SHB Real Estate Ltd
Company Number: 10755174
Address: 14 Floral Street, Covent Garden, London, WC2E 9DH
Phone: 020 3514 8867
Email: [email protected]
Data Protection Contact: Josh Pattison – [email protected]
SHB Real Estate is committed to protecting and respecting your privacy, and we value any personal data held within our organisation. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how it will be handled.
This Privacy Policy applies to the personal data of tenants and occupiers, landlords, buyers, sellers, website visitors, prospective clients, event attendees, suppliers, and other people who may contact us to find out more about properties or the services we offer.
Who we are
In this privacy notice, whenever you see the words ‘We’, ‘Us’ or ‘Our’, it refers to SHB Real Estate Ltd (‘SHB’), a company registered in England and Wales with company number 10755174 and registered offices at 14 Floral Street, London, WC2E 9DH.
‘Data Protection Laws’ means laws and regulations including but not limited to the UK General Data Protection Regulation (as defined in s.3(1) of the Data Protection Act 2018, or ‘UK GDPR’) and the Data Protection Act 2018.
SHB Real Estate is regulated by the Royal Institution of Chartered Surveyors (RICS) and is subject to the RICS Rules of Conduct and relevant professional standards. As a RICS-regulated firm undertaking the exchange of property by letting and sale, we are also subject to obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the AML Regulations), as supervised by HMRC. These regulatory obligations require us to collect and retain certain personal data regardless of individual consent, as set out below.
For different processes, we are either a data controller or processor. Where we are the controller, we decide what data is used, about whom, in what format, for how long, and with whom it is shared.
Our partner companies
SHB Real Estate operates as part of a group of associated companies and brands that provide complementary services across the full commercial property lifecycle. These entities may act as separate Data Controllers or, where services are jointly delivered, as joint controllers under Article 26 UK GDPR.
The network includes the following entities
• SHB Real Estate – commercial property advisory and tenant representation
• TERA – portfolio intelligence and lease management
• Papilio – landlord-side property and asset management
• Foreview – business rates mitigation (partner service)
Your personal data may be shared between these entities where: (i) you have enquired about or engaged with a service delivered by one or more of them; (ii) we have identified a legitimate interest in introducing you to a complementary service relevant to your property or business strategy; or (iii) you have given consent to such sharing. All entities receiving data are bound by this policy and applicable data protection law. We maintain internal data sharing agreements between group entities governing such transfers.
Data protection principles
For us to comply with Data Protection Laws, personal information we hold about you must be:
• Used lawfully, fairly and in a transparent way
• Collected only for valid, clearly explained purposes and not used incompatibly with those purposes
• Relevant to the purposes we have told you about and limited only to those purposes
• Accurate and kept up to date
• Kept only as long as necessary for the purposes we have told you about
• Kept securely
Individual tenants, occupiers, buyers and sellers
The type of personal information we collect
• We will collect, store and use personal information about you that relates to your engagement with us. This includes:
• Name, email address, telephone number(s)
• Proof of identity and proof of address
• Bank statements and sources of funds
• Immigration status (where required for right-to-rent checks)
• Financial conduct history and credit records
• Information required for Anti-Money Laundering (AML) compliance, including source of wealth, politically exposed person (PEP) status, and sanctions screening results
• Any other information required to complete a property letting or sale transaction
How we get your personal information and why we have it
• By entering your details on our website to submit an enquiry about a property or service
• By completing a registration or application form as part of a letting, sale or purchase process
• By contacting us with enquiries by telephone, email or through our website
• By completing a form to register for events or market updates
We may also receive data from third parties, including
• Property portals such as Zoopla, LoopNet, OnTheMarket and CoStar
• Credit reference agencies
• Employers and professional referees
• HMRC and other regulatory bodies for AML compliance purposes
• Companies House and other public registers
• Sanctions screening databases and PEP checking services
• LinkedIn or company websites where our services may benefit
Landlords and corporate clients
The type of personal information we collect
We collect and use the following information about individuals at landlord and corporate client organisations:
• Name, company email address, telephone number(s)
• Role and professional title
• Bank details for payment of fees and settlement of transactions
• Information required for AML compliance, including beneficial ownership details, source of funds, and PEP/sanctions screening where applicable
How we get the personal information and why we have it
• By direct contact – telephone, email, or through our website
• By completing a form to register for events, property alerts or market updates
• Through a property portal, referral or introduction from a third party
• From Companies House or other public registers as part of our AML due diligence process
Situations in which SHB will process your personal data
Tenant / Occupier / Buyer / Seller Data
• To provide letting and sales services – collecting name, email, telephone, credit records, workplace and bank statement to help you find or complete a property transaction. Lawful basis | Contract: processing is necessary to perform a contract, or to take steps at your request prior to entering a contract.
• To carry out Anti-Money Laundering checks, including verification of identity, source of funds, PEP screening and sanctions checks, as required under the AML Regulations 2017. As a RICS-regulated firm undertaking property transactions by letting or sale, we are legally required to conduct these checks and to retain records for a minimum of 5 years after the end of the business relationship. Lawful basis | Legal obligation: processing is necessary to comply with the AML Regulations 2017 and RICS AML guidance, for which SHB is supervised by HMRC.
• To process payment of fees for services you contract from SHB, we will collect bank details. Lawful basis | Contract: processing is necessary for a contract between SHB and the individual.
• To send you relevant property details and market updates throughout your search. You are free to opt-out at any time. Lawful basis | Legitimate interest: SHB has assessed that introducing services closely related to an active property need represents a legitimate interest. You may opt out at any point.
• To introduce you to complementary services within the SHB group (e.g. fit-out, ESG advisory, business rates) where relevant to your property requirement. Lawful basis | Legitimate interest: SHB has assessed that introducing services closely related to an active property need represents a legitimate interest. You may opt out at any point.
• For internal analytics and the improvement of our services. Lawful basis | Legitimate interest: data is anonymised for this purpose.
Landlord Data
• To provide property letting, sale, advisory, management or related services – collecting name, contact details and, where relevant, bank details. Lawful basis | Contract: processing is necessary to perform a contract or take steps prior to entering a contract.
• To carry out Anti-Money Laundering due diligence on landlord clients, including identity verification, beneficial ownership checks and source of funds verification, as required under the AML Regulations 2017. Lawful basis | Legal obligation: required by the AML Regulations 2017 as supervised by HMRC. Records must be retained for a minimum of 5 years after the end of the business relationship.
• To process payment of fees and to settle transactions on your behalf. Lawful basis | Contract: processing is necessary for a contract between SHB and the individual.
Supplier Data
• To communicate with suppliers, including company email addresses and phone numbers of relevant individuals. Lawful basis | Contract: processing is necessary for a contract with the supplier or to take steps prior to entering a contract.
• To pay for services provided, we will collect bank details where this forms part of the contractual arrangement. Lawful basis | Contract: processing is necessary for a contract between SHB and the supplier.
Marketing
SHB sources business contact details from publicly available platforms, company websites and professional directories to conduct B2B outreach to individuals who may have a legitimate professional interest in our services. Before contacting you, we carry out a Legitimate Interests Assessment to confirm the basis for contact is proportionate and unlikely to be overridden by your rights.
When we contact you for the first time using data obtained from a third-party source, we will: (i) identify ourselves and the category of source from which we obtained your details; (ii) explain the purpose and lawful basis for contact; and (iii) provide a simple means of opting out of future communications.
Our marketing communications are informational in nature – sharing market trends, property availability and strategic insight relevant to your role and sector.
If at any time you do not wish to receive further information about us and our services, all communications will provide an easy opt-out. If you want to be removed from all databases, please contact us: [email protected].
Cookies
Our website uses cookies and similar technologies to distinguish you from other users, to remember your preferences, and to understand how our website is used. A cookie is a small text file that is placed on your device when you visit a website, allowing that website to recognise your device on return visits.
Some cookies are essential for the website to function and do not require consent. Others are used for analytics, functionality, or marketing purposes, and will only be set once you have given your consent. When you first visit our website, you will be asked to choose which categories of cookies you are willing to accept. You may change your preferences or withdraw consent at any time through your browser settings or our cookie preference tool. Further detail on the specific cookies we use, their purpose, and their duration is set out in our Cookie Policy, available on our website.
Remarketing
We may use remarketing services provided by third parties, which place a cookie on your device when you visit our website. This allows us to display relevant SHB advertising to you when you visit other websites, based on pages you have viewed on our site. Remarketing cookies are only set where you have given consent to marketing cookies. You can opt out of remarketing at any time through your browser or cookie preference settings.
Third-party advertising
Where third parties place advertising on our website, those parties may use their own cookies or similar tracking technologies to measure the performance of their adverts and to personalise the content shown to you. We do not control these technologies and this policy does not extend to the data practices of third-party advertisers. We recommend reviewing the privacy policy of any third party whose advertising appears on our site if you have questions about their data practices.
Anti-money laundering obligations
As a RICS-regulated firm engaged in the exchange of property by letting and sale, SHB Real Estate is a ‘relevant person’ under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, supervised by HMRC.
We are required by law to
• Verify the identity of clients before entering into a business relationship or completing a transaction
• Conduct ongoing monitoring of business relationships
• Screen individuals against sanctions lists and politically exposed persons (PEP) databases
• Obtain information about the source of funds and, where appropriate, source of wealth
• Report suspicions of money laundering to the National Crime Agency (NCA) via a Suspicious Activity Report (SAR) where required
• Retain records of due diligence undertaken for a minimum of five years after the end of the business relationship
You are not able to opt out of AML data processing. This is a legal requirement and we are unable to act on your behalf in a property transaction without completing the required checks. Where we are required to submit a SAR, we may be prohibited by law from informing you that a report has been made (the ‘tipping off’ provisions under the Proceeds of Crime Act 2002).
Financial processing
Payment card information
Where you provide payment card details to SHB, for example to pay fees or settle an invoice, this information is processed securely and in accordance with the Payment Card Industry Data Security Standard (PCI DSS). Card details are encrypted and access is restricted to authorised staff only. We do not retain full card details beyond what is required to process the transaction, and any stored reference data is automatically removed once no longer needed. Where we discuss payment details with you, we will only confirm the last four digits of a card number for identification purposes.
Direct debit
Where you set up a direct debit arrangement with SHB, the information you provide is passed to our bank for processing in accordance with your instructions. We retain this information only for the duration of the direct debit arrangement. SHB is registered under the Direct Debit Guarantee scheme, under which your bank will refund any disputed payment without question while the matter is investigated.
How do we uphold your rights?
We aim to tailor our communications and ensure you can opt-in to receive the information you want. Under UK GDPR you have the following rights in relation to your personal data:
• Request access – receive a copy of the personal information we hold about you
• Request correction – have incomplete or inaccurate information corrected
• Request erasure – ask us to delete personal information where there is no good reason for continued processing
• Object to processing – particularly where we rely on legitimate interests. You have an absolute right to object to direct marketing
• Request restriction of processing
• Request data portability – receive your data in a portable format for transmission to another controller
• Right not to be subject to solely automated decision-making that produces legal or similarly significant effects (we do not use automated decision-making)
Please note that AML data is processed under a legal obligation. Requests for erasure or restriction of processing do not apply to data we are legally required to retain under the AML Regulations 2017.
To exercise any of the above rights, please contact: [email protected]
How do we store your personal data?
All personal data we hold is stored on servers located within the United Kingdom. We do not currently transfer personal data outside the UK in the course of our standard operations. Where any processor or partner service involves data storage or processing outside the UK, we will ensure appropriate safeguards are in place, including Standard Contractual Clauses or an International Data Transfer Agreement.
This policy is reviewed and updated regularly to ensure we do not store data for longer than necessary.
Retention periods are as follows
• AML due diligence records: 5 years minimum from the end of the business relationship, as required by the AML Regulations 2017
• Active client and transaction data: 7 years from the end of the transaction or business relationship
• Prospect and marketing contact data (engaged): 3 years from last engagement
• Prospect data (not engaged following initial outreach): reviewed at 12 months and deleted if no legitimate basis for retention remains
• Suppressed/opted-out contacts: retained indefinitely on suppression list to prevent future unsolicited contact
• Recruitment applicant data (unsuccessful): 6 months following the outcome of the application
• Financial records: 7 years to comply with HMRC requirements
Data sharing
We share data between SHB group companies (TERA, Papilio, Foreview) where there is a legitimate interest or contractual basis for doing so.
• All partner entities are bound by this policy and internal data sharing agreements.
• If you are a seller or landlord, we will share your details with buyers, tenants or their legal representatives once a transaction is in progress.
• We may share data with third parties including third-party service providers
• We are required to share information with HMRC as our AML supervisor, the NCA (via SARs) where legally required, and with other regulatory bodies including RICS where relevant to our professional obligations
• We require all third parties to respect the security of your data and treat it in accordance with the law
• We may transfer personal information outside the UK only with appropriate safeguards in place
What about third parties?
We may disclose your personal information to third parties where:
• We are under a duty to disclose in order to comply with a legal obligation (Article 6(1)(c))
• In order to enforce or apply any agreements
• To protect the rights, property or safety of SHB or others
SHB may disclose personal data to the following categories of recipients:
• Business partners, suppliers and contractors for the performance of any contract we enter with them or you
• Companies within the SHB group where necessary for administrative purposes and to provide services to you
• Third parties that support us in providing products and services (e.g. IT support, cloud-based software, telecommunications providers)
• Marketing services providers
• AML screening and identity verification providers
• HMRC (AML supervisor) and the NCA where legally required
• RICS and other professional or regulatory bodies where required by our professional obligations
How secure is my information?
To help protect the privacy of data and personally identifiable information, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to personal data to those employees who need to know that information to provide services to you. We train employees on the importance of confidentiality and maintaining the privacy and security of personal data.
Automated decision making
We do not make automated decisions about you that would have a significant legal or similarly significant effect. We will notify you in writing if this position changes
Privacy notice – recruitment
This section provides information about personal data we collect and process relating to job applicants. Data is limited to that which is relevant for recruitment and selection purposes.
The Data Controller for recruitment data is SHB Real Estate Ltd. Josh Pattison is the data protection contact for recruitment matters: [email protected].
We process recruitment data on the following bases: to take steps prior to entering a contract of employment; to meet legal obligations as an employer; and to pursue the legitimate interests of the business in managing the recruitment process.
If you are unsuccessful, we may retain your details for up to 6 months in case a suitable vacancy arises. Data will not be shared with third parties except those involved in the recruitment process, or where required following a successful application (e.g. payroll, HR, occupational health providers).
No automated decision-making is used in the recruitment process.
How to complain
If you have any concerns about how we use your personal information, you can make a complaint to us at [email protected].
You can also complain to the ICO if you are unhappy with how we have used your data: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 (local rate)
Website: https://ico.org.uk/concerns
Changes to this privacy notice
We reserve the right to update this privacy notice at any time. The current version will always be published on our website. We may also notify you in other ways about the processing of your personal information.