Last updated: 2 September 2026
1. Introduction
Paul O'Shea Homes is committed to protecting your privacy and handling your personal information responsibly.
This Privacy Policy explains how we collect, use, store and share personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
For the purposes of data protection law, Paul O'Shea Homes is the data controller for personal information that we determine how and why to process.
Paul O'Shea Homes Limited registered at Airport House, Purley Way, Croydon, CR0 0XZ. Registered in England and Wales. Our registered number is 08713870. Our VAT number is 174924384.
2. Personal Information We Collect
Depending on your relationship with us, we may collect and process information including:
- your name, address and contact details;
- details about properties you own, occupy, wish to purchase, sell, rent or let;
- identification documents such as passports and driving licences;
- date of birth and other information required for identity verification;
- information relating to the source of funds or source of wealth where required for anti-money laundering checks;
- financial and transaction information;
- correspondence, enquiries and records of our communications with you;
- information concerning property viewings, offers and transactions;
- information supplied by your solicitor, mortgage broker, surveyor or other professional adviser;
- information required to comply with our legal and regulatory obligations; and
- information collected when you visit or interact with our website or online services.
3. How We Use Your Information
We may process your information for purposes including:
- providing estate agency and property-related services;
- arranging valuations, viewings, offers and property transactions;
- communicating with buyers, sellers, landlords, tenants and professional advisers;
- administering our relationship with clients and customers;
- verifying your identity;
- complying with anti-money laundering, terrorist financing and other legal and regulatory requirements;
- preventing and detecting fraud and other unlawful activity;
- establishing, exercising or defending legal claims;
- operating and improving our business and services; and
- sending marketing communications where permitted by law.
Our lawful bases for processing personal information may include performance of a contract, compliance with a legal obligation, legitimate interests, recognised legitimate interests where applicable, and consent where required.
4. Identity and Anti-Money Laundering Checks
As an estate agency business, we are required to carry out customer due diligence and identity checks under UK anti-money laundering legislation.
We may use specialist identity verification providers, including Landmark and Credas, to assist us with these checks.
These checks may involve the collection of a photograph or video image of you and comparison of that image with the photograph contained within an identity document.
Our principal lawful basis for processing personal information required to fulfil our statutory anti-money laundering obligations is compliance with a legal obligation.
5. Biometric Information
Where an identity verification service technically processes facial characteristics for the purpose of uniquely verifying your identity, this constitutes biometric data and is treated as special category personal information under UK data protection law.
Special category biometric information requires both an appropriate lawful basis under Article 6 UK GDPR and a separate condition under Article 9 UK GDPR.
Where applicable, biometric information may be processed for purposes including preventing or detecting unlawful acts and satisfying anti-money laundering and identity-verification requirements. We and our service providers are required to ensure that any such processing is necessary, proportionate and subject to appropriate safeguards.
We do not use biometric information for general profiling, marketing or surveillance.
The precise information retained by an identity verification provider and the period for which it is retained may depend upon the service used and the provider's applicable data retention arrangements.
6. Automated Processing and Identity Verification
Our identity verification providers may use automated technology when checking identity documents, photographs and other verification information.
An automated verification result does not necessarily determine whether we will provide a service to you. Where an automated check produces an unsuccessful, uncertain or potentially incorrect result, the matter may be reviewed manually and we may ask you to provide alternative evidence of identity.
Where a decision is made solely by automated processing and has a legal or similarly significant effect on you, applicable data protection law provides safeguards which may include the right to:
- receive information about the decision;
- make representations about it;
- obtain human intervention; and
- contest the decision.
Please contact us if you believe an automated decision concerning you requires review.
7. Sharing Your Information
Where necessary, we may share personal information with organisations including:
- identity verification and anti-money laundering providers, including Landmark and Credas;
- our property and customer relationship management software providers;
- Google and other business technology providers;
- solicitors and conveyancers;
- mortgage brokers and financial advisers;
- surveyors and other property professionals;
- contractors and service providers;
- landlords, sellers, purchasers or other parties to a property transaction where appropriate;
- HM Revenue & Customs, law enforcement agencies, regulators or other public bodies where required or permitted by law; and
- professional advisers such as accountants, insurers and legal advisers.
We only share information where there is an appropriate reason for doing so and require service providers processing information on our behalf to protect it appropriately.
8. International Transfers
Some technology and service providers may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law. Depending on the destination and circumstances, these safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another lawful transfer mechanism.
9. How Long We Keep Your Information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet our legal, regulatory, accounting and professional obligations.
Records required under anti-money laundering legislation will generally be retained for the applicable statutory period, normally five years following the end of the relevant business relationship or as otherwise required by law.
Other information may be retained for different periods depending upon the nature of our relationship with you and our legal and legitimate business requirements.
When information is no longer required, it will be securely deleted or anonymised where appropriate.
10. Your Data Protection Rights
Subject to certain legal limitations, you may have the right to:
- ask us for access to personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to erase your personal information;
- ask us to restrict how your information is processed;
- object to certain types of processing;
- request transfer of your information in certain circumstances;
- withdraw consent where processing is based upon consent; and
- exercise applicable rights concerning significant automated decision-making.
These rights do not apply in every circumstance. For example, we may need to retain information where we are legally required to do so.
11. Data Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
Where we use third-party processors, we require appropriate contractual and security arrangements to protect personal information processed on our behalf.
12. Complaints and Contact
If you have any questions about this Privacy Policy, would like to exercise your data protection rights or wish to complain about how we have used your personal information, please contact Paul O'Shea Homes.
Paul O'Shea Homes
https://paul-oshea.co.uk
[email protected]
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Further information is available from the Information Commissioner's Office at www.ico.org.uk.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our services, systems, suppliers or legal obligations.
The current version will be published on our website together with the date on which it was last updated.
