Privacy policy · iwanttobuymyfreehold.com

1. Who is responsible for your data

The data controller is Development placeholder, not a trading firm, regulated by the Solicitors Regulation Authority under SRA number 123456.

Registered office: Development placeholder address
Data protection contact: hello@iwanttobuymyfreehold.com
ICO registration: ZA123456

2. What we collect

Categories of personal data and where they come from
Category	What it includes	Where it comes from
Account	Name, email address, password (stored only as a salted hash - we never see it), time zone.	You
Security	Sign-in attempts and their outcome, IP address, browser and device description, and a record of each active session. We keep failed attempts as well as successful ones.	Automatically, when you use the site
Case	Property address, title number, lease details, your instructions and our correspondence.	You, HM Land Registry, the freeholder and their advisers
Payment	Amount, currency, date, outcome, and Stripe's own reference for the payment. We do not receive or store your card number - it is entered on Stripe's own page and never reaches us.	Stripe
Identity and AML	Full name, date of birth, address history, identity document details, and the result of checks against credit reference data, the electoral roll, and politically exposed person and sanctions lists - together with the PDF report the check produces.	You and our identity checking provider
Source of funds	Bank statements and other evidence of where your money has come from.	You

3. Why we use it, and our lawful basis

Purpose and lawful basis under Article 6 UK GDPR
What we do	Lawful basis
Give you an account and act for you on your case	Contract - Article 6(1)(b)
Take payment of our fee	Contract - Article 6(1)(b)
Verify your identity and screen for money laundering, and keep the records that follow	Legal obligation - Article 6(1)(c), to comply with the Money Laundering Regulations 2017
Keep our accounts, meet our tax obligations and satisfy our regulator and auditors	Legal obligation - Article 6(1)(c)
Keep the site secure - recording sign-in attempts, detecting brute-force attacks, and letting you see and end your own sessions	Legitimate interests - Article 6(1)(f), being the security of the service and of your confidential matter
Defend ourselves against a claim or complaint, and keep the file that allows us to	Legitimate interests - Article 6(1)(f)

Where we rely on legitimate interests we have considered whether our interest is overridden by your rights, and concluded it is not. You can ask us for that assessment.

We do not use your data for marketing, we do not profile you to make automated decisions with legal effects, and we do not sell your data to anyone.

The identity check produces an automated result, but it does not decide anything on its own: a person at this firm reviews any check that is flagged and makes the decision. You can ask for that human review at any time.

4. Special category and criminal offence data

Anti-money-laundering screening can reveal data about suspected criminal offences, and may touch on political exposure. Where we process that:

for criminal offence data, our basis is Schedule 1, Part 2, paragraph 12 of the Data Protection Act 2018 - preventing or detecting unlawful acts - under a policy document we maintain and will supply on request;
where special category data arises, we rely on Article 9(2)(f) UK GDPR, the establishment, exercise or defence of legal claims.

5. Who we share it with

We share your data only where we need to. Our processors and recipients are:

Recipients of personal data
Who	What they receive	Why
Stripe	Your name, email address, the amount and the case reference. Your card details go to Stripe directly and never through us.	To take payment. Stripe is a processor for us and a controller in its own right for fraud prevention.
Brevo (Sendinblue GmbH)	Your email address and name, and the content of the message we are sending - an address confirmation link, a password reset link, or a reply to an enquiry.	To deliver transactional email on our behalf. Brevo is a processor acting on our instructions; it does not use your address for its own marketing, and we send no marketing through it.
Our identity checking provider	Your name, date of birth, address and contact details.	To carry out the identity and anti-money-laundering checks the law requires.
Credit reference and sanctions data providers	The details above, passed on by our provider.	To confirm your identity. This is an identity search, not a credit application: it does not affect your credit score, but a record of the search appears on your file.
Surveyors, barristers and other advisers	What each needs for their part of your case.	To advise you. We tell you before instructing anyone.
HM Land Registry, HMRC, tribunals and courts	What the transaction or proceedings require.	To complete and register the purchase, and to conduct proceedings.
The freeholder and their solicitor	Your name and the details necessary to serve notice and negotiate.	Statutory enfranchisement cannot proceed without it.
The National Crime Agency	Whatever a report requires.	Where we are obliged to report a suspicion. The law may prevent us from telling you that we have done so.
Our regulator, insurers and auditors	File contents, where an inspection or claim requires it.	Regulatory compliance. They are bound by the same duty of confidentiality.

6. Transfers outside the UK

Our identity checking provider operates in the United Kingdom. Stripe processes payments through Stripe Payments Europe Limited and its group, which includes companies in the United States. Where personal data is transferred outside the UK, Stripe relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

7. How long we keep it

Retention periods
What	How long	Why
Your case file	6 years after the matter closes	To answer later queries and to defend a claim within the limitation period
Identity and anti-money-laundering records, including the check report	Five years from the end of our business relationship, then deleted	Required by regulation 40 of the Money Laundering Regulations 2017
Accounting and payment records	Six years from the end of the relevant tax year	Tax and SRA Accounts Rules
Sign-in and security logs	While your account is open, and for a period afterwards proportionate to investigating misuse	Security of the service
Your account	Until you ask us to close it, subject to the periods above	To let you use the service

The money laundering period is a maximum as well as a minimum: those records are deleted at the end of five years unless we are required to keep them for longer.

8. How we protect it

The whole site is served over HTTPS, and connections are protected by HSTS.
Passwords are stored only as salted hashes using PBKDF2-SHA512 at a high work factor. We cannot read your password, and neither can anyone who obtained our database.
Passwords are checked against a deny-list, cannot repeat your recent passwords, and cannot contain your own name or email address.
Repeated failed sign-ins lock the account for a period that lengthens with each lockout.
Every sign-in is recorded, and you can end any individual session without changing your password.
Access to your file within the firm is limited to the people who need it.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you where the risk is high.

9. Your rights

You have the right to:

Access - a copy of the personal data we hold about you;
Rectification - correction of anything inaccurate;
Erasure - deletion, where we have no continuing reason to hold it;
Restriction - to have us pause processing while a dispute is resolved;
Portability - the data you gave us, in a machine-readable form;
Objection - to processing based on legitimate interests;
Withdraw consent, where we relied on consent, without affecting what came before.

Some of these rights are limited in a solicitor's hands. We cannot delete records the money laundering regulations require us to keep, nor file material we need to defend a claim. Legal professional privilege and the prohibition on "tipping off" may also mean we cannot disclose some material in response to an access request. We will always tell you which exemption we are relying on.

To exercise a right, contact hello@iwanttobuymyfreehold.com. We respond within one month, and will tell you if we need longer because the request is complex. There is no charge unless a request is manifestly unfounded or excessive.

10. Complaining to the ICO

Please raise a concern with us first. You also have the right to complain to the Information Commissioner's Office at any time.

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Web: ico.org.uk/make-a-complaint