Privacy Policy

2.1Prospective tenants

When you enquire about a property, attend a viewing, or apply to rent we collect:

• Name, contact details (telephone, email, current address), date of birth
• Identification and Right to Rent documentation (passport, biometric residence permit, share code, visa, driving licence)
• Employment and income evidence (employer name, role, salary, payslips, employment reference)
• Affordability and credit reference data (previous addresses, credit history, county court judgments, bankruptcy records)
• Previous landlord reference (rental history, conduct, arrears)
• Bank statements where required to evidence affordability
• Guarantor details (where a guarantor is offered)
• Anti-fraud and sanctions screening results
• Property preferences and viewing history
• Communications between you and Harvey W James about the property

2.2Current and former tenants

During and after a tenancy we hold the data above plus:

• The signed tenancy agreement and any addenda
• Deposit registration details and the prescribed information
• Rent ledger and payment history
• Repairs, maintenance and inspection records
• Correspondence about the tenancy (including any complaints)
• Move-in and check-out inventory and condition reports
• End-of-tenancy financial reconciliation, including deposit deductions where applicable

2.3Guarantors

Where a guarantor is required we collect the same identity, contact, employment and affordability evidence as for a tenant, plus the signed guarantor deed.

2.4Landlords and prospective landlords

When you instruct us to let or manage a property we collect:

• Name, contact details, registered address (or residential address where the landlord is an individual)
• Proof of ownership and authority to let (title documents, mortgage consent where required, head-lessor consent where required)
• Bank account details for rent transfers
• Tax status, including Non-Resident Landlord (NRL) scheme status where relevant
• Where Anti-Money Laundering checks are engaged: identification documents and source-of-funds evidence
• Property compliance documentation (Gas Safety, EPC, EICR, smoke and carbon-monoxide alarm certificates, PRS Database registration, selective licensing where applicable)
• Insurance documentation
• Communications about the property and our service

2.5Contractors, suppliers and professional partners

Name, business contact details, qualifications, insurance details (public liability, professional indemnity), trade body memberships, invoices and payment records.

2.6Website visitors

When you visit www.harveywjames.com we may receive technical data through cookies and analytics tools: IP address (truncated for analytics), browser type and version, device type, pages viewed, referring URL, and session duration. See section 10 on cookies.

2.7Enquirers and newsletter subscribers

Where you submit an enquiry form or sign up to our newsletter we collect the name, email address and any free-text message you provide, plus a record of your consent (where consent is the lawful basis).

2.8Website assistant (“James”)

When you use James, our website assistant — by text or by voice — we record the conversation: the messages you send, James’s replies, the page you were on, and basic device information (browser type and version, device type and operating system, and language; we do not store your IP address), together with any rating or feedback you give. When you talk to James by voice on our website, what you say is transcribed as you speak by Google’s Gemini AI; we do not keep the audio. Calls to our office phone line are different — they are recorded (section 2.11). The video call is described in section 2.12.

We use this to answer your enquiry and to review and improve the assistant’s accuracy, safety and helpfulness. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — providing and improving our service. James’s replies are generated by Google’s Gemini AI models. Conversations are stored on our secure infrastructure (Cloudflare), are reviewed internally by Harvey W James — including with the help of Anthropic’s Claude AI — and are not sold or used for advertising. Section 5.2 lists these providers. James does not ask for, and you should not provide, payment-card or identity-document numbers in the chat.

We keep conversation records for up to 24 months, after which we anonymise them — removing personal details and retaining only de-identified information to keep improving the service. You can ask us to delete your chat records at any time by emailing info@harveywjames.com.

2.9Verified self-service (“My HWJ”)

If you ask James about your own tenancy or account, you can choose to verify your identity: we email a one-time code to the address we already hold for you and, once entered, James can show you your own information (for example your rent amount, payment date, or the status of a repair) for up to 30 minutes in that chat session. We record verification events (time, outcome, and your customer reference — not the code) alongside the conversation for security and audit. Details shown to you become part of the conversation record described above. Verification is optional; you can ask the team instead at any time, and you can end a verified session with “Sign out” in the chat window.

2.10WhatsApp and SMS (“James” by message)

You can also talk to James on WhatsApp. In addition, when you enquire about one of our properties or ask for a valuation — on our website or through a portal such as Rightmove or Zoopla — we may send one automated WhatsApp message (or, where WhatsApp delivery is not possible, an SMS) to the phone number you gave with that enquiry, following up that same enquiry. These are service messages about your own enquiry, not marketing. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — responding to and progressing the enquiry you chose to make. Automated first messages are sent only between 8am and 9pm UK time. Reply STOP at any time and we will stop messaging you on that number; reply START to opt back in.

These channels run on Twilio, our communications provider, and — for WhatsApp — Meta’s WhatsApp Business Platform, which process your phone number and message content to deliver the service under their own privacy terms. The conversation itself is handled by James exactly as described in section 2.8: the same recording, internal review, 24-month retention and deletion rights apply. Verified self-service (section 2.9) remains available on the website chat rather than in WhatsApp.

2.11James on the phone (020 3865 1500)

Calls to our office number, 020 3865 1500 — the number given in sections 1 and 14 — are answered by James, our AI assistant, at any hour. At the start of each call he tells you, in English, that he is an AI assistant and that calls are recorded. If you speak Mandarin or Polish, he also tells you in that language. For each call we keep:

• a recording of the call, both sides, from when James answers until the call ends — including any part handled by our answering service, and any voicemail you leave;
• a written transcript of what you and James said (and, if you spoke another language, an English translation made by James);
• the number you called from (if your phone shares it), the time and length of the call, a short summary, and what happened as a result — for example, a viewing request or a message for the team.

We use this to answer your call and act on it (passing a message to the right person, arranging a viewing, reporting a repair), to keep an accurate record of what was said, to check and improve James’s accuracy and safety, and to deal with any question or complaint about a call. While you are on the line, James also checks the number you are calling from against our viewing diary, so that he can help with a viewing you already have booked. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): answering our phone line at all hours and keeping a reliable record of each call. You don’t have to give James your details, but without a name and a way to reach you, our team may not be able to follow up.

Twilio carries and records the call. Speech services that Twilio runs for us — Deepgram, ElevenLabs and Google — turn your words into text and James’s replies into speech, and Google’s Gemini AI models generate James’s replies. If James cannot continue a call, he puts you through to our answering service, Message Direct, whose staff take a message for our team. After the call, the transcript, the summary and a private link to the recording go to our team through our task board (Trello), email, WhatsApp and our customer records system (Street). We also use Anthropic’s Claude AI to help us review calls. Section 5.2 lists these providers.

We keep call recordings for 90 days, then delete them. The transcript and call details are kept with our other James conversation records for up to 24 months (section 2.8). Where a call leads to something we act on — an enquiry, a viewing, a repair, a complaint — a note of the call (its summary and transcript) is added to that record and kept with it for as long as we keep that record (section 7).

If you would rather not be recorded, please email us at info@harveywjames.com instead. To get a copy of a recording or transcript, or to ask us to delete one, email info@harveywjames.com with the number you called from and roughly when you called. We will delete it unless we need to keep it — for example, because it is part of a complaint or a legal claim (section 8.3) — and if so, we will tell you why. You can also object to this processing (section 8.6).

2.12James on video (the Meet James page)

On our Meet James page, and from the chat on any page of our website, you can talk to James face to face in a live video call. His face and voice are generated by AI — he is not a real person or a recording of one. The call uses your microphone and never your camera: we never ask for camera access, and no image or video of you is sent or kept. You can type instead of speaking at any time.

What you say goes to Google’s Gemini AI, which transcribes it and generates and speaks James’s reply. James’s spoken reply is then sent to LiveAvatar, a HeyGen service, which animates his face and streams the video to your browser. LiveAvatar receives only James’s replies, never your voice. Because your browser connects directly to Google and to LiveAvatar during the call, both receive your device’s internet (IP) address, as any online service you connect to does.

When the call starts, James tells you that it is recorded and transcribed so the team can follow up. For each call we keep:

• a sound recording of the call, both sides — what you said and what James said — from James’s greeting until the call ends. While your microphone is muted, your side is not recorded. The recording is sound only: no video of you or of James is kept;
• a written transcript of what you and James said, as part of your conversation record (section 2.8);
• basic details of the call: when it started and ended, the page you were on, your browser and device details (as in section 2.8), and the country your connection came from (we do not store your IP address).

Your browser makes the recording and sends it to Cloudflare, which stores it for us in Western Europe. Google and LiveAvatar do not receive the recording.

We keep video call recordings for 90 days, then delete them. The purposes, the lawful basis (legitimate interests), the 24-month retention of the transcript and call details, and your right to ask us to delete the record are the same as in section 2.8.

If you would rather not be recorded, you can use the text chat on any page of our website instead of a video call, or email us at info@harveywjames.com. To get a copy of a recording or transcript, or to ask us to delete one, email info@harveywjames.com with roughly when you called and any details you gave James, such as your email address or phone number. We will delete it unless we need to keep it — for example, because it is part of a complaint or a legal claim (section 8.3) — and if so, we will tell you why. You can also object to this processing (section 8.6).

5.1Service providers we use to deliver lettings and property management

• Goodlord (goodlord.co) — referencing platform and tenancy management; UK-based.
• Credas (credas.com) — digital identity verification, including Right to Rent and Anti-Money Laundering checks; DIATF-certified; UK-based.
• Inventory Base (inventorybase.co.uk) — digital inventory and inspection reports; UK-based.
• Kamma (kammadata.com) — regulatory compliance data and licensing intelligence; UK-based.
• Street.co.uk (street.co.uk) — customer relationship management and report-a-repair system; UK-based.
• LettsPay (lettspay.co.uk) — FCA-authorised client accounting and rent processing; UK-based.
• KeyNest (keynest.com) — key custody for properties without 24/7 concierge access; UK-based.
• Viewber (viewber.co.uk) — UK-vetted member network for hosted viewings and inspections; UK-based.
• Giraffe360 (giraffe360.com) — virtual tours and floor plans; UK / EU based.
• PropServe (propserv.co) and Checkatrade (checkatrade.com) — repair contractor sourcing and vetted-trade networks; UK-based.
• Flatfair (flatfair.co.uk) and Reposit (reposit.co.uk) — deposit-alternative products, where offered to the tenant.

5.2Technology providers behind James, our phone line and our messages

These providers run the systems described in sections 2.8–2.12:

• Cloudflare (cloudflare.com) — hosts our website and James, and stores James’s conversation and call records, and the recordings of video calls, in Western Europe; US-based.
• Google (cloud.google.com) — the Gemini AI models that generate James’s replies, in writing, by voice, on video and on the phone; also our business email (Google Workspace); US-based.
• Twilio (twilio.com) — carries and records calls to our office line and delivers our WhatsApp and SMS messages; US-based. The speech services Twilio runs for our calls are provided by Deepgram (speech to text) and by ElevenLabs and Google (James’s voice).
• LiveAvatar (liveavatar.com), a HeyGen service — animates James’s face in the video call; US-based.
• Message Direct (message-direct.co.uk) — our telephone answering service, which takes calls James passes on; UK-based.
• Atlassian — Trello (trello.com) — our team’s task board, where enquiries, repairs and call notes are tracked; US-based.
• Anthropic (anthropic.com) — Claude, an AI tool we use to help review James’s conversations and calls; US-based.
• Meta — WhatsApp Business Platform — delivers our WhatsApp messages, including the call notes James sends our team (sections 2.10 and 2.11); US-based.

5.3Statutory schemes and regulators

• Tenancy Deposit Scheme (TDS) — statutory scheme for deposit protection.
• Property Redress Scheme (PRS) (propertyredress.co.uk) — our consumer redress scheme; the new statutory PRS Ombudsman once landlord membership is mandatory (expected 2028).
• Propertymark (propertymark.co.uk) — Client Money Protection provider and trade body.
• Information Commissioner's Office (ICO) — where required.
• HMRC, local authorities and licensing bodies — where legally required (NRL scheme, Making Tax Digital, council tax notifications, selective licensing schemes).
• Courts and tribunals — where required by court order or in connection with possession, deposit or rent proceedings.

5.4Property advertising platforms

• Rightmove (rightmove.co.uk) and Zoopla (zoopla.co.uk) — where instructed by the landlord to advertise a property. The property's address and features are shared; applicants then enquire through the platform or directly with us.

5.5Professional advisors

Our solicitors, accountants (including our strategic accountancy partner YWC London LLP for overseas-landlord tax matters), tax advisors, insurance brokers and our professional indemnity insurer Hiscox (hiscox.co.uk). Each is engaged on a need-to-know basis under their own professional duties of confidence and their own UK GDPR obligations.

5.6What we do not do

We do not sell personal data. We do not share personal data with advertisers, data brokers or marketing list providers. We do not use personal data for any purpose materially different from those described in this policy.

7.1How we look after your data, in practice

A retention period only means something if something actually deletes the data, so our rules run on a timer instead of relying on someone remembering:

• recordings of calls to our office line, and of video calls with James, are deleted 90 days after the call;
• finished jobs on our job board are removed from the board 60 days after they are finished, and our own copy keeps a record that the job happened without the personal details;
• enquiry, viewing and valuation records are kept for 12 months from your last contact with us, and conversations with James for up to 24 months before they are anonymised.

When you ask us to delete your data (section 8.3), one request searches our systems for your phone number and email address: chat and call records, our job board, emails, notes and our systems’ logs. A record is deleted outright only once a member of our team has confirmed it is yours. Finding your details in a record does not make it yours: a message from someone else that mentions you stays theirs, and only your details are taken out of it. Where your details sit somewhere our tools cannot reach, such as our calendar, a member of our team removes them by hand, and we tell you when everything is done. If the law requires us to keep something, we tell you which obligation applies.

8.1The right of access (Article 15)

You have the right to a copy of the personal data we hold about you and information about how it is processed. This is the Subject Access Request — see section 9 below.

8.2The right to rectification (Article 16)

You have the right to ask us to correct personal data that is inaccurate or incomplete.

8.3The right to erasure (Article 17)

You have the right to ask us to delete personal data we hold about you. We can refuse where we are required by law to retain the data (see section 7) or where we need it to establish, exercise or defend a legal claim. Where retention is required, we will tell you which obligation applies.

8.4The right to restriction (Article 18)

You have the right to ask us to limit how we process your personal data in specific circumstances — for example while we resolve a query about accuracy.

8.5The right to data portability (Article 20)

Where we process personal data on the basis of contract or your consent, and we hold it electronically, you have the right to receive it in a structured, commonly used and machine-readable format, or to have it transmitted directly to another controller where technically feasible.

8.6The right to object (Article 21)

You have the right to object to processing based on legitimate interests (including direct marketing). For direct marketing, the objection is absolute and we will stop on receipt of your request. For other legitimate-interests processing, we will balance the request against the interests we are pursuing.

8.7Rights in relation to automated decision-making (Articles 22A–22D)

We do not make decisions about you based solely on automated processing where those decisions have legal or similarly significant effects. Credit and referencing decisions involve human review.

8.8The right to withdraw consent (Article 7(3))

Where we process personal data on the basis of your consent (direct marketing, non-essential cookies), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.