PRIVACY NOTICE · 15 OCTOBER 2026
Your information, explained.
This notice describes the website and customer portal operated by MACGREGOR & O'HANLON ESTATES LTD, company number 17479815, trading as O’Hanlon Estates. Registered office: 10–16 Tiller Road, London, England, E14 8PX. Correspondence address: 14/2E Docklands Business Centre, 10–16 Tiller Road, London E14 8PX.
1. Who is responsible and how to contact us
The company is the controller of personal information used to handle enquiries, operate customer accounts and manage its buyer and seller relationships. Use our enquiries form and select “Privacy request” or “Complaint”, or write to the address above, marked “Privacy”. You do not need an account to contact us about privacy. You can also email ciaran@ohanlon-estates.com. Do not include passwords, sign-in codes, bank details or identity-document images in an enquiry.
2. What this notice covers
This notice covers our public website, buyer and seller portal, enquiries and the handling of information submitted through those services. If we later need identity checks, payment details or other information for a contracted service, we will explain the additional processing when requesting it. Our website is intended for adults. It is not a service for children, and we do not knowingly seek their information.
3. Information we collect
- Enquiries: your name, email address, optional telephone number, enquiry category, message and the time and reference of your request.
- Accounts: your email address, an internal account identifier, authentication records and session information. Google sign-in confirms your email; the portal requests OpenID and email access, not access to Gmail or Google Drive.
- Buyer briefs: contact details and, if supplied, company name, locations, budget, available investment cash, property interests, funding preferences, requirements, timing and information you choose to tell us.
- Seller submissions: contact details, property address and postcode, property characteristics, asking-price expectations, ownership/authority declarations, timing, access arrangements and your stated needs.
- Account activity: submitted and revised briefs, selected properties shared with you, whether you viewed a shared package, and feedback you provide.
- Security and delivery: limited request information needed for abuse prevention, hashed IP-derived rate-limit identifiers, sign-in attempts and message-delivery information. Hosting and email providers may process their own operational logs.
Photo and video storage is not currently connected. Do not attempt to send sensitive documents through free-text fields. If private media uploads are introduced, we will update the notice and upload guidance before enabling them. Please avoid including information about other people unless you are authorised to provide it and it is relevant. Tell us if you submit information on behalf of someone else.
4. Where information comes from
We receive most information directly from you. Google supplies verified sign-in information if you choose it. Authorised staff may record details you provide in a conversation or correspondence. If we receive your information from an agent, broker or another person, we will explain the relevant source and purpose when required; we will not treat receipt as permission for unrelated marketing.
5. Why we use information and our legal bases
- Responding to a requested service enquiry and preparing a requested service: steps you ask us to take before a contract, where applicable. For general correspondence or enquiries not leading to a contract, our legitimate interest in responding and managing our business.
- Providing an agreed service: performance of our contract with you. Where you act for a company, our legitimate interest in communicating with its representatives and providing that company's service.
- Account security, abuse prevention and reliable operation: our legitimate interests in protecting customers, staff and systems and maintaining a usable service. We seek to limit the information used and the impact on you.
- Optional introductions: your specific permission for the named partner and purpose, as described below. You may refuse without losing access to an unrelated service.
- Privacy requests and applicable legal duties: compliance with legal obligations. Any anti-money-laundering or other statutory checks will be explained separately if and when required; this notice does not claim that registration is complete.
- Complaints and legal claims: legal obligations where applicable and our legitimate interests in resolving disputes and establishing or defending legal rights.
Submitting a form acknowledges that this notice is available. It is not blanket consent to all processing, partner sharing or marketing. If we rely on consent for a particular optional use, we will request it separately and explain how to withdraw it.
6. Agents, brokers and other partners
For an optional introduction, we will tell you the partner's name, the reason for the introduction, the contact details to be sent and any referral payment or conflict relevant to your decision, then obtain and record your agreement. The initial introduction will contain only the necessary name, telephone number and/or email address you approve. We will not routinely include your full brief, finances, identity documents, private notes or property-access details.
We will not sell contact lists or give an unnamed group of “partners” general permission to market to you. A partner normally acts as its own controller for its subsequent service and should provide its own privacy notice. You can decline an introduction and choose another provider. Withdrawing permission stops future consent-based sharing; it cannot reverse a disclosure already made lawfully. If additional information is later necessary, we will explain that use and establish a lawful basis before sharing it. Disclosures required by law, or appropriately limited disclosures for legal claims, are separate from optional referrals.
7. Providers that operate the service
Authorised staff access information for their work. Cloudflare provides website/portal hosting, account and brief storage, and relevant security services. Resend processes messages for delivery. Google provides optional sign-in and the business's email service where used. Postcodes.io receives postcode search text and selected postcode districts for validation through our server; we do not forward your account identity or brief with those requests. Town-name searches use our local GeoNames place-name index.
These operational providers are separate from commercial referral partners. They may necessarily process more than your name, telephone number and email, for example an enquiry message for delivery or a brief for storage. Professional advisers or authorities may receive limited information where needed for a specific lawful purpose. We do not publish your seller submission or buyer brief automatically.
8. International processing
Cloudflare, Resend and Google operate internationally and information may be processed outside the UK, including in the United States. Their published data-processing terms describe applicable transfer mechanisms, including standard contractual clauses and UK addenda where relevant. Processing location and safeguards depend on the service and transfer. We do not promise UK-only storage. Contact us for information about the safeguards applicable to your information, or a copy of the relevant terms with confidential information removed where necessary.
Provider information: Cloudflare data-processing terms, Resend data-processing terms and Google privacy information. We review supplier arrangements and must address any identified gap before extending processing.
9. How long information is kept
| Information | Retention rule | Reason and limits |
|---|---|---|
| Enquiries that do not become a client relationship | 12 months after the last meaningful contact. | Allows a customer to return to an unfinished property enquiry without keeping old leads indefinitely. |
| Buyer and seller briefs, contact details and unused customer accounts | While genuinely active; review for deletion after 12 months without meaningful customer contact, or sooner when the customer closes the enquiry. | Supports an active property search or sale. Login alone, an automated email or staff opening a record does not restart the period. Ask whether a search is still active where needed; no response does not extend retention. |
| Completed paid service records | Keep the minimum agreement, instructions, key advice, transaction and fee evidence for 6 years after the service ends. | Company policy for dealing with contract disputes, not a blanket statutory six-year rule. Review the period when paid services and their jurisdiction are confirmed. Remove unnecessary working notes and duplicate briefs sooner. |
| Accounting and tax records | Normally 6 years from the end of the last company financial year they relate to; longer where applicable tax rules require it. | Preserves accounting evidence. Ask the accountant about open enquiries, long-running transactions and other exceptions. |
| AML identity and due-diligence records | Normally 5 years after the business relationship ends, or completion of an occasional transaction. | Separate statutory category. The existing console uses relationship end dates. Review and delete at expiry unless a specific lawful exception applies; never use this period for every lead. |
| Ordinary complaints and privacy requests | 3 years after closure for the minimum request, decision and response record. | Company policy to demonstrate how the issue was handled and identify recurring problems. Remove unnecessary identity-check copies once verification is complete. A transaction dispute or documented legal hold may require relevant evidence to follow a longer, justified period. |
| Marketing objections | Keep only the minimum contact identifier and objection while needed to prevent unwanted marketing; review annually. | A suppression entry prevents someone being re-added by mistake. It is not permission to retain the complete brief or continue marketing. |
We review retention monthly and aim to delete or irreversibly anonymise eligible records within 30 days of review, subject to specific legal duties or documented holds. These reviews are managed by staff; they are not an automatic purge. Valid erasure requests follow their legal deadline rather than waiting for routine review. Legal holds are reviewed every three months. Active relationships are reviewed annually. Copies in inboxes, exports and providers are included in the review.
Sign-in codes and OAuth challenges expire after ten minutes and portal session cookies after seven days. These access lifetimes are not promises that the underlying database rows are deleted at the same time. Provider logs, email copies and backups have separate retention arrangements. We check their applicable expiry when handling a deletion and explain any remaining recovery copies. Deletion is not currently represented as an automated service. Requests will be reviewed by authorised staff, including copies held in systems and inboxes; backup copies must expire through the verified backup process and must not be restored into active use without reapplying approved deletions.
10. Cookies and local information
The portal uses essential Secure, HttpOnly cookies for sign-in challenges, Google OAuth state and an authenticated session. They support the login you request. The current application does not add advertising trackers or marketing cookies. Unsaved brief entries are held in the open page's memory; closing or reloading it can lose them. Google and other services may use their own cookies when you visit their sites. If optional analytics or marketing cookies are introduced, we will explain them and obtain consent where required before setting them.
11. Security
Controls in the application include HTTPS in production, protected staff access, account-specific access checks, server-side input validation, request limits, restricted browser permissions and protected authentication cookies. The contact form limits message length, validates entries, escapes email content and sends only to our configured business inbox. These measures reduce risk; no website, inbox or transmission can be guaranteed completely secure. Do not share login codes. Sign out on shared devices and report suspected unauthorised access through our contact route. If a breach occurs, we will assess and meet applicable notification duties.
12. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent for a consent-based activity. You have an absolute right to object to direct marketing. Other rights have exceptions, for example where retention is legally required or necessary for legal claims. We will explain a refusal or limitation and how to challenge it.
Use the enquiry form's Privacy request category or write to us. A request does not need legal wording or a special form. We may seek proportionate information to confirm identity or clarify the request, but will not ask for unnecessary sensitive documents through the public form. We will respond within the applicable legal period, normally one month, and explain any lawful extension or other change to the deadline. Requests are normally free; any lawful exception will be explained.
13. Complaints
Contact us first if you wish so we can try to resolve the issue. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. An ICO fee registration is not an endorsement or certification of privacy compliance. No ICO registration number is currently claimed.
14. Automated tools and changes
Internal tools may help staff compare property requirements and prepare research. Staff review proposed opportunities; the customer portal does not make solely automated decisions with legal or similarly significant effects on you. If that changes, we will provide the required information before the new use begins. We will date material changes to this notice and provide additional notice where appropriate. A new notice will not silently turn an old enquiry into consent for a new optional purpose.