PRIVACY NOTICE FOR RIGHTACRES PROPERTY CO. LIMITED AND ALL GROUP COMPANIES Applicable to all individuals who consent to use of the “contact us” section of the Rightacres Property Co. Limited website Protecting your Privacy This Privacy Notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data and keep it safe and how to find out more. It is likely that we will need to update this Privacy Notice from time to time and you can always find the latest version on our website.   This Privacy Notice is for your information only; you do not need to take any action. Rightacres Property Co. Limited, including all of our group companies, (RAP) is committed to ensuring the lawful, fair and transparent processing of all personal data under its control in accordance with the provisions of the General Data Protection Regulation (GDPR). In order to engage with you through our website, by email, phone and in person it is necessary for us to obtain and process personal data in accordance with the provisions in this Privacy Notice.  Who controls and processes your information?  Data Controller: Rightacres Property Co. Limited and all applicable group companies.  Data Processor: Rightacres Property Co. Limited.  The Information we collect:  We collect and process some/all of the following personal information: 

• Full name 
• Email address;
• Phone number
• Postcode
• Country
• Reasons for interest in RAP

How we collect your information:  We collect information through a number of means, including:

• When you visit our website and you choose to contact us using our “contact us” form.
• When you engage with us on social media. 
• When you contact us by any means (including by letter, phone and email) for example with queries and complaints.
• When you book any kind of appointment or meeting with us or with one of our team.
• When you choose to complete any surveys that we may send you.

  Why we process your information (the Purpose): 

• • To respond to your queries or questions submitted through our website “contact us” form.  Handling the information you send enables us to manage our relationship with you.
  • To send you communications required by law.
  • To comply with our contractual or legal obligations to share data with law enforcement, government and regulatory bodies.

• To comply with legal and regulatory obligations, requirements, guidance and best practice.

• To communicate with you about events, activities, updates and information. 
• To communicate with you about your selected reasons for interest in RAP.

The Lawful Basis for which we process your information:  The lawful basis is clear consent from you to process your information (Article 6(1)(a) of the General Data Protection Regulation).  Who has access to your information:  Your information will be shared internally within the RAP team where appropriate. We also use a number of trusted third parties to provide us with necessary services to run our business and who may process your information on our behalf (including our email and data storage provider). How your information is used:  Your information is only used for the Purpose(s) defined above, in accordance with the lawful basis detailed above. How we secure your information: We take appropriate technical and operational measures to ensure that your information is managed carefully and appropriately and to protect against unlawful or unauthorised use and accidental loss or destruction, including: 

• Only providing access to those who need access to carry out the Purpose.
• Passwords are protected.
• Our file storage provider uses encrypted sessions to protect files.
• Hard-copy information is stored securely in locked cupboards with access limited to only those who need to have access to carry out the Purpose. 

Data Transfers:  We sometimes share your personal data with trusted third parties.  This is the policy we apply to those organisations to keep your data safe and to protect your privacy:

• We provide only the information they need to perform their specific services.
• They may only use your data for the exact Purposes we specify.
• We work closely with them to ensure that your privacy is respected and protected at all times.
• If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.
• We may also be required to disclose your personal data to the police or other law enforcement, regulatory or government body in your country of origin or elsewhere upon a valid request to do so. These requests are assessed on a case-by-case basis and take your privacy into consideration.
• We may, from time to time, expand, reduce or sell part of our business and this may involve the transfer of divisions or the whole business to new owners. If this happens, your personal data will, where relevant, be transferred to the new owner or controlling party and in compliance with the terms of this Privacy Notice.

For further information please contact our Data Protection Officer. Transfers within the European Economic Area: None Transfers outside of the European Economic Area: None  How long we will hold onto your information:  We will retain your data for as long as you are opted-in to receiving emails from us. You may request deletion from our database.  It will only be kept for as long as is necessary for the Purpose for which it was collected and in accordance with legal and regulatory requirements and/or guidelines. Your rights in relation to your information:  An overview of your different rights: You have the right:

• To be informed about the processing of your personal information.
• To request access to the personal data we hold about you free of charge in most cases and to obtain information about how we process it.

• To request the correction of your personal data when incorrect, out of date or incomplete.  For example, when you withdraw consent, or object and we have no legitimate overriding interest, or once the Purpose for which we hold the data has come to an end.
• To request that we stop any consent-based processing of your personal data after you withdraw that consent or that we restrict processing of your personal data.
• To have your personal data erased.
• To have your personal data moved, copied or transferred.
• To request review by us of any decision based solely on the automatic processing of your data (where no human has yet reviewed the outcome and criteria for the decision).

You have the right to request a copy of any information about you that we hold at any time and also to have that information corrected if it is inaccurate. To ask for your information and/or request that the information is amended, please contact our dedicated Data Protection Officer, Rightacres Property Co. Limited, 8th Floor, One Central Square, Cardiff, CF10 1FS. If we choose not to action your request we will explain to you the reasons for our refusal. Your right to withdraw consent: Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and to withdraw that consent. What happens if your information is compromised? In the event we discover a breach in the way that we have handled your personal information, we will notify the Information Commissioner’s Office within 72 hours of discovery. Where we consider there to be any risk to you as a consequence of the breach we will notify you immediately with details of any resulting risks and measures we have taken or intend to take and any recommended actions that may help you.  Sensitive Personal Information:  We do not collect or process sensitive personal information for the Purposes outlined above. Contacting the Regulator: If you feel that your data has not been handled correctly or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.  However, we do encourage you to contact us in the first instance to raise any queries and to resolve any concerns.  You can contact them by calling 0303 123 1113.  Or go online to www.ico.org.uk/concerns (opens in a new window; please note we are not responsible for the content of external websites). Further information: We hope this Privacy Notice has been helpful in setting out the way that we handle your personal data and your rights to control it. If you have any questions that have not been covered, please contact our Data Protection Officer who will be pleased to help you:

• Contact us through the “contact us” section of our website.
• Write to us at Data Protection Officer, Rightacres Property Co. Limited, 8th Floor, One Central Square, Cardiff, CF10 1FS.
• Phone us on: 029 20 220767.

This Privacy Notice was last updated on 29 May 2025.