Privacy Policy

Hatfield Shaw & Co Limited (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Money Laundering Regulations 2017.

1. Who We Are

Hatfield Shaw & Co Limited is an independent estate agency operating in Brackley, Buckingham, Winslow, and the surrounding areas.

Company details:
Company name: Hatfield Shaw & Co Limited
Company number: 17056422
Registered office: 15 Nightingale Close, Brackley, Northamptonshire, NN13 6PN

Contact details:
Email: sales@hatfieldshaw.co.uk
Telephone: 01280 460360

For the purposes of data protection legislation, Hatfield Shaw & Co Limited is the data controller.

2. Data Protection Contact

We are not required to appoint a Data Protection Officer. Responsibility for data protection matters sits with the company directors, supported by our internal Data Protection Lead.

All data protection enquiries or requests should be directed to:
sales@hatfieldshaw.co.uk

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Name, address, telephone number, and email address
• Property details, including information about current or prospective properties
• Financial information relevant to a transaction (such as proof of funds or mortgage position)
• Identification documents to comply with Anti-Money Laundering requirements
• Communication records, including emails, telephone calls, and messages
• Website usage data, including cookies and analytics data where applicable

4. How We Use Your Personal Data

We use personal data to:

• Provide estate agency services, including sales, lettings, valuations, and property management
• Arrange and conduct property viewings
• Market properties on your behalf
• Progress property sales, purchases, lettings, or tenancies
• Communicate with you regarding enquiries or transactions
• Comply with legal and regulatory requirements, including Anti-Money Laundering checks
• Improve our services and customer experience

5. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract – where processing is necessary to provide estate agency services or take steps at your request
• Legal obligation – where processing is required to comply with laws and regulations, including AML requirements
• Legitimate interests – where processing is necessary for our business operations, including:
  • responding to enquiries
  • progressing property transactions
  • preventing fraud and financial crime
  • improving our services and customer experience
    We ensure that these interests are balanced against your rights and freedoms
• Consent – where required, particularly in relation to certain marketing communications and non-essential cookies

6. Marketing Communications (PECR Compliance)

Where we send marketing communications (for example, property updates or services):

• We will only do so where we have your consent or where permitted by law
• You may receive marketing by email, telephone, or other electronic means
• You can unsubscribe or opt out at any time by:
  • selecting the unsubscribe link in emails
  • contacting us directly

We will never send unsolicited marketing communications where consent is required.

7. Anti-Money Laundering (AML) and Identity Verification

In order to comply with the Money Laundering Regulations 2017, we are legally required to verify the identity of clients and, where applicable, beneficial owners. This may include:

• Requesting and retaining copies of identification documents and proof of address
• Carrying out electronic identity verification checks using third-party providers
• Verifying source of funds and, where required, source of wealth
• Retaining AML records for a minimum of five years after the end of our business relationship

We may share AML-related data with third-party identity verification providers, fraud prevention agencies, and regulatory or law enforcement bodies, including the National Crime Agency (NCA).

Where required by law, we may not be permitted to inform you that a report has been made.

8. Sharing Your Personal Data

We may share your personal data with trusted third parties where necessary, including:

• Solicitors and conveyancers
• Mortgage advisers and brokers
• Surveyors and valuers
• Referencing companies (for lettings)
• Regulatory bodies and authorities
• Service providers supporting our operations (including CRM systems, IT providers, and marketing platforms)

We will never sell your personal data. All third parties are required to process personal data securely and in accordance with the law.

9. International Transfers

Some third-party service providers may process personal data outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations
• Standard contractual clauses or equivalent legal mechanisms

10. Data Security

We take appropriate technical and organisational measures to protect personal data, including:

• Controlled access to systems and data
• Secure storage of physical and electronic records
• Use of reputable and secure IT and CRM platforms
• Measures to prevent unauthorised access, loss, or misuse

11. Data Retention

We only retain personal data for as long as necessary, taking account of the purpose for which it was collected and our legal obligations.

• General business records are typically retained for up to six years
• Anti-Money Laundering records are retained for at least five years

After this period, data is securely deleted or anonymised.

12. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (where applicable)
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time (where processing is based on consent)

Requests should be made via our contact details above.

13. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

14. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data relating to children without appropriate consent.

15. Cookies and Website Use

Our website uses cookies and similar technologies.

• Strictly necessary cookies are used to ensure the website functions correctly
• Analytics, functionality, and marketing cookies are used only with your consent

When you visit our website, you will be presented with a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Manage preferences by category

You can change or withdraw your consent at any time via the cookie settings tool.

Further details are available in our Cookie Policy.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, or our business practices.

Any updates will be published on our website.

17. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Visit the ICO website