Privacy Notice

Castle Surveyors Limited, company number 05117824, is the controller for Leaseholderguide.com. Registered office: 2 Southwood Close, Walkford, Christchurch, BH23 5RW. Contact enquiries@leaseholderguide.com for privacy requests or complaints. This notice covers website visitors, report purchasers, people named in supplied documents and quotation applicants.

We receive your email, order quantity, payment reference and status, checkout acknowledgements, property and lease details, uploaded documents, corrections and support correspondence. PayPal processes payment credentials; the site does not request or store your PayPal password or full card number. Optional telephone, contact and building details are collected for quotation requests.

We obtain property transaction evidence from public sources, including HM Land Registry. Documents you provide may identify landlords, leaseholders or other people. Technical information includes request times, security and audit events, and network information processed by our hosting and payment providers. Application rate limits use derived identifiers to reduce direct exposure of network addresses.

Provide only necessary information. Remove unrelated signatures, bank details, identity documents, health information and other sensitive content before uploading. Where you provide someone else’s details, ensure you have authority or another lawful basis and, where appropriate, direct them to this notice.

Contract and steps requested before a contract: taking and verifying payment, providing private workspaces, processing relevant documents, generating and delivering reports, and responding to order questions. Required information is necessary to supply the report; without it we may be unable to proceed.

Legitimate interests: maintaining security, preventing misuse, diagnosing faults, handling and defending claims, and processing necessary third-party property information where those interests are not overridden by the individual’s rights. Our interests are reliable service delivery, fraud prevention and protection of legal rights. We assess necessity and balance the effects on people.

Legal obligation: maintaining required accounting records, responding to binding legal requests and meeting applicable regulatory duties. Consent: where separately requested for an optional use, such as non-essential cookies or marketing; neither is a condition of buying a report. We do not use uploaded material for unrelated marketing.

The service is designed to use Freeola for hosting, database and private file storage, OpenAI for document extraction and consistency checks, Resend for transactional email, and PayPal for payment processing. Providers receive only information needed for their role. PayPal and some providers may also act as independent controllers for their own fraud, compliance or account purposes.

Lease text, images and relevant property information may be sent to OpenAI after payment for the requested processing. The application requests no response storage through the API; this does not mean providers hold no operational or abuse-monitoring records. Private workspace links are sent by email, but lease documents and reports are not attached to those messages.

We may disclose necessary records to professional advisers, insurers, regulators, courts or authorities when justified by the relevant legal basis. Authorised staff and contractors receive access only as needed. We do not sell report documents for advertising.

Submitting the referral form asks us to facilitate your specific quotation request. We use your contact and building information to route it to suitable independent valuation, legal or related suppliers. For the applicant, processing necessary to carry out the requested referral is based on the requested service; necessary security and third-party information handling may rely on legitimate interests. It is not blanket marketing consent.

Live referrals must identify the intended recipients or provide meaningful recipient information and any relevant fee disclosure before submission. Recipients control their own subsequent contact, advice and retention and must provide their own privacy information. A quotation or response is not guaranteed. The application routes requests by email rather than keeping the full enquiry in its database; the routing mailbox retains a record of your instruction.

Sharing may begin immediately and delivered information cannot be recalled. Contact a recipient directly to stop further contact from them, and contact us about future disclosures or your rights. We remain responsible for our own processing.

Our providers may process data outside the UK. Before enabling a provider or transfer, we must establish the destination, role and applicable safeguard: UK adequacy regulations where applicable, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum with the required assessment and supplementary measures. Provider account configuration and contracts determine the actual arrangements.

The release review must confirm the active providers, destinations and safeguards before customer processing starts. You may ask us for details or a copy of relevant safeguards, subject to lawful redaction of confidential information. This notice alone does not authorise an international transfer.

Customer workspaces and private download links expire 180 days after payment. This ends customer access; it does not delete the private evidence record.

We retain issued reports, submitted supporting documents, customer inputs, analysis, calculation and template versions, contract acceptance, payment and delivery records for at least six years after payment or report completion, whichever is later, to investigate complaints and establish, exercise or defend legal claims. Access is restricted. Six years is the earliest review date, not an automatic deletion date. Longer retention requires a continuing documented need, such as a dispute, legal obligation or relevant insurance requirement. A legal hold suspends deletion while a claim or investigation remains unresolved. Support and referral correspondence are reviewed under the same purpose-based schedule.

The launch review must verify cleanup, mailbox and provider retention, backup expiry and legal holds against these commitments. We do not promise immediate removal from immutable backups; retained backup copies must remain protected and expire under the approved schedule.

Automated systems extract facts, match public evidence, calculate an estimate and check consistency. The output is guidance and does not decide legal rights, grant credit or bind a landlord or court. We do not use this service to make a solely automated decision with legal or similarly significant effects on you. You can correct inputs and ask us to investigate a processing error.

We use private storage, access tokens, payment verification, input checks and access controls. No system can guarantee absolute security. Keep private links confidential, use a secure email account and tell us promptly if a link has been exposed. Our security responsibilities and your statutory rights remain unaffected.

Depending on the circumstances, you can request access, correction, erasure, restriction and portability of personal data, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Rights are subject to legal conditions; erasure is not absolute where records must lawfully be retained.

Email enquiries@leaseholderguide.com. We normally respond within one month; if a lawful extension is needed, we will explain it within that period. We may need proportionate information to confirm identity and protect another person’s data. Requests are normally free. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113 without first exhausting our complaints process.

See our Cookie Notice for browser storage and payment-provider technologies. The service is for adults and is not directed to children. Do not submit a child’s personal information unless necessary and lawful; contact us if it has been provided in error.

We may update this notice to reflect actual processing and legal changes, publishing the date and providing additional notice where required. A notice update does not retrospectively create consent or remove existing rights.