1. Who we are
Landfall Property Ltd ("Landfall Property", "we", "us", "our") is a private limited company registered in England & Wales under company number 17178803. Our registered office is in the United Kingdom. We are the data controller for the personal information you provide through this website and during our engagement with you. We are registered with the UK Information Commissioner's Office (ICO) under registration number 00014564029.
For any data protection questions, contact our data protection lead at hello@landfallproperty.co.uk.
2. What personal information we collect
We only collect what we need to assess fit, communicate with you, and deliver our service. This includes:
- Identity data — first and last name; current role on board.
- Contact data — email address; phone or WhatsApp number (optional).
- Onboarding data — approximate savings range, prior UK property experience, investment timeline, UK residency status, and any free-text notes you choose to share.
- Correspondence — emails, WhatsApp messages and call notes from your engagement with us.
- Compliance data — once engaged as a client, identification documents and source-of-funds information required under the UK Money Laundering Regulations 2017.
- Technical data — limited browser and device information when you visit this website, including your IP address and browser user agent.
- Marketing consent data — if you tick the marketing consent box on one of our forms, we record that you ticked it, the date and time (UTC), the exact wording you were shown, the version of that wording, which form you used, the page you submitted from, and your IP address and browser user agent. We keep this so we can demonstrate that consent was properly given, as UK GDPR requires.
3. How we collect it
We collect personal information when you:
- Submit the questionnaire on our Get Started page.
- Email, message or call us directly.
- Engage us as a client and provide compliance documents during onboarding.
4. How we use it
We use your personal information to:
- Assess whether our service is the right fit for you.
- Reply to your enquiry within 24 hours and continue our discussion.
- Deliver the property sourcing, negotiation and onboarding service if you engage us.
- Comply with our legal duties — including anti-money-laundering checks, record-keeping and tax obligations.
- Maintain the security and integrity of this website.
We do not sell your data. We do not use it for advertising or profiling.
5. Legal basis
Under the UK GDPR we rely on the following legal bases:
- Consent — for marketing emails and messages, and for advertising cookies. Consent is only ever given by ticking an unticked box; we never treat submitting a form, or silence, as consent. You can withdraw it at any time and it is as easy to withdraw as it was to give (see section 9).
- Contract — when we are providing the service you have engaged us for.
- Legitimate interests (enquiries) — if you send us an enquiry, we will reply to it and discuss our service with you on this basis, whether or not you opted in to marketing. Declining marketing never stops us answering your question.
- Legal obligation — for AML, tax and statutory record-keeping requirements.
- Legitimate interests — operating the business, protecting against fraud, and improving our service. We balance these interests against your rights and freedoms.
6. Who we share your information with
We share information only when necessary, and only with parties bound by confidentiality:
- Professional partners you authorise us to introduce you to — typically a mortgage broker, solicitor, surveyor or letting agent.
- Service providers we use to run the business — our email host, secure document storage, our website and form host (Netlify) and accounting software. Each is bound by data-processing terms.
- MailerLite — our email marketing platform. If, and only if, you tick the marketing consent box on one of our forms, we pass your name, email address, phone number (if given) and the date and wording of the consent you gave to MailerLite so we can send you the updates you asked for. If you do not tick that box, nothing is sent to MailerLite.
- Meta (Facebook and Instagram) — where you have accepted advertising cookies, we send Meta a record that a form was completed, so we can measure which adverts work. Any personal data in that record is irreversibly hashed (SHA-256) before it leaves our systems; we never send Meta your name, email address or phone number in readable form. If you decline advertising cookies, we send Meta nothing.
- Regulators and authorities when required by law, including HMRC, the ICO and law-enforcement bodies.
We will never sell, rent or trade your personal information.
7. How long we keep your data
- Enquiries that do not progress — kept for up to 12 months, then deleted.
- Active client records — kept for the duration of the engagement.
- AML and accounting records — retained for at least 5 years after the engagement ends, as required by UK law.
- Marketing subscriptions — kept until you unsubscribe or ask us to delete them, and reviewed if you have not engaged with our emails for 24 months.
- Marketing consent records — the record of the consent you gave (or declined) is kept for 24 months after the consent ends, so we can evidence it if challenged. This is the one record we may retain briefly after you unsubscribe, precisely because it proves your preference was honoured.
8. How we protect your data
We use reputable, encrypted services to receive and store your information. Access is limited to authorised personnel on a need-to-know basis. We review our systems and processes regularly. No transmission over the internet can be guaranteed 100% secure, but we take reasonable steps to safeguard your data.
9. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the information we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your information ("right to be forgotten"), subject to our legal obligations.
- Restriction — ask us to pause processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on our legitimate interests.
- Withdraw consent — at any time, where processing is based on consent.
Withdrawing marketing consent. Click the unsubscribe link at the foot of any marketing email, reply STOP to any WhatsApp message, or email us. It takes effect immediately and costs you nothing else — you will still receive replies to enquiries and any messages about a service you have engaged us for. To stop advertising cookies, choose Decline on the cookie banner or clear this site's local storage.
To exercise any of these rights, email hello@landfallproperty.co.uk. We will respond within one calendar month.
10. Cookies
We use your browser's local storage to remember your cookie banner preference. You can clear it at any time through your browser settings.
This website also loads the Meta Pixel, an advertising and measurement tool provided by Meta Platforms Ireland Ltd. It sets third-party cookies (including _fbp and _fbc) which Meta uses to measure the performance of our advertising and to recognise returning visitors. Where you have accepted advertising cookies, we also send Meta a matching server-side record of form completions, using irreversibly hashed identifiers as described in section 6.
You can decline advertising cookies using the banner shown when you first visit, and you can withdraw that choice at any time by clearing your browser's local storage for this site or by emailing us. You can also control how Meta uses your data through your Meta ad preferences.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of the page will reflect the most recent change. Where changes are significant, we will let existing clients know directly.
12. Complaints & contact
If you have a concern about how we handle your data, please contact us first — we'll do our best to put it right.
If you remain unhappy, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint · 0303 123 1113.