Draft for approval
Proposed internal policy for The House Exchange Ltd, dated 1 October 2026. Management must approve this policy and implement the controls before it is described as current practice. This is not a substitute for the customer privacy notice.
Responsibility
The House Exchange Ltd, company number 17436842. Registered office: C/O Walkers Accountants Ltd Suite 3 Aireside House, Royd Ings Avenue, Keighley, West Yorkshire, England, BD21 4BZ. Email: info@thehouseexchange.co.uk. A named privacy lead and deputy must be appointed before launch. Staff must raise privacy enquiries and suspected incidents immediately through the approved internal route.
Collect only what is needed
The initial enquiry should collect contact details, property address and the information needed to respond. Do not request identity documents, bank information or sensitive personal circumstances in an open website form. Use an approved secure process for later ownership and identity checks. Record the source and purpose of information received from third parties.
Document the reason for collection
Before introducing a field, integration or new use, record its purpose, lawful basis, access requirements and retention period. Collect only necessary information. Obtain any additional legal condition required before handling special-category or criminal-offence information. Keep optional marketing choices separate from purchase enquiries.
Enquiry transparency and preference records
At collection, make the customer privacy notice easy to reach and distinguish required information from optional details. Explain why missing required details could prevent an enquiry progressing. Keep the version of any consent wording, the choice made and when it was made; do not treat agreement to a privacy notice as blanket consent for all processing. Provide a practical way to correct details or withdraw optional contact permission. Maintain only the minimum suppression information needed to respect an opt-out, under an identified lawful basis.
Access and service providers
Use individual accounts, least-privilege access, appropriate authentication, secure transfer and managed backups. Confirm who can access WordPress, FormLayer, email and any CRM. Review provider contracts and overseas processing before use. Do not enable Google address lookup until its account, restrictions, billing and privacy implications are approved.
Sharing and verification controls
Before sharing, check the recipient, purpose, lawful basis and minimum necessary data. Confirm whether each adviser or provider acts independently or on our instructions. For identity and authority checks, use a documented secure process; do not copy a competitor’s document list or claim regulatory registration without verification. If call recording is proposed, approve its purpose, notice, access and retention before enabling it.
Retention and deletion
Approval required: set documented retention periods and deletion triggers for unanswered enquiries, unsuccessful offers, completed purchases, complaints, consent records and backups. Base periods on business need and applicable legal requirements; do not retain everything indefinitely. Record justified legal holds and review them.
Requests and incidents
Refer requests for access, correction, erasure, objection or other rights promptly to the privacy lead. Verify identity proportionately. Log suspected breaches, contain them and assess notification duties and applicable deadlines without delay. Do not promise absolute security.
Launch checklist
Confirm the privacy lead, provider list, processing register, retention schedule, cookie inventory, security controls, staff training and complaints handling. Keep the published privacy notice aligned with actual operations. Review this policy after material changes and on an agreed schedule.