PRIVACY POLICY
Last updated: 13 November 2026

1. Who we are
Prosperity Property North Ltd (company no. 12341436, registered in England and Wales, 29 Westminster Road, York YO30 6LZ) is the controller of the personal data described in this policy. We trade as El Rents (lettings and property management) and El Stays (short stays). We are registered with the Information Commissioner's Office (ICO), registration ZA663259. Contact: elena@prosperitypropertynorth.co.uk.
This policy applies if you are a landlord, investor, tenant, buyer or seller, a referral partner or supplier, someone who contacts us, or a visitor to this website.

2. What we collect
• Contact and identity details: name, email, phone and address; for tenants, buyers, sellers and investors also date of birth, ID documents and proof of address.
• Property and financial details: details of properties you own, let or want to buy; bank details for rent and payments; information needed for referencing, affordability and anti-money laundering checks.
• Checks required by law: right-to-rent checks for tenants, and anti-money laundering checks (including source of funds) for investors, buyers and sellers. Where the law requires or allows it, these may include information about criminal convictions.
• Tenants' households: names of the people who will live in the property, including children. We don't contact dependants.
• Calls and messages: our phone lines (including 0333 090 9629 and 07861 934348) and WhatsApp/SMS may be answered by our AI assistant. Calls may be recorded and transcribed so we can respond and keep accurate records.
• Website use: cookies and the Meta Pixel (only with your consent). See our Cookie policy.

3. Why we use it and our lawful basis
• Contract (or steps before a contract): valuations, letting, management, sourcing and the other services you ask for; invoices and payments.
• Legal obligation: right-to-rent, the anti-money laundering and sanctions checks the law requires (including on buyers, sellers and investors in sales and sourcing), tax and accounting records, deposit protection, safety and licensing duties.
• Legitimate interests (preventing fraud and financial crime): identity, anti-money laundering and sanctions checks we do as company policy where the law doesn't require them. Some digital ID checks use a selfie (biometric data): we only use this with your explicit consent, and you can choose a manual document check instead.
• Legitimate interests: answering enquiries and following up a valuation or enquiry you made; referencing and credit checks; preventing fraud; handling complaints and disputes; working with referral partners; call recording and AI call handling (so we can answer quickly and keep accurate records — you can always ask to speak to a person); using an AI assistant to help draft messages and prepare statements and records, and recording or transcribing meetings and calls (we tell you at the start). A person (Elena) checks anything sent to you and makes every payment; no decision about you is made by AI alone.
• Consent (you can withdraw it at any time): advertising and analytics cookies; marketing emails and texts. Existing clients may receive occasional updates about similar services, with an easy opt-out each time.
• Criminal-offence data in referencing or anti-money laundering checks is used only where the law requires or allows it.

4. Who we share it with
Only what's needed, and only with:
• Service providers acting for us: HubSpot (customer records), Google Workspace (email, calendar, files), Tilda (website), Famulor (AI phone and messaging assistant), CircleLoop (business phone), Meta (WhatsApp; Facebook adverts and Pixel with consent), CookieScript (cookie consent), Hospitable (short-stay bookings), Anthropic (Claude, the AI assistant we use to draft messages, organise enquiries and prepare statements and records), FreeAgent (accounting software), Zoom, Google Meet, Loom and Granola (video meetings, recordings and meeting notes), Wispr Flow (voice dictation), Blinq (digital business cards), Notion and Todoist (internal notes and task lists), Calendly (booking calls), SendPulse (email newsletters, only if you have agreed to receive them), Stannp (printed letters), Smallpdf and sign.com (PDFs and e-signatures) and our accountants.
• For lettings, sales and sourcing: PropertyGoose (referencing, Right to Rent, and identity, anti-money laundering and sanctions checks for lettings, sales and sourcing; its identity checks are carried out by Vouchsafe, a government-certified digital identity service), credit-check agencies, tenancy deposit schemes, guarantors, contractors carrying out repairs (only the details they need), and utility companies and councils where required.
• Others involved in your transaction: landlords, tenants, buyers, sellers, solicitors and mortgage brokers.
• Where the law requires it: The Property Ombudsman, Client Money Protect, the police, HMRC, courts and regulators.
We don't sell your data.

5. International transfers
Some of our providers (for example Hospitable, Anthropic, HubSpot, Google, Meta, Zoom, Granola, Wispr Flow, Notion, Todoist and Calendly) process data outside the UK, including in the US. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

6. How long we keep it
• Clients (landlords, tenants, investors, buyers and sellers): 6 years after the end of our contract or tenancy, to meet tax and legal duties.
• Identity and anti-money laundering check records: 5 years after our relationship ends, then deleted unless the law requires us to keep them longer.
• Enquiries that don't become clients: 12 months after our last contact.
• Call and meeting recordings, transcripts and notes: up to 12 months.
• Marketing consent: until you withdraw it.

7. How we protect it
Access is limited to the people who need it, our systems are password-protected with two-step verification where available, and our providers are bound by contract to keep your data secure.

8. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to how we use it, to data portability, and to withdraw consent at any time. To use any of these rights, email elena@prosperitypropertynorth.co.uk. We reply within one month. Sometimes we can't agree to a request (for example where the law requires us to keep records); if so, we'll explain why.

9. Complaints
Please tell us first and we'll try to put it right. We'll acknowledge a data protection complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.