Privacy Policy

Home Privacy Policy

1. Who We Are (Data Controller)

This website is operated by VSG Global Limited, trading as Victorstone, a company registered in England and Wales under company number 13538466 (VAT No. 432 605 421), with its registered office at 213 City Road, London, EC1V 1JN (“Victorstone”, “we”, “us”, or “our”).

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act), VSG Global Limited is the data controller responsible for your personal data.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Email: directors@victorstone.co.uk
Post: Data Protection Enquiries, VSG Global Limited t/a Victorstone, 213 City Road, London, EC1V 1JN

2. Personal Data We Collect

Depending on how you interact with us (as a landlord, tenant, applicant, buyer, vendor, or website visitor), we may collect and process the following categories of personal data:

Identity and Contact Data: Full name, title, postal address, email address, and telephone numbers.
Verification and Compliance Data: Proof of identity and address (such as passport, driving licence, utility bills), nationality and immigration/Right to Rent status (where required under the Immigration Act 2014), and anti-money laundering (AML) verification records (where required under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017).
Financial and Transaction Data: Bank account details, payment records, rent and deposit records, credit referencing, employment details, and affordability assessment information for tenancy or property transactions.
Property and Tenancy Data: Details of properties you own, let, rent, or enquire about, tenancy agreements, landlord instruction terms, property management correspondence, and maintenance/repair records.
Communications Data: Records of your correspondence and enquiries with us by email, telephone, live chat, or website forms.
Technical and Website Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, language preferences, and security/anti-spam logs collected when you use our website. For details on cookies, please see our Cookie Policy.

3. How We Use Your Personal Data and Our Lawful Bases

We only process your personal data where we have a valid lawful basis under Article 6 of the UK GDPR. The table below sets out our processing purposes and the corresponding lawful bases:

Purpose of Processing	Lawful Basis under UK GDPR
Providing estate agency, lettings, and property management services (including marketing properties, arranging viewings, negotiating tenancies/sales, collecting rent, and managing repairs).	Performance of a contract with you (or taking steps at your request before entering into a contract), and our legitimate interests in delivering property services to our clients.
Conducting tenant referencing, credit checks, and guarantor assessments.	Performance of a contract and our (and our landlord clients’) legitimate interests in assessing tenancy suitability and affordability.
Carrying out statutory checks, including Right to Rent checks, anti-money laundering (AML) verification, client money protection administration, and tenancy deposit protection.	Compliance with a legal obligation to which we are subject under UK law.
Responding to enquiries, administering accounts, notifying you of changes to our terms or services, and resolving complaints (including via The Property Ombudsman).	Performance of a contract, compliance with a legal obligation, and our legitimate interests in maintaining client service standards and defending legal claims.
Sending property alerts and marketing communications where you have requested them or opted in.	Consent (which you may withdraw at any time by clicking unsubscribe or emailing directors@victorstone.co.uk) or legitimate interests (where permitted under the Privacy and Electronic Communications Regulations (PECR) for existing clients).
Operating, securing, and protecting our website against spam, unauthorized access, and malicious traffic.	Our legitimate interests in maintaining network and information security.

Where we need to collect personal data by law (for example, for anti-money laundering or Right to Rent checks) or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract or proceed with your property transaction.

We do not sell your personal data to third parties. Depending on the service we provide to you, we may share relevant personal data with the following categories of recipients:

Transaction Counterparties: Landlords, tenants, buyers, vendors, and their appointed legal or professional representatives as necessary to progress a letting, sale, or property management matter.
Regulatory, Statutory, and Redress Bodies: Tenancy deposit protection schemes, Client Money Protect (Membership No. CMP012207), The Property Ombudsman (Membership No. T09800), HM Revenue & Customs (HMRC), law enforcement agencies, local authorities, and utility/council tax providers.
Property Contractors and Professional Advisers: Vetted maintenance contractors, inventory clerks, surveyors, gas/electrical safety engineers, insurers, auditors, and legal advisers.
Website and Technical Service Providers:
- Wordfence, MalCare, and Sucuri: Website security and firewall protection.
- Google (Google Maps and Google reCAPTCHA): Interactive property maps and spam protection on enquiry forms.
- Weglot SAS: Website language translation functionality.
- AddToAny: Social sharing tool functionality.

5. International Data Transfers

We operate primarily in the United Kingdom, with international portal links and offices in the UAE and Saudi Arabia. Some of our third-party service providers may store or access personal data outside the United Kingdom.

Whenever we transfer your personal data outside the United Kingdom, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented in accordance with Chapter V of the UK GDPR:

The transfer is to a country or territory that the UK Government has determined provides an adequate level of protection for personal data (under UK Adequacy Regulations, including the European Economic Area and the UK Extension to the EU-US Data Privacy Framework where applicable); or
We have put in place appropriate safeguards, such as the UK Information Commissioner’s Office (ICO) International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), supported by a transfer risk assessment.

6. How Long We Keep Your Personal Data (Data Retention)

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements, and to establish, exercise, or defend legal claims (for example, under the Limitation Act 1980).

7. Security of Your Data

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. Access to your personal data is limited to employees, agents, contractors, and other third parties who have a business need to know. Where we have provided you with (or where you have chosen) a password or login enabling you to access certain parts of our portals or systems, you are responsible for keeping these credentials confidential.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of Access: Request access to and a copy of the personal data we hold about you (commonly known as a “Data Subject Access Request”).
Right to Rectification: Request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure: Request deletion of your personal data where there is no compelling legal or regulatory reason for us to continue processing it.
Right to Object: Object to processing of your personal data where we are relying on a legitimate interest, or object at any time to direct marketing.
Right to Restriction of Processing: Request that we suspend the processing of your personal data in certain scenarios (for example, while we verify its accuracy).
Right to Data Portability: Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format (where processing is carried out by automated means based on your consent or a contract).
Right to Withdraw Consent: Where we rely on your consent to process your personal data, you may withdraw that consent at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out before your withdrawal.

How to Exercise Your Rights: You will not normally have to pay a fee to exercise any of your rights. To make a request, please email us at directors@victorstone.co.uk or write to us at VSG Global Limited t/a Victorstone, 213 City Road, London, EC1V 1JN. We will respond to all valid requests within one month in accordance with statutory timescales.

9. Complaints

If you have any concerns about our use of your personal data, please contact us first at directors@victorstone.co.uk so we can resolve your query.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues:

Website: https://ico.org.uk
Telephone: 0303 123 1113