Privacy Notice

Last updated: March 2026

This privacy notice explains how Charles Orlebar Estate Agents Ltd ("we", "us", "our") collects, uses, stores and shares personal data, and how we comply with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice consolidates and replaces all previous privacy policies and notices published by us, including the version previously available on our website at https://charlesorlebar.co.uk/legal/privacy and the policy issued in 2024. It reflects our current business practices, systems and use of modern cloud, collaboration and artificial intelligence (AI) tools.

1. Who we are

For the purposes of the UK GDPR, the data controller is:

Charles Orlebar Estate Agents Ltd
Company number: 4707738
Registered address: 23 Cottingham Way, Thrapston, Northamptonshire, NN14 4PL
Trading address: 9 High Street, Rushden, Northamptonshire, NN10 9JR

If you have any questions about this notice or how we use your personal data, please contact us at info@charlesorlebar.co.uk or by telephone on 01933 311121.

2. Information we collect about you

We may collect and process the following categories of personal data:

• Identity and contact details: name, postal address, email address and telephone number.
• Identity verification and compliance information: where required by law, including to comply with the Money Laundering Regulations 2017 and related legislation.
• Financial information: including bank details where required for lettings, rental payments, deposits, client accounting or refunds.
• Property‑related information: details relating to sales, purchases, lettings, tenancies, valuations, viewings and property preferences.
• Special category data: where necessary and with appropriate safeguards, such as information about disabilities or health‑related access requirements.
• Marketing preferences: including areas of interest and communication preferences.
• Technical and usage data: IP address, device information, browser type, operating system, login data and website usage analytics.
• Communications: emails, telephone calls (including inbound and outbound calls, which are recorded), messages and records of correspondence with us. Telephone calls are recorded for training, quality monitoring and record‑keeping purposes and handled in accordance with this privacy notice.

Where we are required by law or contract to collect personal data and you fail to provide it, we may be unable to provide our services and will inform you if this is the case.

3. How we collect your data

We collect personal data:

• Directly from you when you contact us, instruct us, complete forms, attend appointments or use our services.
• Automatically through your use of our website, digital platforms and online tools.
• From third parties where lawful and relevant, such as referencing agencies, property portals, solicitors, contractors, councils, regulators and professional advisers.

4. Lawful bases for processing

We process personal data only where permitted by law, including where:

• Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• You have given consent, for example for electronic marketing or the processing of special category data.
• Processing is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. These interests include operating, improving and securing our business and services.
• Processing is necessary to comply with a legal or regulatory obligation, including anti‑money laundering and property‑related regulations.
• Processing is necessary to protect vital interests or for reasons of public interest.

5. How we use your information

We use personal data to:

• Provide estate agency, lettings, property management, valuation and related services.
• Communicate with you about enquiries, instructions, viewings, transactions and ongoing matters.
• Meet legal, regulatory, accounting and compliance obligations.
• Improve our services, systems, marketing and customer experience.
• Send marketing communications where permitted and in line with your preferences.
• Maintain security, prevent fraud, resolve disputes and protect our business, staff and clients.

6. Use of cloud platforms, AI and automated tools

To operate efficiently and securely, we use modern cloud‑based systems and AI‑enabled tools. These process personal data only in accordance with our instructions, contractual safeguards and applicable law.

Microsoft 365 and Copilot

We use Microsoft 365, including email, document management, collaboration tools and Microsoft Copilot, to create, store and manage business information. Copilot may assist with drafting, summarising or analysing content using data we already lawfully hold. Personal data is not used to train public AI models and remains subject to Microsoft’s enterprise security and compliance controls.

Box and Box AI

We use Box for secure document storage and sharing, and Box AI to assist with document analysis, summarisation and retrieval. Box AI processes data within our controlled environment and does not use our content to train public models.

OpenAI‑powered services

We may use OpenAI‑powered technology through approved business tools to support productivity, analysis and content generation. Where used, safeguards are applied to minimise personal data, restrict access and ensure compliance with contractual and legal requirements. Client personal data is not used to train public AI models.

Human oversight

AI tools are used to assist our team. We do not make decisions with legal or similarly significant effects about individuals based solely on automated processing without appropriate human involvement where required by law.

7. Who we share your data with

We may share personal data with trusted third parties (data processors) where necessary to provide our services and operate our business. These include:

• Property portals, referencing providers and marketing platforms.
• IT, cloud hosting, document management and communications providers (including Microsoft and Box).
• Financial, accounting and payment service providers.
• Contractors, inventory clerks, maintenance providers and utilities.
• Professional advisers, solicitors, councils, regulators and HMRC.

We may also disclose personal data:

• In connection with the sale, acquisition or restructuring of our business.
• Where required by law or to protect the rights, property or safety of our business, clients or others.

We do not sell personal data and we do not share it for third‑party marketing without your consent.

8. International transfers

Where personal data is transferred outside the UK or the European Economic Area, we ensure appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses.

9. Data security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption, secure cloud infrastructure and staff training. While we take security seriously, no system is completely secure and you should take care when sharing information with us.

10. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting or reporting requirements, or to deal with complaints or disputes. Retention periods vary depending on the service provided.

11. Your rights

You have rights under data protection law, including the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Request erasure in certain circumstances.
• Restrict or object to processing.
• Withdraw consent at any time (where processing is based on consent).
• Request data portability where applicable.

Requests can be made using the contact details above.

12. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or by telephone on 0303 123 1113.

13. Changes to this privacy notice

We may update this privacy notice from time to time. The most recent version will always be published on our website and available at our offices.