Privacy Policy

Chelton Brown Ltd

Updated: 6 August 2026

This privacy notice explains how we collect, use, share and protect personal information when providing estate agency, lettings, property management, block management and related services.

1. Who we are

Chelton Brown Ltd, Chelton Brown Block Management Ltd and Chelton Brown Maintenance Ltd (trading as Choice Buildings Maintenance) are the data controllers for the personal information described in this Privacy Policy.

The companies’ registration details are as follows:

• Chelton Brown Ltd – Company Registration Number 05521012, with its registered office at 4/5 George Row, Northampton, Northamptonshire, NN1 1DF. ICO Registration Reference: Z9236366.
• Chelton Brown Block Management Ltd (trading as Chelton Brown) – Company Registration Number 15090377, with its registered office at 4/5 George Row, Northampton, Northamptonshire, NN1 1DF. ICO Registration Reference: ZB710863.
• Chelton Brown Maintenance Ltd (trading as Choice Buildings Maintenance) – Company Registration Number 16232892, with its registered office at 4/5 George Row, Northampton, Northamptonshire, NN1 1DF. ICO Registration Reference: ZB975559.

This Privacy Policy applies to personal information collected from or about clients, prospective clients, applicants, vendors, landlords, tenants, guarantors, purchasers, suppliers, contractors, professional advisers, website users, and any other individuals with whom we interact in connection with our services.

Our website and services may contain links to third-party websites that are not operated or controlled by us. We are not responsible for the content, security, or privacy practices of those websites, and we recommend that you review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, or legal and regulatory requirements. The most recent version will always be available on our website and will apply from the date shown at the top of this policy.

 

2. The laws that apply

We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where applicable, the changes introduced by the Data (Use and Access) Act 2025.

The Data (Use and Access) Act 2025 does not replace UK GDPR, the Data Protection Act 2018 or PECR, but it amends parts of those laws. This policy has therefore been updated to reflect relevant changes, including subject access requests, data protection complaints, automated decision-making, recognised legitimate interests, international transfers and storage/access technologies such as cookies.

 

3. What information we collect

The personal information we collect will depend on your relationship with us and the service we provide. It may include:

• name, address, email address, telephone number and other contact details;
• identity information and verification results, including information needed for anti-money laundering, fraud prevention, sanctions screening, right to rent and other legal or regulatory checks;
• proof of ownership, title information, tenancy information and transaction details;
• bank details, payment details, rent account information and deposit information where needed for lettings, property management or sales transactions;
• information about close connections or conflicts of interest where required by law, regulation or professional standards;
• property requirements, viewing feedback, offers, negotiations, valuations, market appraisal information and correspondence;
• information about access needs or reasonable adjustments. This may include special category personal data, such as health or disability information, where it is necessary to provide our services appropriately;
• communications with us, including emails, letters, calls, notes, forms, complaints, enquiries and service records;
• website, device and technical data, such as IP address, browser, device type, usage information and cookie or similar technology data;
• marketing preferences and areas of interest, where you choose to receive updates from us.

If we need to collect personal information by law, under a contract, or in order to provide our services and you do not provide it when requested, we may be unable to provide some or all of the relevant services. We will tell you if this applies.

 

4. How we collect information

• directly from you when you contact us, instruct us, make an enquiry, complete a form, attend a viewing, make an offer, apply for a tenancy or use our services;
• from landlords, tenants, vendors, purchasers, guarantors, applicants, contractors, solicitors, mortgage advisers, surveyors and other third parties involved in a property matter;
• from public sources, including HM Land Registry, Companies House, electoral registers and sanctions lists where applicable;
• from identity verification, referencing, fraud prevention, credit checking, property software and property portal providers where necessary;
• from our website, cookies and storage/access technologies.

 

5. Why we use your information and our lawful basis

We use personal information only where we have a lawful basis to do so. The main purposes and lawful bases are set out below.

Purpose	Examples	Lawful basis
Providing our services	Estate agency, lettings, property management, block management, valuations, viewings, offers, tenancy administration and sales progression.	Contract, legitimate interests and legal obligation.
Legal and regulatory compliance	AML, fraud prevention, sanctions checks, right to rent, tax, deposit rules, consumer protection, property safety and regulatory requirements.	Legal obligation, substantial public interest where applicable, legitimate interests.
Identity and ownership checks	Verifying ID, ownership, address and authority to act, including use of digital verification providers.	Legal obligation, contract and legitimate interests.
Communications	Responding to enquiries, service updates, arranging appointments, managing repairs, progressing transactions and dealing with complaints.	Contract, legitimate interests and legal obligation.
Marketing	Sending information about similar services or updates where permitted, and respecting opt-outs.	Consent or legitimate interests, including the soft opt-in where applicable.
Website and technology	Operating and improving our website, security, analytics and cookie preferences.	Consent where required, legitimate interests, and legal obligation.
Claims and risk management	Handling disputes, complaints, insurance matters, legal claims and debt recovery.	Legitimate interests, legal obligation and, where necessary, legal claims condition for special category data.

 

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and freedoms. Our legitimate interests include running and improving our business, providing property services, preventing fraud, recovering debts, protecting our rights, improving customer experience and communicating with existing customers about similar services.

Where we rely on a recognised legitimate interest introduced under the Data (Use and Access) Act 2025, we will only do so where the law permits, such as certain disclosures for crime prevention, safeguarding, public security or emergencies.

 

6. Special category information

We may process special category information, such as health or disability information, where it is necessary to make reasonable adjustments, address access requirements, safeguard individuals, deal with legal claims or comply with our legal obligations. We will only use this information where we have an additional lawful condition under data protection legislation.

 

7. Automated decision-making and profiling

We do not usually make decisions that have a legal or similarly significant effect on you based solely on automated processing. Some third-party providers used for referencing, identity checks, fraud prevention, credit assessment or sanctions screening may use automated tools to support their checks.

Where a solely automated decision with legal or similarly significant effect is made, we will ensure appropriate safeguards are in place. These may include providing information about the decision, allowing you to make representations, allowing you to challenge the decision and enabling human intervention where required by law.

 

8. Who we share information with

We may share information where necessary to provide our services, comply with legal obligations, protect our rights, manage transactions or act on your instructions. Recipients may include:

• landlords, tenants, vendors, purchasers, guarantors and applicants where required for a property matter;
• solicitors, conveyancers, surveyors, mortgage brokers, accountants, insurers and other professional advisers;
• contractors, inventory clerks, maintenance providers, managing agents and block management suppliers;
• referencing, credit checking, fraud prevention, sanctions screening and identity verification providers;
• property software, cloud hosting, IT support, email, file storage, website, marketing and communications providers;
• deposit protection providers, payment service providers, banks and utility companies;
• HMRC, HM Land Registry, local authorities, courts, tribunals, enforcement agencies, regulators, ombudsman schemes and law enforcement bodies where required or permitted;
• prospective buyers or successors to our business or assets if our business is sold or reorganised.

Our current business partners and service providers may include LettingsHub, InventoryBase, Fixflo and approved contractors, The Property Software Group, The Guild of Property Professionals, Propertymark, HMRC, Cottons Accountants, Maple Mortgage Services, Advania IT, local authorities and utility providers. This list is reviewed and updated as providers change. Please note, this list is not exhaustive and should someone fall outside of this, we will seek consent to share your data.

We will not sell your personal information. We will not share your information with third parties for their own marketing purposes unless we have your consent or another lawful basis applies.

 

9. International transfers

Where personal information is transferred outside the UK, we will ensure an appropriate safeguard or lawful transfer mechanism is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by law.

 

10. Cookies and storage/access technologies

Our website may use cookies and similar storage/access technologies to operate the site, remember preferences, measure use, improve functionality and support security. Some low-risk technologies may not require consent under updated law, but we will seek consent where required, including for non-essential advertising or tracking technologies. You can manage preferences through your browser settings or any cookie preference tool made available on our website.

 

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes set out in this policy. Retention periods vary depending on the nature of the service, legal and regulatory requirements, limitation periods for claims, complaints, anti-money laundering obligations, accounting requirements and our legitimate business needs.

When information is no longer required, we will securely delete, anonymise or archive it in accordance with our retention procedures.

 

12. How we protect information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These measures may include access controls, secure systems, encryption or minimisation where appropriate, staff training, supplier due diligence and secure disposal arrangements.

If we give you login details or access credentials for any system, you are responsible for keeping them confidential and must not share them with anyone else.

 

13. Your rights

Subject to certain conditions and exemptions, you may have the right to:

• request access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information where there is no good reason for us to continue processing it;
• ask us to restrict how we use your information in certain circumstances;
• object to processing based on legitimate interests or direct marketing;
• ask for certain information to be transferred to you or another organisation;
• withdraw consent where we rely on consent;
• challenge or request human intervention in relation to qualifying automated decisions.

To exercise your rights, contact us using the details in section 16. We may need to verify your identity before responding.

 

14. Subject access requests

If you make a subject access request, we will respond within the legal timeframe. Where we reasonably need further information to clarify your request or confirm your identity, the response period may be paused until we receive the information needed. We will carry out reasonable and proportionate searches when responding to a request.

 

15. Complaints

If you are concerned about how we use your personal information, please contact us using the details below. We will acknowledge data protection complaints within 30 days and respond without undue delay. We may ask for further information where needed to investigate the complaint properly.

If you are not satisfied with our response, or you believe we are processing your personal information unlawfully, you can complain to the UK data protection regulator, the Information Commissioner’s Office. Further details are available at www.ico.org.uk or by calling 0303 123 1113.

 

16. Contact details

Data protection contact: Edward Chelton Brown

Email: Edward.cheltonbrown@cheltonbrown.co.uk

Postal address: Chelton Brown Ltd, 4/5 George Row, Northampton, Northamptonshire, NN1 1DF

General consent and marketing preferences can also be sent to admin@cheltonbrown.co.uk.

 

17. Policy status

This privacy policy was updated on 6 August 2026 to reflect current UK data protection legislation and guidance, including changes made by the Data (Use and Access) Act 2025 where applicable.

This document is intended as a practical privacy notice for Chelton Brown Ltd. It should be reviewed periodically and whenever services, suppliers, technologies, retention practices or legal requirements change.