Privacy statement

1. Who we are

Shanly Homes ("we", "us", "our") is committed to protecting your personal data.

This Privacy Policy is issued on behalf of the Shanly Group. For the purposes of this policy, when we refer to "Shanly Homes" we mean the relevant Shanly Group company responsible for processing your data in connection with the services or interactions described below (for example, property sales, lettings, property management, customer care or website enquiries). The Shanly Group includes Sorbon Group Limited, Shanly Residential Limited, Shanly Homes Limited, Shanly Homes (South East) Limited, Sorbon Estates Limited, Sorbon Investments Limited, Milestone SO Limited and associated companies.

We are the data controller responsible for your personal data (or we act as a joint controller/processor, depending on the circumstances).

2. Contact details

Data Privacy Team – Shanly Group

Address: 24-26 Aylesbury End, Beaconsfield, Buckinghamshire, HP9 1LW

Email: dataprivacy@shanlygroup.com

Tel: 01494 671331

You can complain to the Information Commissioner's Office (ICO) at www.ico.org.uk, but we would always appreciate the chance to resolve your concerns first.

3. What data we collect

We may collect and process the following categories of personal data:

Identity data: first name, last name, maiden name, title, date of birth, gender, username or similar identifier, marital status (where relevant).

Contact data: postal address and address history, email address, telephone numbers.

Financial data: bank account and payment card details; and where relevant salary, income and employment details, and information from credit reference or fraud prevention agencies and publicly available sources.

Transaction data: details of payments to and from you and details of products and/or services you have purchased from us (e.g. reservation, sale, letting or property management arrangements).

Technical data: IP address, login data, browser type/version, time zone and location setting, browser plug-ins, operating system and platform, and other technology on devices used to access our websites.

Profile data: purchases or orders, interests, preferences, feedback and survey responses.

Usage data: information about how you use our websites, products and services.

Marketing and communications data: your preferences in receiving marketing from us and your communication preferences.

We also collect, use and share aggregated data (such as statistical or demographic data). Aggregated data is not personal data in law unless it can be linked back to you.

Special category data and criminal offence data

We do not generally collect special category personal data (e.g. health, ethnicity, political opinions) or criminal offence data unless required to meet a legal obligation.

Important exception: where we are required to collect and share data in relation to social housing lettings and sales through CORE (Continuous Recording of social housing lettings and sales) for statistical purposes, that dataset may include sensitive information and (in some cases) special category data. This is handled as a statutory reporting obligation.

4. How we use your data

We process your personal data only where the law allows us to. Most commonly we rely on:

• Contract / pre-contract steps (where we are entering into or performing a contract with you)
• Legitimate interests (where necessary to run our business, provided your rights do not override those interests)
• Legal obligation (where required by law/regulation)
• Consent (where we ask for it, for example in relation to certain research activities or particular marketing channels)

Purposes, data types and lawful bases

Marketing choices: you can ask us to stop receiving marketing at any time by contacting dataprivacy@shanlygroup.com.

5. Research and service improvement

We may use personal data to research and improve our products, services and customer experience. This includes:

• Analysing customer feedback, transaction history and interaction data to understand how our homes, sales process, aftersales support and property management services are performing and how they can be improved.
• Inviting you to take part in surveys, interviews or focus groups. Participation is always voluntary and you may withdraw at any time without giving a reason.
• Working with academic institutions and other research partners on studies aimed at improving industry practice. Where we do so, personal data is shared only where necessary, under appropriate confidentiality and data protection arrangements, and is anonymised or pseudonymised wherever practical.

Our lawful basis for internal analysis and anonymised or pseudonymised research is legitimate interests (improving our products, services and customer experience). Where we invite you to take part in a specific research activity such as an interview, focus group or survey, we rely on your consent, which you may withdraw at any time by contacting us.

Research outputs shared with third parties or published externally will not identify you individually. Where academic partners are involved, they are bound by their own institutional research ethics and data protection frameworks in addition to our contractual requirements.

6. Cookies and website analytics

Our website uses cookies and similar technologies to help it function, to remember your preferences, and to help us understand how visitors use the site.

Strictly necessary cookies are set automatically and are needed for the site to work.

Analytics and behavioural insight cookies are set only where you have given consent through our cookie banner. These include Microsoft Clarity, provided by Microsoft Corporation, which we use to understand how visitors interact with our website through session recordings, heatmaps and behavioural analytics (for example, mouse movements, clicks, scrolls and pages viewed). Clarity does not record the content of form fields such as names, email addresses or payment details, and personal data is masked wherever practical.

Data collected through Microsoft Clarity is transmitted to Microsoft, which acts as a separate data controller in respect of that data. Microsoft may transfer the data outside the UK and/or EEA under appropriate safeguards. For details of how Microsoft handles the data, please see the Microsoft Privacy Statement at privacy.microsoft.com.

You can withdraw your consent to non-essential cookies at any time by using the cookie preferences link in our website footer or by adjusting your browser settings.

7. Failure to provide data

If you do not provide information we need (by law or under a contract), we may not be able to perform the contract we have with you or are trying to enter into, and we may need to cancel or decline a service (we will tell you at the time if this applies).

8. Sharing data

We may share your data with trusted third parties where necessary, including:

• Other Shanly Group companies (where relevant to provide services and administer your relationship with us)
• New home warranty providers (e.g. NHBC) for Buildmark/warranty administration and related homeowner communications and surveys
• Estate agents and solicitors acting on our behalf in connection with property sales
• Technology suppliers supporting our websites and systems (such as ContactBuilder and Clixifix)
• Website analytics providers, including Microsoft (in relation to Microsoft Clarity), where you have given consent
• Customer satisfaction and research providers (such as In-house Research Ltd)
• External contractors involved in customer care, snagging, warranty/guarantee works, maintenance and property management
• Credit reference, debt collection and fraud prevention agencies (where relevant)
• Professional advisers (lawyers, bankers, auditors, insurers)
• Academic institutions and research partners engaged on research and service improvement activities, under appropriate confidentiality and data protection arrangements, with personal data anonymised or pseudonymised wherever practical
• Regulators and authorities (e.g. HMRC and other statutory bodies where required)

We require third parties to protect your data and use it only for the purposes we specify. We do not sell your personal data.

9. International transfers

Because some of our technology providers use global cloud infrastructure, your personal data may be transferred outside the UK and/or EEA.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place (for example, UK adequacy regulations and/or approved contractual protections) so your data remains protected.

10. Data security

We use technical and organisational measures to protect your data. Access is limited to staff and advisers with a need to know. Data transmitted online (e.g. by email) is never fully secure; please take care when sending information.

11. How long we keep your data

We retain personal data only as long as necessary for the purposes set out above, including legal, accounting and reporting requirements. Our current retention rules are as follows:

• Freehold purchase: up to 12 years from completion.
• Lease/licence (residential or commercial): until the earlier of lease/licence end or 12 years from disposal of our interest in the property.
• AML / statutory obligation data: 5 years (or longer if legally required).
• Enquiries/requests for information about properties or developments: until the earlier of erasure request or 2 years from last contact.
• Research participation data: until completion of the relevant research project and any associated reporting or publication obligations, after which data is anonymised or deleted.
• All other cases: as long as necessary to deal with enquiries, manage potential claims, and meet legal/regulatory requirements.

12. Your rights

You have the right to:

• access the data we hold about you,
• request correction of inaccurate data,
• request deletion (where legally appropriate),
• object to processing (including for marketing and for research based on legitimate interests),
• request restriction of processing,
• request transfer of your data to another party,
• withdraw consent (if we rely on it, including consent to take part in a specific research activity),
• complain to the ICO (www.ico.org.uk).

13. Data Subject Access Requests

If you wish to exercise your right of access under data protection law (a "Data Subject Access Request"), please contact us at dataprivacy@shanlygroup.com. We may ask you to provide proof of identity before we can process your request. You are entitled to one copy of your personal data free of charge. For full details, please see our Data Subject Access Request Policy.

14. Links to other websites

Our website may contain links to partner or third-party sites. These have their own privacy policies, and we are not responsible for them.

15. Changes to this policy

We keep this policy under review. Updates will be published on our website. Please check back to stay informed.