Privacy Policy

2.1Prospective tenants

When you enquire about a property, attend a viewing, or apply to rent we collect:

• Name, contact details (telephone, email, current address), date of birth
• Identification and Right to Rent documentation (passport, biometric residence permit, share code, visa, driving licence)
• Employment and income evidence (employer name, role, salary, payslips, employment reference)
• Affordability and credit reference data (previous addresses, credit history, county court judgments, bankruptcy records)
• Previous landlord reference (rental history, conduct, arrears)
• Bank statements where required to evidence affordability
• Guarantor details (where a guarantor is offered)
• Anti-fraud and sanctions screening results
• Property preferences and viewing history
• Communications between you and Harvey W James about the property

2.2Current and former tenants

During and after a tenancy we hold the data above plus:

• The signed tenancy agreement and any addenda
• Deposit registration details and the prescribed information
• Rent ledger and payment history
• Repairs, maintenance and inspection records
• Correspondence about the tenancy (including any complaints)
• Move-in and check-out inventory and condition reports
• End-of-tenancy financial reconciliation, including deposit deductions where applicable

2.3Guarantors

Where a guarantor is required we collect the same identity, contact, employment and affordability evidence as for a tenant, plus the signed guarantor deed.

2.4Landlords and prospective landlords

When you instruct us to let or manage a property we collect:

• Name, contact details, registered address (or residential address where the landlord is an individual)
• Proof of ownership and authority to let (title documents, mortgage consent where required, head-lessor consent where required)
• Bank account details for rent transfers
• Tax status, including Non-Resident Landlord (NRL) scheme status where relevant
• Where Anti-Money Laundering checks are engaged: identification documents and source-of-funds evidence
• Property compliance documentation (Gas Safety, EPC, EICR, smoke and carbon-monoxide alarm certificates, PRS Database registration, selective licensing where applicable)
• Insurance documentation
• Communications about the property and our service

2.5Contractors, suppliers and professional partners

Name, business contact details, qualifications, insurance details (public liability, professional indemnity), trade body memberships, invoices and payment records.

2.6Website visitors

When you visit www.harveywjames.com we may receive technical data through cookies and analytics tools: IP address (truncated for analytics), browser type and version, device type, pages viewed, referring URL, and session duration. See section 10 on cookies.

2.7Enquirers and newsletter subscribers

Where you submit an enquiry form or sign up to our newsletter we collect the name, email address and any free-text message you provide, plus a record of your consent (where consent is the lawful basis).

2.8Website assistant (“James”)

When you use James, our website assistant — by text or by voice — we record the conversation: the messages you send, James’s replies, the page you were on, and basic device information (browser type and language; we do not store your IP address), together with any rating or feedback you give. Voice calls are transcribed in real time; we do not keep the audio recording.

We use this to answer your enquiry and to review and improve the assistant’s accuracy, safety and helpfulness. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — providing and improving our service. Conversations are reviewed internally by Harvey W James, processed on our secure infrastructure (Cloudflare), and are not sold or used for advertising. James does not ask for, and you should not provide, payment-card or identity-document numbers in the chat.

We keep conversation records for up to 24 months, after which we anonymise them — removing personal details and retaining only de-identified information to keep improving the service. You can ask us to delete your chat records at any time by emailing info@harveywjames.com.

2.9Verified self-service (“My HWJ”)

If you ask James about your own tenancy or account, you can choose to verify your identity: we email a one-time code to the address we already hold for you and, once entered, James can show you your own information (for example your rent amount, payment date, or the status of a repair) for up to 30 minutes in that chat session. We record verification events (time, outcome, and your customer reference — not the code) alongside the conversation for security and audit. Details shown to you become part of the conversation record described above. Verification is optional; you can ask the team instead at any time, and you can end a verified session with “Sign out” in the chat window.

2.10WhatsApp and SMS (“James” by message)

You can also talk to James on WhatsApp. In addition, when you enquire about one of our properties or ask for a valuation — on our website or through a portal such as Rightmove or Zoopla — we may send one automated WhatsApp message (or, where WhatsApp delivery is not possible, an SMS) to the phone number you gave with that enquiry, following up that same enquiry. These are service messages about your own enquiry, not marketing. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — responding to and progressing the enquiry you chose to make. Automated first messages are sent only between 8am and 9pm UK time. Reply STOP at any time and we will stop messaging you on that number; reply START to opt back in.

These channels run on Twilio, our communications provider, and — for WhatsApp — Meta’s WhatsApp Business Platform, which process your phone number and message content to deliver the service under their own privacy terms. The conversation itself is handled by James exactly as described in section 2.8: the same recording, internal review, 24-month retention and deletion rights apply. Verified self-service (section 2.9) remains available on the website chat rather than in WhatsApp.

5.1Service providers we use to deliver lettings and property management

• Goodlord (goodlord.co) — referencing platform and tenancy management; UK-based.
• Credas (credas.com) — digital identity verification, including Right to Rent and Anti-Money Laundering checks; DIATF-certified; UK-based.
• Inventory Base (inventorybase.co.uk) — digital inventory and inspection reports; UK-based.
• Kamma (kammadata.com) — regulatory compliance data and licensing intelligence; UK-based.
• Street.co.uk (street.co.uk) — customer relationship management and report-a-repair system; UK-based.
• LettsPay (lettspay.co.uk) — FCA-authorised client accounting and rent processing; UK-based.
• KeyNest (keynest.com) — key custody for properties without 24/7 concierge access; UK-based.
• Viewber (viewber.co.uk) — UK-vetted member network for hosted viewings and inspections; UK-based.
• Giraffe360 (giraffe360.com) — virtual tours and floor plans; UK / EU based.
• PropServe (propserv.co) and Checkatrade (checkatrade.com) — repair contractor sourcing and vetted-trade networks; UK-based.
• Flatfair (flatfair.co.uk) and Reposit (reposit.co.uk) — deposit-alternative products, where offered to the tenant.

5.2Statutory schemes and regulators

• Tenancy Deposit Scheme (TDS) — statutory scheme for deposit protection.
• Property Redress Scheme (PRS) (propertyredress.co.uk) — our consumer redress scheme; from late 2026 the new statutory PRS Ombudsman.
• Propertymark (propertymark.co.uk) — Client Money Protection provider and trade body.
• Information Commissioner's Office (ICO) — where required.
• HMRC, local authorities and licensing bodies — where legally required (NRL scheme, Making Tax Digital, council tax notifications, selective licensing schemes).
• Courts and tribunals — where required by court order or in connection with possession, deposit or rent proceedings.

5.3Property advertising platforms

• Rightmove (rightmove.co.uk) and Zoopla (zoopla.co.uk) — where instructed by the landlord to advertise a property. The property's address and features are shared; applicants then enquire through the platform or directly with us.

5.4Professional advisors

Our solicitors, accountants (including our strategic accountancy partner YWC London LLP for overseas-landlord tax matters), tax advisors, insurance brokers and our professional indemnity insurer Hiscox (hiscox.co.uk). Each is engaged on a need-to-know basis under their own professional duties of confidence and their own UK GDPR obligations.

5.5What we do not do

We do not sell personal data. We do not share personal data with advertisers, data brokers or marketing list providers. We do not use personal data for any purpose materially different from those described in this policy.

8.1The right of access (Article 15)

You have the right to a copy of the personal data we hold about you and information about how it is processed. This is the Subject Access Request — see section 9 below.

8.2The right to rectification (Article 16)

You have the right to ask us to correct personal data that is inaccurate or incomplete.

8.3The right to erasure (Article 17)

You have the right to ask us to delete personal data we hold about you. We can refuse where we are required by law to retain the data (see section 7) or where we need it to establish, exercise or defend a legal claim. Where retention is required, we will tell you which obligation applies.

8.4The right to restriction (Article 18)

You have the right to ask us to limit how we process your personal data in specific circumstances — for example while we resolve a query about accuracy.

8.5The right to data portability (Article 20)

Where we process personal data on the basis of contract or your consent, and we hold it electronically, you have the right to receive it in a structured, commonly used and machine-readable format, or to have it transmitted directly to another controller where technically feasible.

8.6The right to object (Article 21)

You have the right to object to processing based on legitimate interests (including direct marketing). For direct marketing, the objection is absolute and we will stop on receipt of your request. For other legitimate-interests processing, we will balance the request against the interests we are pursuing.

8.7Rights in relation to automated decision-making (Article 22)

We do not make decisions about you based solely on automated processing where those decisions have legal or similarly significant effects. Credit and referencing decisions involve human review.

8.8The right to withdraw consent (Article 7(3))

Where we process personal data on the basis of your consent (direct marketing, non-essential cookies), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.