Privacy Policy for Palace Lettings
Last Updated: 03/08/26
1. Credit Reference and Affordability Checks
To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs). We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.
Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 742313).
TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority (FCA Firm Reference Number: 737740).
The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.
Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:
[Creditsafe Privacy / Transparency Notice] (https://www.creditsafe.com/gb/en/legal/transparency-notice-customer-supplier.html)
[TransUnion Bureau Privacy Notice] (https://www.transunion.co.uk/legal/privacy-centre/pc-bureau)
2. Identity and Contact Details
Organisation name: Palace Lettings Ltd
Registered address: 33 London, ST Leonards on Sea, East Sussex, TN37 6AJ
Contact email or phone number: 01424 721 281
Company registration number: 15140489
ICO registration number: ZB629186
3. Data Protection Officer (DPO)
DPO Name: Sarah Thomas
DPO Email: sarah.thomas@palacelettings.com
4. Purpose of Processing Personal Data
Our organisation processes personal data only where necessary and for defined, lawful purposes. These purposes include:
* Delivering and supporting contracted services, including services that involve or support TransUnion data or systems.
* Managing customer, supplier, and business relationships.
* Complying with applicable legal, regulatory, and contractual obligations.
* Supporting fraud prevention, identity verification, and risk management activities where applicable.
* Protecting the confidentiality, integrity, and availability of personal data through appropriate technical and organisational security measures.
* Managing system access, authentication, logging, monitoring, and audit activities.
* Detecting, preventing, and responding to security incidents, unauthorised access, or data breaches.
* Maintaining records required for governance, compliance, and accountability purposes.
5. Legal Basis for Processing and Legitimate Interests
Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Depending on the activity, we rely on the following lawful bases:
Performance of a contract: Where processing is necessary to deliver services or meet contractual obligations.
Legal obligation: Where processing is required to comply with applicable laws or regulatory requirements.
Legitimate interests: Where processing is necessary for business purposes such as system security, fraud prevention, risk management, and compliance, and where such interests do not override individual rights.
Consent: Where required by law, and where individuals have been provided with a clear choice.
Our Legitimate Interests: Our legitimate interests include operating our business, fulfilling contractual obligations, ensuring system and data security, preventing fraud, supporting audit and compliance activities, and protecting TransUnion data.
6. Categories of Personal Data Processed
We may collect and process:
Identity data: Name, date of birth, title, username.
Contact data: Postal address, email address, telephone number.
Account and access data: User IDs, login details, access permissions.
Professional or employment data: Job title, employer name, business contact details.
Financial and transactional data: Payment details, billing information, and transaction records.
Technical and usage data: IP address, device information, browser type, operating system, and access logs.
Security and audit data: System logs, monitoring records, and incident-related information.
Communications data: Correspondence, emails, and records of interactions.
Compliance and risk data: Records required for regulatory, audit, or due diligence purposes.
7. Data Sources, Recipients, and Transfers
Sources: We collect data from you directly, employers/clients, referees, publicly available sources, credit reference agencies (CRAs), and third-party service providers.
Recipients: We may share personal data with customers, business partners, third-party service providers, regulators, law enforcement bodies, and professional advisers.
International Data Transfers: We do not transfer, store, or process personal data outside of the United Kingdom. All personal data is handled exclusively within the UK.
8. Data Retention, Rights, and Automated Decision-Making
Retention: We keep personal data only for as long as necessary for its purpose and to meet legal obligations. Data used for credit checks is retained only as long as required and then securely deleted.
Your Rights: You have the right to access, rectify, erase (right to be forgotten), restrict processing, data portability, and object to processing. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Provision of Data: Provision of data is primarily contractual. Failure to provide necessary data may result in our inability to enter into a contract, fulfil orders, or conduct required compliance checks.
Automated Decision-Making: We may conduct automated decision-making. You have the right to request human intervention.
9. Website Usage (Cookies, Comments, and Media)
Note: I have retained your existing policy text here.*
Comments: When visitors leave comments, we collect data shown in the form, IP address, and browser user agent to help spam detection.
Media: Avoid uploading images with embedded location data (EXIF GPS).
Cookies: We use cookies for convenience (login, display choices). Visitors may opt-in to saving details when leaving a comment.
Embedded Content: Articles may include content from other websites which may track your interaction.
Visitor Feedback: Visitor comments may be checked through an automated spam detection service.