Legal
Privacy notice
Last updated Version 2
1. Who we are
White Crystal Properties Ltd (company number 12779648, registered office 78 Cowbridge Road West, Cardiff, Wales, CF5 5BT) is the controller of the personal information described in this notice. We trade as White Crystal Properties.
To ask us anything about your information, email privacy@whitecrystalproperties.com or write to White Crystal Properties Ltd, 78 Cowbridge Road West, Cardiff, Wales, CF5 5BT.
2. What we collect and why
| What we use it for | The information | Why we are allowed to (lawful basis) | How long we keep it |
|---|---|---|---|
| Your account: signing in, saving properties, your dashboard | Name, email, phone (optional), company name (optional), password (stored only as a one-way hash by our authentication provider), account type, the version of the terms you accepted and when | Contract: we need it to run your account | While your account is open, then up to 30 days after you close it |
| Enquiries about a property | Name, email, phone (optional), your message, the property, a one-way hash of your IP address | Legitimate interests: passing your enquiry to the seller and keeping the service safe from abuse | 24 months |
| Listings you create | The listing text, price, address, photos, video and floor plans, and your contact details as the seller (never shown publicly) | Contract | While the listing is live and for 12 months after it is removed |
| Seller verification | Legal name, business name and number, address, photo ID, proof of address and company or agent documents | Legal obligation, where we act as an estate agent and must check who we deal with. Otherwise legitimate interests: letting buyers know who they are dealing with and preventing fraud | The documents are deleted within 30 days after we decide your verification or you close your account, unless the law requires us to keep them longer (anti-money-laundering rules can require five years where they apply to us). We keep the outcome, the date and who decided. |
| Emails we send | Your email address and the content and delivery status of service emails (for example enquiry copies, listing decisions) | Contract, and legitimate interests for keeping a record that we sent them | 12 months |
| Newsletter | Email address, the wording you agreed to, when you agreed and when you confirmed | Consent. You can withdraw it at any time | Until you unsubscribe, then your email address stays on a do-not-email list so we do not email you again |
| Contact form and support messages | Name, email, phone (optional), topic, message | Legitimate interests: answering you | 12 months |
| How many people view a listing | A one-way hash made from your IP address, browser details and a salt that changes every day, plus the date. We do not store your IP address. | Legitimate interests: showing sellers how many people looked at their listing | 13 months |
| Keeping the site secure | IP address held briefly to limit how often a form can be sent, and the result of the Cloudflare Turnstile check where it is turned on | Legitimate interests | A short time, up to an hour for rate limits |
| Cookies and similar storage | See the cookie policy | Strictly necessary items need no consent. Everything else is only used if you agree | See the cookie policy |
We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not sell it.
3. Where your information comes from
Mostly from you. Sellers see the enquiries buyers send about their listings. If you sign in with Google, Google tells us your name and email address. Our postcode lookup returns the area for a postcode you type in.
4. Who receives it
- Listing owners receive the name, email, phone number and message from your enquiry about their listing, so they can reply. We do not show a seller's email or phone number on the website.
- Our service providers (processors) act only on our instructions:
- Supabase: database, sign-in and file storage.
- Vercel: website hosting.
- MailerSend: sending our emails.
- Cloudflare (Turnstile): checks that forms are filled in by a person. Only where it is turned on.
- Upstash: rate limiting, which uses your IP address for a short time. Only where it is turned on.
- postcodes.io: when a seller looks up a postcode, only the postcode is sent.
- Google: only if you choose to sign in with Google.
- Map tiles. When a map loads, your browser asks OpenStreetMap's servers for map images, so they see your IP address and browser details. We do not send them anything else.
- WhatsApp. If you choose to message us on WhatsApp, WhatsApp handles that chat under its own terms.
- Authorities and advisers. We may share information with the police, regulators, courts, our professional advisers and insurers where the law requires it or it is needed to protect our rights.
We load our fonts from our own servers, so Google Fonts does not see your visit.
5. Transfers outside the UK
Our database and file storage are provided by Supabase and are in Singapore. The United Kingdom has no adequacy decision for Singapore, so for that transfer we rely on the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Our website is hosted by Vercel and delivered through its global network, so pages may be served from servers in several countries, including the United States. Some providers, such as MailerSend, Cloudflare and Upstash, may also process information outside the UK. Where they do, we rely on the UK's adequacy regulations or on the same ICO transfer agreement or UK Addendum. If you want to know more about where your information goes, email privacy@whitecrystalproperties.com.
6. Seller verification documents
Photo ID, proof of address and company documents go straight into a private storage area. They never appear on the website. Only staff we have authorised to carry out verification can open them, through a link that works for a few minutes. We use them once, to check who you are. We delete them within the period in the table above.
7. Security
We protect your information with encryption in transit, access controls that restrict who can see it, separate private storage for verification documents, hashed passwords, rate limits and an audit record of staff access to sensitive data. No system is perfectly secure. If a breach puts your rights at risk we will tell you and the ICO as the law requires.
8. Children
The website is for people aged 18 and over. We do not knowingly collect information from children. If you think a child has given us their details, email privacy@whitecrystalproperties.com and we will delete them.
9. Cookies
We explain every cookie and similar item, and how to change your choice, in our cookie policy.
10. Your rights
You have the right to:
- ask for a copy of your information (access);
- have wrong information corrected;
- ask us to delete it (erasure);
- ask us to restrict how we use it;
- receive the information you gave us in a portable format;
- object to us using it for legitimate interests; and
- withdraw consent at any time, where we rely on it. This does not affect what we did before.
To use a right, email privacy@whitecrystalproperties.com. We may ask you to prove who you are. We reply within one month. We do not charge a fee in normal cases. If your request is complex, or you have made several, we can extend by up to two months and we will tell you why.
To close your account, use "Delete my account" on the Profile page of your dashboard. It sends a request to our team. We check for live listings and open enquiries, then confirm with you by email before anything is deleted.
11. Complaints
If you are unhappy with how we use your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Changes to this notice
We will update this page if how we use information changes. The date and version at the top show the current wording. If a change matters to you, we will tell you by email.