1. Introduction & Data Controller
SPI Surveyors Ltd is the data controller for personal data collected in connection with our services. We comply with the UK GDPR (as retained by the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018.
- Company: SPI Surveyors Ltd
- Company No.: 15205127
- Registered address: First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW
- Email: info@spi-surveyors.com
- Telephone: 0161 552 5151
2. Personal Data We Collect
- Identity Data: name, title, date of birth (where required for identity verification)
- Contact Data: postal address, email, telephone
- Property Data: address and details of the subject property
- Financial Data: transaction records, payment references (card details not stored — processed by Stripe, PCI-DSS compliant)
- Documentary Data: ID documents for anti-money laundering checks
- Technical Data: IP address, browser type, time zone, operating system
- Usage Data: how you use our website and services
- Communications Data: email, telephone, post or enquiry form correspondence
- Marketing & Preference Data: marketing and communication preferences
Data is collected via: website, booking forms, telephone, email, and third-party channels (HomeMove, estate agents, financial advisers).
3. Legal Basis for Processing
- Performance of a contract (Article 6(1)(b)): to deliver the services you have engaged us to provide
- Compliance with a legal obligation (Article 6(1)(c)): anti-money laundering, RICS obligations, tax requirements
- Legitimate interests (Article 6(1)(f)): fraud prevention, business administration, direct marketing to existing clients
- Consent (Article 6(1)(a)): for marketing. You may withdraw consent at any time without affecting the lawfulness of prior processing
4. How We Use Your Personal Data
- Fulfil contractual obligations: scheduling, reports, invoicing, communication
- Process and manage payments; collect outstanding debts
- Manage your client portal account
- Communicate with estate agents, vendors and landlords to arrange access
- Comply with RICS regulatory and legal obligations
- Verify identity; carry out anti-money laundering and fraud prevention checks
- Respond to and manage complaints and disputes
- Improve our website, services and operations
- Send marketing communications (where consented or legitimate interest applies)
- Maintain records and audit obligations
5. Sharing & Disclosing Personal Data
We do not sell, rent or trade your personal data. We may share with:
- Service providers acting as data processors (IT, cloud storage, Stripe, email, specialist sub-contractors)
- Introducers and marketplace partners (e.g. HomeMove) to the extent necessary for the instruction
- Estate agents, vendors and landlords to arrange property access
- Fraud prevention agencies and credit reference agencies
- Regulators, authorities and courts where required by law (including RICS Regulation)
- Professional advisers: solicitors, accountants, insurers
- Successor businesses in a merger, acquisition or sale
Data processing agreements are in place with all third-party processors. We will not share your data for third-party direct marketing without your consent.
6. Data Retention
- Client records and Reports: 6 years from Report date (Limitation Act 1980)
- Financial/payment records: 7 years (HMRC requirements)
- RICS professional records: minimum periods required by RICS
- Marketing data: until consent withdrawn or objection received
- Website enquiry data: 12 months (unless a contract was formed)
Data is securely deleted or anonymised after the applicable retention period expires.
7. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encrypted cloud-hosted storage
- Role-based access controls
- Multi-factor authentication
- Regular security reviews
- Stripe for PCI-DSS compliant card processing
- Secure paper disposal procedures
Email transmissions may be insecure in transit. We will never ask for your client portal password.
8. Your Rights Under UK GDPR
- Right to be informed — this Policy
- Right of access — Subject Access Request
- Right to rectification — correct inaccurate data
- Right to erasure — "right to be forgotten" where lawful
- Right to restrict processing
- Right to data portability
- Right to object — including to direct marketing at any time
- Rights related to automated decision-making
To exercise your rights, contact us at info@spi-surveyors.com. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO: ico.org.uk — 0303 123 1113.
9. International Transfers
Data is stored in the UK/EEA where possible. Where third-party providers transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO.
10. Cookies Policy
- Strictly necessary cookies: essential for website operation and cannot be disabled
- Analytical/performance cookies: Google Analytics (aggregated, anonymised data). Opt out via the Google Analytics Opt-out Browser Add-on
- Functionality cookies: personalisation and preference cookies
You can control and manage cookies via your browser settings. Continued browsing of our website constitutes acceptance of cookies under this Policy.
11. Updates to This Policy
We review this Policy regularly. Any changes will be published at spi-surveyors.com/privacy with an updated effective date. Where changes are material, we will notify you where practicable.
12. Contact & DPO Details
For any data protection queries, Subject Access Requests or to exercise your rights, please contact us using the details below.