EXLA Property Ltd is committed to respecting your security and providing quality services to you. This policy outlines our ongoing obligations to you in respect of how we manage your personal information.

Who we are?

EXLA Property Ltd, whose registered address is: Crystal Gate House, 28 – 30 Worship Street, London, EC2A 2AH, specialise solely in ex-local authority properties.

EXLA Property Ltd (EXLA London) will act as the ‘data controller’ of the personal data obtained from its clients who have a need for real estate agency services. EXLA London is committed to protecting the privacy of its clients. EXLA London will ensure that all the information submitted via its website or through our office is only used for the purposes explained in this Privacy Policy and is compliant with the General Data Protection Regulation (GDPR).

The EU GDPR (Regulation (EU) 2016/679) replaces the Data Protection Act (Directive 95/46/EC) from 25 May 2018. It is designed to harmonise data privacy laws across Europe, to protect and empower all EU citizens.

What is personal data?

Personal data is the data that relates to a living individual who can be identified from this data or other information which is in possession of, or is likely to come into the possession of, the data controller. This also includes sensitive personal data which consists of information regarding race or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, sexual orientation and criminal records. Sensitive data will only be used with your consent or where required or authorised by law.

What data do we collect?

  • Name
  • Email
  • Telephone numbers
  • Address
  • References
  • Passport or visa
  • National insurance and tax information
  • Financial information
  • Bank details
  • Images/photographs of your property (vendors and landlords)
  • Reviews/feedback from tenants (landlords)
  • Your interests and property preferences
  • Proof of ownership
  • Proof of residency
  • Certificate of Incorporation
  • Sensitive personal data (explained above)

Where do we collect your data from?*

  • Our website
  • You (application or registration form)
  • Telephone calls

*This list is not exhaustive

Why we need your data?

  • To collect, store and process it
  • To provide real estate agency services to you
  • To inform you, by email or telephone, of available properties that may be of interest to you
  • To market our real estate agency services
  • To send information to third parties which relate to our real estate agency services
  • To carry out our obligations arising from any contracts entered into between you and us
  • To notify you of any changes to our services
  • To provide information to regulatory authorities or statutory bodies
  • From time to time we may seek your consent to process, use or disclose your information for any other purpose not listed above

When we collect personal data we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

Our lawful bases for processing your data are our legitimate interests, contract, consent and legal obligation.

  1. Legitimate interests- in order to provide our services, the processing of your data is necessary for our legitimate interests provided that your interests and fundamental rights do not override those interests.
  2. Contract- we may enter into a contract with you. Thereby, most of personal data processing will be carried out according to the lawful basis of contract. To do so, certain information is needed from you such as your contact details, bank details etc.
  3. Consent- in order to process your data for some cases, we may need your consent. Such cases are when you consent to receive direct marketing or to use data for a specific reason, for instance, for reference requesting. You may withdraw your consent at any time.
  4. Legal obligation- in order to provide our services, sometimes we may need to process personal data and, where appropriate and in accordance with local laws and requirements, sensitive personal data to exercise or defend legal claims. It also applies to the business generally when complying with fraud/crime prevention, data protection legislation and co-operating with regulatory authorities such as Information Commissioner’s Office or HMRC.

Third parties

Where reasonable and practicable to do so, we will collect your personal data only from you. However, in some circumstances we may be provided with information by third parties. In such a case we will take responsible steps to ensure that you are made aware of the information provided to us by the third party.

Some of our third parties are:

  • IT systems providers and IT contractors as well as third party referencing or screening agencies for the purposes of the prevention and detection of crime;
  • Mortgage brokers we are partnered with for mortgage services and advice;
  • Independent financial advisors for advice relating to your property;
  • Solicitors and conveyancing agents for legal advice relating to your property;
  • Any other named party to a signed contract, such as your landlord or tenant;
  • Third parties who provide services to the property for maintenance and repairs including plumbers/electricians/builders/carpenters);
  • Surveying companies for surveying services required for the sale/purchase of your property;
  • Utilities companies where we are required to do so to adhere to a tenancy agreement;
  • Referencing companies to obtain references for letting a property;
  • Block managers where a let property is a leasehold property;
  • Inventory companies who conduct check ins and check outs; and
  • Insurance and warranty companies where you have decided to buy a product or service through us.

Security of personal data

Your personal data is stored in a manner that reasonably protects it from misuse and loss and from unauthorised access, modification or disclosure. When your personal data is no longer required for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify your personal data.

Maintaining the quality of your personal data

It is important to us that your personal data is up-to-date. We will take reasonable steps to make sure that your personal data is accurate, complete and up-to-date. If you find that the information we have is inaccurate, please advise us as soon possible so we can update our records and ensure we can continue to provide quality services to you.

Data retention:

We hold on to your personal data whilst you use our services or whilst we provide services connected to you. The retention period may be longer than the period for which we are providing services to you where we have statutory or regulatory obligations to retain personal information for a longer period, or where we may need to retain the information in case of a legal claim.

Your rights:

  • Right to be informed about the collection and use of your personal data.
  • Right to access your personal data and supplementary information. If you would like to make a request for information, please contact
  • Right to rectification when your data is inaccurate or incomplete. We will respond to such a request within 1 month.
  • Right to erasure where there is no compelling reason for personal data to be further processed.
  • Right to restrict processing of your personal data in certain circumstances.
  • Right to data portability when you want to obtain and reuse your personal data across different services.
  • Right to object of your data where that processing is based upon legitimate interest and there are no compelling grounds for the continued processing of that data.
  • Object to our processing of your data where that processing is based upon legitimate interest and there are no compelling grounds for the continued processing of that data; any decision, which significantly affects you, being taken solely by a computer or via another automated process; direct marketing.
  • Withdraw your consent to our processing of your personal data for a particular purpose at any stage. However, please note that we may continue to retain, or use your personal information thereafter where we have a legitimate interest or a legal or contractual obligation to do so. Our processing in that respect will be limited to what is necessary in furtherance of those interests or obligations. Consent can be withdrawn by emailing to
  • Make a complaint to the Information Commissioner’s Office.

Should you wish your personal data to be removed from our database earlier, please email us at:

Changes to our privacy policy:

We keep our privacy policy under regular review and we will place any updates on this web page. This privacy policy was last updated on May 2018.


If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to us by emailing to or the Information Commissioner’s Office (ICO).


Should there be any queries, please do not hesitate to contact us at: or by writing to:

Data Controller
EXLA Property Ltd
28-30 Worship Street