone is insufficient.
We process criminal-offence information only where legally authorised and with the required safeguards. Where relevant checks involve biometric identification or other special category information, additional privacy information and any required consent will be provided for that processing.
Where you provide information about another person, please make sure you are entitled to share it and, where appropriate, direct them to this policy. This does not remove our own transparency obligations. Information about children or other household members is limited to what is necessary for the relevant property or service.
6: Marketing and your preferences
We may send property matches, market updates or information about our services where permitted. The rules depend on the communication channel and recipient.
For unsolicited email, text and similar electronic marketing to individuals, including sole traders and certain partnerships, we use consent or a valid soft opt-in. The products-and-services soft opt-in applies only where all legal conditions are met, including obtaining the details in the course of a sale or negotiations for a sale, marketing our own similar services, and offering a simple opt-out when collecting the details and in each subsequent message. We do not assume it applies merely because someone appears in a database or has not objected.
Different rules may permit electronic marketing to corporate subscribers without consent, but we still comply with data protection law, identify ourselves and provide an opt-out.
For live marketing calls, we respect previous objections and screen against the Telephone Preference Service and Corporate Telephone Preference Service where required. We do not call registered numbers for marketing unless the applicable rules allow it, including where the subscriber has specifically agreed to our calls. Automated marketing calls require the appropriate consent.
You have an absolute right to object to our use of your personal information for direct marketing, including related profiling. Use the unsubscribe link, tell our team or email info@durdenandhunt.co.uk. We will stop that marketing use. You may withdraw marketing consent at any time without affecting the lawfulness of earlier processing.
We keep a limited suppression record where necessary to ensure an opt-out continues to be respected. Deleting all evidence of an objection could result in unwanted contact if details are received again.
Opting out does not prevent necessary administrative communications about an enquiry, service, transaction, tenancy, complaint or legal obligation. We do not use administrative messages to bypass marketing preferences.
7: Who we share information with
We share information only where there is an appropriate purpose and lawful basis, and limit it to what is needed. Recipients may include:
parties and their representatives involved in a sale, purchase, letting or management matter, including solicitors and other agents;
landlords, tenants, guarantors and relevant property owners or managing agents;
contractors, inventory clerks, surveyors and safety or maintenance providers;
identity, anti-money-laundering, referencing, credit and fraud-prevention providers;
tenancy deposit schemes, payment providers and relevant insurers;
property portals and marketing providers when advertising a property or delivering permitted communications;
providers of CRM, hosting, document storage, communications, IT support and other business systems;
accountants, auditors, legal advisers, insurers, regulators, redress schemes, courts and public authorities where appropriate; and
advisers and prospective or actual parties to a business transfer, subject to appropriate confidentiality, access restrictions and data minimisation.
Some suppliers act as processors under our instructions and contractual controls. Others, such as solicitors, regulators and certain verification or referencing providers, may be independent controllers responsible for their own processing and privacy notices.
Our principal business platforms include Street for customer and property records, Goodlord for relevant lettings administration and services, Coadjute for relevant compliance checks, Spectre for relevant prospecting, marketing and website services, and Reapit for relevant legacy records. Their involvement depends on the service and records concerned; not every provider receives every person's information. We also use communications, hosting and support providers within the categories above.
Property advertisements may be publicly accessible and distributed through websites, portals and other agreed marketing channels. We seek to avoid publishing unnecessary personal information.
We do not sell personal contact lists for unrelated third-party marketing. If we offer a referral to another service provider, we explain the intended sharing and obtain consent where required. A request for our services does not automatically authorise unrelated marketing by other businesses.
8: Overseas processing
Some providers may store information or provide support from outside the UK. Where this involves a restricted international transfer, we use a legally recognised transfer mechanism: applicable UK adequacy regulations, or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, together with the assessments and supplementary measures required for the transfer. A statutory exception is used only where its conditions are met.
You can contact our Privacy Team for details of the countries and safeguards relevant to your information and how to obtain a copy of the applicable safeguards, subject to lawful redactions. Overseas access does not remove our obligations under UK data protection law.
9: How long we keep information
We do not keep identifiable information indefinitely simply because it may be useful. Retention depends on the purpose, the record and applicable legal requirements. We use the following criteria:
Enquiries and property requirements: whether the enquiry is active, the date and nature of the last meaningful contact, whether the requirement remains current, and whether a transaction, complaint or other justified retention need has arisen.
Sales and service records: the duration of the relationship, completion or termination date, applicable accounting duties, complaint periods and relevant legal limitation periods.
Lettings and management records: the tenancy or management period and the time needed afterwards to resolve deposits, payments, maintenance issues, complaints or claims and comply with relevant legal duties. These needs are assessed by record type, rather than retaining every document for the same period.
Identity and compliance records: the period required by the legislation applying to the particular check. Copies of identity documents are not retained merely because other transaction records remain necessary.
Marketing records: whether we retain a valid basis and relevant permission for contact, the currency of the relationship and any withdrawal or objection. Minimal suppression records are retained for as long as needed to prevent renewed unwanted marketing.
Complaints, disputes and claims: the time needed to investigate and resolve the matter and meet associated legal, insurance or regulatory requirements. A relevant preservation requirement may suspend routine deletion.
Technical and security records: the period necessary for security, troubleshooting and system administration. Cookie durations are explained in our cookie information.
Call recordings: the period needed for the purposes explained in section 12, taking account of the recording date, whether it is needed to verify an instruction or transaction, and any complaint, dispute or legal preservation requirement. A relevant recording may need to be retained longer than routine calls. Retaining a customer record does not automatically require retention of every associated recording.
At the end of the applicable period, information is securely deleted or anonymised. Where deletion from backups is not immediate, information is protected from ordinary use and removed through the applicable backup cycle. You may ask for the retention period or criteria applying to a specific record.
10: Security
We use technical and organisational measures appropriate to the information and risks, including access controls, confidentiality requirements and appropriate supplier controls. Access is limited to people who need the information for authorised purposes.
No system can be guaranteed completely secure. If a personal data breach occurs, we assess it and notify affected individuals and the ICO where legally required. Please contact us promptly if you suspect misuse or unauthorised disclosure of information held by us.
11: Cookies and website technologies
Our website is provided through Spectre Websites. Cookies and similar technologies can support website functionality, security and any enabled analytics or advertising features. The technologies used depend on the configuration of this website, rather than every feature offered by the provider. Please see our Cookie Policy (https://www.durdenandhunt.co.uk/cookie-policy) and the website's Cookie settings control for cookie information and available choices.
Where consent is required, these technologies must not be used before you have made that choice. Where a legal exception applies, we provide the required information and any applicable right to object. You can change available cookie preferences through the website controls and manage cookies through your browser. Restricting some technologies may affect functionality.
Other websites and services linked from our website have their own privacy practices. Please read their notices when using them.
12: Matching, automated tools and communications technology
We use the requirements and preferences recorded about you to help identify relevant properties and organise our communications. This may involve automated matching or grouping of contacts. You can ask us to correct the underlying information and object to its use for direct marketing.
Call recording: We record business telephone calls to maintain an accurate record of communications and instructions, check service quality and investigate complaints or disputes. This can include your voice, telephone number, call timing and information discussed. We rely on the legitimate interests described in section 4, with additional legal conditions where sensitive information is involved. Access is restricted to authorised staff and relevant service providers. Retention is assessed using the recording-specific criteria in section 9.
We provide notice when calls are recorded. If you have concerns, please tell the team or contact us by email to discuss an alternative communication method. You may request access to your personal information in a recording and exercise your other applicable rights; we may need to protect other people's information when responding.
We do not currently transcribe calls. If we introduce transcription, AI-assisted analysis or another additional use of call recordings, we will assess its purpose, lawful basis, provider arrangements, retention and privacy risks, and provide the relevant privacy information before it begins. Recording a call does not, by itself, authorise every subsequent use of its content or its use to train an AI provider's general-purpose models.
Our process includes human review before rejecting an applicant on the basis of referencing, affordability or identity-check results. Automated matching and provider-generated results support that review; they do not themselves constitute our final rejection decision. Independent providers may carry out their own automated assessments, which their privacy information should explain.
If we introduce decisions based solely on automated processing with legal or similarly significant effects, we will provide the required information about the process, its significance and likely consequences before it is used, together with applicable safeguards, including opportunities to make representations, challenge a decision and obtain human intervention.
13: Your rights
Depending on the processing and applicable legal conditions, you may:
request access to your personal information and information about its use;
request correction of inaccurate or incomplete information;
request erasure where there is no lawful reason to continue holding it;
request restriction of processing;
object to processing based on legitimate interests on grounds relating to your situation;
receive certain information in a portable format, or request its transfer, where the legal conditions apply;
withdraw consent at any time, without affecting earlier lawful processing; and
exercise applicable rights relating to significant solely automated decisions.
For direct marketing, your right to object is absolute. For other processing based on legitimate interests, we stop unless we can demonstrate compelling overriding grounds or the processing is needed for legal claims.
Contact info@durdenandhunt.co.uk or speak to our team. You do not need to use a special form or legal wording. We may request proportionate information to confirm identity or clarify a request where necessary.
We respond without undue delay and normally within one month, subject to the applicable statutory rules on timing, clarification and extensions. If an extension or restriction applies, we explain it and your options. Requests are normally free; we charge or refuse only where the law permits and explain why.
14: Questions and complaints
Please contact our Privacy Team using the details above if you have a concern. You can make a data protection complaint by email, post or through our team. We acknowledge complaints within 30 days, investigate without undue delay, keep you appropriately informed and explain the outcome.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator:
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Contacting us does not remove your right to complain to the ICO or seek a legal remedy.
15: Changes to this policy
We review this policy when our processing or legal requirements change. The date above identifies the latest version. Where a material change affects how we use your information, we provide any further notice required by law and obtain consent where required. Updating this page does not retrospectively create consent or permission for a new use of your information.