This is a detailed draft, not finished legal advice.
It's written against current UK data protection law — the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025 (in force in stages since February 2026) — but it still needs review by a qualified solicitor before you rely on it, particularly because this business handles enquiries touching on financially and emotionally sensitive circumstances (debt, divorce, bereavement). Every placeholder below (company details, ICO registration, retention periods) needs a real answer before this goes live.
Placeholder — insert your registered company name, company number, and registered office address here once incorporated/confirmed. For the purposes of this policy, "we," "us," and "our" means Purchase My Property, and "the site" means purchasemyproperty.co.uk. We are the data controller for the personal information described in this policy.
If you're processing personal data as a business, you're required to pay the ICO's data protection fee and appear on the public register unless a specific exemption applies — confirm this registration exists and add the registration reference here before launch.
We collect two broad categories of information: what you actively give us, and what your device shares automatically when you visit.
When you submit the enquiry form, we collect: your full name, phone number, email address, property address, property type, reason for selling, desired timeframe, an optional estimated value, and any free-text details you choose to add. Some of these fields (reason for selling, in particular) may reveal sensitive personal circumstances — such as financial difficulty, divorce or separation, bereavement, or risk of repossession. We don't treat this as "special category data" under UK GDPR Article 9 (which covers things like health, ethnicity, or religious belief specifically), but we handle it with the same care regardless, since it's information most people would consider private.
If you call us instead of using the form, we'll collect broadly the same information, given verbally.
When you visit the site, our analytics system automatically logs: the page you visited, the date and time, a truncated/hashed version of your IP address (see Section 8 — we never store your full IP address), an approximate location (city and country, worked out from your IP address using a database stored on our own server — never sent to any third party, and never precise enough to identify a specific address or device), your browser and device type, the page that referred you here (if any), and any campaign parameters in the URL (e.g. utm_source). This is aggregate, non-identifying usage data, not tied to your name or contact details unless you separately submit the enquiry form.
UK GDPR requires us to have a valid "lawful basis" for every way we use personal data. Here's ours:
We do not use your information for automated decision-making that produces legal or similarly significant effects on you without human involvement — every cash offer is reviewed and made by a person, not generated automatically from your form answers.
We share enquiry data with the following categories of recipient, and no one else, except as required by law:
We do not sell your information, and we do not share it with third parties for their own marketing purposes.
ClickUp, Inc. is based in the United States, so storing your enquiry there involves transferring your personal data outside the UK. Under the Data (Use and Access) Act 2025, transfers like this must meet a "data protection test" — broadly, that the protection your data receives isn't materially lower than it would get under UK GDPR. This is usually satisfied through a specific safeguard, such as the UK Addendum to the EU Standard Contractual Clauses, or reliance on the UK extension to the EU–US Data Privacy Framework if the recipient is certified under it.
Action needed: confirm which safeguard ClickUp's own data processing agreement relies on (check their DPA/Trust page) and name it specifically here, rather than leaving this generic.
If you've accepted cookies, the Meta Pixel (see Section 7) also transfers data to Meta Platforms, Inc. in the United States, on the same "data protection test" basis. Meta has historically participated in the EU–US Data Privacy Framework and its UK extension — action needed: confirm Meta's current certification status before this goes live, the same as the ClickUp entry above.
Placeholder retention periods — set these deliberately rather than keeping data indefinitely, and update this section to match:
Our own analytics system is built to work without cookies at all: it counts visits using a value derived from your IP address, browser, and the current date, run through a one-way hash so the original details can't be recovered — and that value changes every day, so it can't be used to build a long-term profile of you across visits.
Because this only produces aggregate statistics (how many people visited, which pages, roughly how they got here) and isn't used for advertising, it falls within the analytics exemption to the cookie consent rules introduced by the Data (Use and Access) Act 2025 — the banner on this site isn't legally required for that tracking. We show it anyway, and use it to gate the one thing on this site that does need your consent, described below.
The one cookie this site always sets, regardless of your choice, is pmp_cookie_consent, which simply remembers whether you clicked Accept or Reject, for 12 months. It doesn't identify you or track your activity — it's a strictly necessary cookie, the kind sites are allowed to set without asking. You can change your choice at any time using "Cookie Preferences" in the footer.
If you click Accept, we also load the Meta Pixel (Facebook/Instagram), which helps us measure how effective our adverts are and show relevant ads to people who've visited this site. It collects information about your visit — pages viewed, general browser and device details, and whether you submitted our enquiry form — and sends this to Meta Platforms, Inc. in the United States, where it's governed by Meta's own privacy policy, not ours. We haven't enabled Meta's "Advanced Matching" feature, which would additionally send them a hashed version of your name, email, or phone number.
If you click Reject, or don't make a choice, the Meta Pixel never loads and none of this happens. We don't currently use any other non-essential or advertising cookies. If that changes, this policy will be updated to describe them first.
The site is served entirely over HTTPS. Enquiry submissions are rate-limited and filtered for automated spam before ever reaching our team. Access to stored enquiries is limited to team members who need it to do their job. Credentials and API keys used by the site are never stored in publicly-accessible files.
Under UK GDPR, you have the right to:
To exercise any of these, contact us using the details in Section 11. We'll respond within one month, as required by law.
If you're unhappy with how we've handled your information, you also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, or by phone on 0303 123 1113. We'd appreciate the chance to put things right directly first, but you're not obliged to come to us before contacting the ICO.
This service is intended for adults (18+) with the legal capacity to sell property. We don't knowingly collect information from children.
Email: hello@purchasemyproperty.co.uk
Phone: 01234 567 890
Placeholder registered address — add here.
We may update this policy as our service, or the law, changes. Material changes will be reflected in the "last updated" date at the top of this page.
