Privacy policy

Template prepared 10 November 2026. It describes how this UK site is built today, including agent accounts and buy-to-let deal-alert signups.

Who we are

The data controller for personal information collected through rightplace8.co.uk is:

• Legal name: [LEGAL NAME OF THE CONTROLLER]
• Trading name, if different: [TRADING NAME]
• Company number, if a UK company: [COMPANY NUMBER]
• Registered office: [REGISTERED OFFICE ADDRESS]
• Privacy contact: [PRIVACY EMAIL ADDRESS]
• ICO registration number, if registered: [ICO REGISTRATION NUMBER]
• Data protection lead or DPO, if you have one: [NAME AND CONTACT, OR DELETE THIS LINE]

Rightplace is a UK property website. It publishes buy-to-let town briefings from official open data and lists homes submitted by agents. It is not a lender, valuer or financial adviser.

What we collect

Ask questions (AskLog). We store the questions you ask (not your name or IP) to improve answers and see what people want to know. We keep a random session cookie id, whether the answer was marked helpful, and a short outward postcode area if one appears in the question. Emails, phone numbers and listing links are stripped before storage. Rows are auto-deleted after 12 months.

Deal-alert signups. If you use a “weekly deals” form on a buy-to-let area page, we store the name you type (optional), your email address, the town, the date and time, and the tokens in your confirmation, unsubscribe and delete links. We email you a confirmation link. You are added to the list only after you open it. The weekly email, once an administrator sends it, goes only to confirmed addresses that have not unsubscribed. Each email contains a one-click unsubscribe link and a link to delete your details.

Agent and admin accounts. If you register or sign in, we store your email address, a password hash (not the password itself), display name, company name, phone number if you provide one, verification status, and the usual sign-in security stamps used by ASP.NET Core Identity.

Listings you submit. Agents can submit property details, prices, addresses and photos. Those are published when a moderator approves them. Do not put a tenant’s or buyer’s private contact details in a listing description.

Technical logs. The server may keep IP address, browser type, the page requested and error details for security and troubleshooting. Retention: [LOG RETENTION PERIOD, FOR EXAMPLE 30 DAYS].

We do not ask you to create an account to read a town briefing or to browse published listings.

Why we use it, and the lawful basis to confirm

The owner needs to confirm each basis before going live. A reasonable starting point for this site is:

• Deal alerts. You asked to be on a town’s list. Basis to confirm: legitimate interests in sending the list you requested, or consent if you prefer to treat the tick as consent. Either way, people must be able to get off the list and have the row deleted. Contact: [PRIVACY EMAIL ADDRESS].
• Accounts and listings. Basis to confirm: contract, so agents can submit and manage listings and so admins can moderate them.
• Security logs. Basis to confirm: legitimate interests in keeping the site secure.
• Legal claims or regulatory requests. Basis to confirm: legal obligation, where one actually applies.

We do not sell personal information. We do not use it for automated decisions that produce legal effects.

Who we share it with

People who operate the site can see deal-alert rows and account data: [NAME THE ROLES, FOR EXAMPLE THE DIRECTOR AND THE HOSTING ADMINISTRATOR].

Hosting and database location: [WHERE THE SITE AND SQL SERVER DATABASE ARE HOSTED, FOR EXAMPLE A UK DATA CENTRE, AND THE PROVIDER’S NAME].

Some public pages load assets from other companies. Those companies may see your IP address when your browser requests the file:

• Homepage photographs are loaded from images.unsplash.com.
• The market analytics page loads Chart.js from jsDelivr (cdn.jsdelivr.net).
• The intelligence desk (market-intelligence.html) loads fonts from Google Fonts, Tailwind from cdn.tailwindcss.com, and chart, spreadsheet and PDF scripts from jsDelivr.
• The decision desk (decision-dashboard.html) loads Google Fonts, Tailwind, Leaflet and map tiles from CARTO / OpenStreetMap (basemaps.cartocdn.com), plus Chart.js, SheetJS and jsPDF from jsDelivr or cdnjs.

The weekly deals email is sent through the provider configured for the site (SMTP, SendGrid or Brevo). The API key or mailbox password is not stored in the public site. In development, when no provider is configured, the message is written to the server log instead of being delivered. Name the provider you actually switch on before you treat this page as live: [EMAIL PROVIDER].

International transfers

[STATE WHETHER PERSONAL DATA STAYS IN THE UK. IF A HOST, CDN OR FUTURE EMAIL PROVIDER PROCESSES IT OUTSIDE THE UK, NAME THE COUNTRY AND THE SAFEGUARD, SUCH AS UK IDTA OR A UK ADEQUACY REGULATION.]

How long we keep it

• Deal-alert signups: [RETENTION, FOR EXAMPLE UNTIL THE PERSON ASKS US TO DELETE THEM, OR 24 MONTHS AFTER THE LAST EMAIL IF THEY DO NOT OPEN IT].
• Agent accounts: [RETENTION, FOR EXAMPLE FOR AS LONG AS THE ACCOUNT IS OPEN, THEN DELETE OR ANONYMISE WITHIN X MONTHS OF CLOSURE].
• Listing content: kept while the listing is published and for [PERIOD] after it is withdrawn, unless a longer period is needed for a complaint.
• Ask questions (AskLog): deleted automatically after 12 months.
• Server logs: [LOG RETENTION PERIOD].

Cookies

The public town pages and listing pages do not set an advertising or analytics cookie.

• If you sign in, ASP.NET Core Identity sets an essential cookie so you stay signed in.
• Forms that change data (sign-in, registration, listing edits, deal-alert signup) set an essential antiforgery cookie to block cross-site requests.

Third-party scripts listed above may set their own cookies. Check that and, if they do, name them here or remove the scripts: [THIRD-PARTY COOKIES FOUND, OR “NONE CONFIRMED”].

Your rights

If UK GDPR applies, you can ask to access, correct, erase or restrict your personal information, and you can object to processing based on legitimate interests. You can ask for a copy in a portable format where the basis is contract or consent. Where we rely on consent, you can withdraw it at any time.

Write to [PRIVACY EMAIL ADDRESS]. We may need to confirm it is you. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.

Children

The site is aimed at adults looking at property. We do not knowingly collect information from children.

Changes

When this notice changes, update the date at the top and [SAY WHERE MATERIAL CHANGES WILL BE ANNOUNCED, FOR EXAMPLE ON THIS PAGE].