Privacy Policy

How we collect, use and protect your personal information

Last updated: 1 January 2025 Version: 2.0 Applies to: surreysurveyor.com

  We are committed to protecting your privacy. This policy explains clearly what data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who We Are

Surrey Surveyor is a trading name of Surrey Surveyor Ltd, a company registered in England and Wales. We provide professional property surveying services, including RICS-level building surveys, HomeBuyer reports, party wall advice, RICS valuations, defect analysis, and commercial surveys.

Data Controller: Surrey Surveyor Ltd
Registered address: Surrey, England
Website: www.surreysurveyor.com
Email: info@surreysurveyor.com

2. Data We Collect

We may collect and process the following categories of personal data:

2.1 Identity & Contact Information

  • Full name
  • Email address
  • Telephone number
  • Postal address (if provided)

2.2 Property Information

  • Property address for survey purposes
  • Property type and purchase price (if provided)
  • Survey type requested

2.3 Technical / Usage Data

  • IP address and browser type
  • Pages visited and time spent on site
  • Referring website or search term
  • Device type and operating system

2.4 Communications Data

  • Email correspondence with us
  • Notes from telephone conversations (with your consent)
  • HubSpot CRM form submissions

We do not collect special category data (e.g. health, financial, or ethnicity data) unless you voluntarily provide it in a free-text field.

3. How We Collect Your Data

  • Contact forms – embedded HubSpot forms on our website
  • Direct email or telephone – when you contact us directly
  • Cookies & analytics – automatically via browser cookies (see Section 9)
  • Referral partners – estate agents or solicitors who refer you to us (with your knowledge)

4. How We Use Your Data

We use your personal data for the following purposes:

  • To respond to your enquiry and provide you with a survey quote
  • To deliver the surveying services you have commissioned
  • To send you your survey report and any follow-up correspondence
  • To send marketing communications (only where you have consented or we have a legitimate interest)
  • To improve the content and performance of our website
  • To comply with legal and regulatory obligations (e.g. RICS, ICO)
  • To manage our business records and accounting

Under UK GDPR Article 6, we rely on the following lawful bases:

  • Contract – processing is necessary to fulfil a survey contract with you (Art. 6(1)(b))
  • Legitimate interests – following up on enquiries, improving our services, preventing fraud (Art. 6(1)(f))
  • Consent – for marketing emails where you have explicitly opted in (Art. 6(1)(a)). You may withdraw consent at any time.
  • Legal obligation – retaining financial and professional records as required by law (Art. 6(1)(c))

6. Data Sharing & Third Parties

We do not sell your personal data to third parties. We may share your data with:

  • HubSpot Inc. – our CRM and form platform (data processed in the USA under EU–US Data Privacy Framework)
  • Google Analytics / Google LLC – anonymous website usage analytics
  • Email service provider – to send transactional emails
  • Professional indemnity insurers – in the event of a claim (personal data only as strictly necessary)
  • RICS / RPSA / CIOB – regulatory bodies (only if required for a complaint or disciplinary matter)
  • Legal and accounting advisors – under confidentiality obligations

7. Data Retention

We retain your personal data for the following periods:

  • Survey reports and professional records: 15 years (RICS Professional Standards requirement)
  • Financial records: 7 years (HMRC requirement)
  • Marketing data: Until you withdraw consent or 3 years of inactivity
  • Website enquiries not converted to a contract: 12 months
  • Technical / cookie data: As per our cookie policy (see Section 9)

After retention periods expire, data is securely deleted or anonymised.

8. Your Rights

Under UK GDPR you have the following rights:

  • Right of access – request a copy of the personal data we hold about you (Subject Access Request)
  • Right to rectification – request correction of inaccurate or incomplete data
  • Right to erasure – request deletion of your data ("right to be forgotten") where no lawful basis exists for continued processing
  • Right to restrict processing – request that we limit how we use your data
  • Right to data portability – receive your data in a structured, machine-readable format
  • Right to object – object to processing based on legitimate interests or for direct marketing
  • Rights relating to automated decision-making – we do not use solely automated decision-making that produces legal effects
  • Right to withdraw consent – at any time, where processing is based on consent

To exercise any of these rights, please email us at info@surreysurveyor.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.

9. Cookies

Our website uses cookies — small text files stored on your device. We use:

  • Essential cookies – required for the website to function (session management, security). These cannot be disabled.
  • Analytics cookies – Google Analytics (GA4) to understand how visitors use our site (anonymous data, IP anonymisation enabled).
  • Marketing / CRM cookies – HubSpot tracking cookie (hubspotutk) to track form submissions and associate CRM records.

Managing Cookies

You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the website. Visit allaboutcookies.org for guidance on managing cookies in your browser.

10. Data Security

We take reasonable technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure or destruction. These measures include:

  • HTTPS encryption on all pages of our website
  • Secure, password-protected access to our CRM (HubSpot)
  • Restricted staff access to personal data on a need-to-know basis
  • Regular security reviews of our systems and third-party processors

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and you directly where required.

11. International Transfers

Some of our third-party providers (e.g. HubSpot, Google) process data outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

  • UK adequacy regulations or adequacy decisions
  • Standard Contractual Clauses (SCCs) approved by the ICO
  • Participation in an approved transfer mechanism (e.g. EU–US Data Privacy Framework)

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us:

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint/  |  0303 123 1113