General Data Protection & Privacy
Last updated: August 2026
Who We Are
Pole Star Property Services Ltd is the data controller for personal data collected through this website and in connection with our surveying and property services.
We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is ZB207136. You can verify this at ico.org.uk.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What Personal Data We Collect
Depending on the service you use, we may collect:
- Your name, email address, and phone number
- Your property address and any property-related information you provide
- Your current residential address (where required for Terms of Engagement)
- Payment information (processed by Stripe — we do not store card details)
- Photos you upload in connection with a survey or consultation
- Communications between us (emails, messages)
- Website usage data (analytics cookies — only with your consent)
Lawful Bases for Processing
We process your personal data on the following lawful bases under UK GDPR Article 6:
| Processing activity | Lawful basis |
|---|---|
| Providing survey and inspection services | Contract (Article 6(1)(b)) |
| Providing Location Reports | Contract (Article 6(1)(b)) |
| Sending quotes, invoices, and Terms of Engagement | Contract (Article 6(1)(b)) |
| Responding to enquiries | Legitimate interests (Article 6(1)(f)) |
| Complying with RICS regulatory obligations | Legal obligation (Article 6(1)(c)) |
| Anti-money laundering checks | Legal obligation (Article 6(1)(c)) |
| Analytics cookies | Consent (Article 6(1)(a)) |
| Retaining records for 6 years post-instruction | Legal obligation / Legitimate interests |
Use of Artificial Intelligence
In preparing certain reports — including Location Reports and survey narratives — we use AI-assisted tools, including OpenAI's GPT models, to help gather, summarise, and draft content from public data sources.
What this means for you: Your property address and relevant contextual information may be transmitted to OpenAI's API, which processes data in the United States. This transfer is covered by a data processing agreement incorporating Standard Contractual Clauses (SCCs) as the lawful transfer mechanism under UK GDPR. Data is not used to train AI models under our API agreement with OpenAI.
Human oversight: All AI-generated content is reviewed, edited, and approved by a qualified professional (AssocRICS, MCIOB) before it is delivered to you. No report is issued solely on the basis of automated processing. You are not subject to any decision that produces a legal or similarly significant effect based solely on automated means (UK GDPR Article 22).
No sensitive personal data (special category data), financial data, or identity documents are transmitted to AI systems.
Our Data Processors
We use the following third-party processors to deliver our services. Each operates under a data processing agreement:
| Processor | Purpose | Location |
|---|---|---|
| GoDaddy / Airo | Website hosting and application infrastructure | US (SCCs) |
| OpenAI | AI-assisted report drafting (property address only) | US (SCCs) |
| Stripe | Payment processing | US (SCCs) |
| GoCardless | Direct debit payment processing | UK/EU |
| Microsoft (Azure / Outlook) | Email delivery and calendar integration | EU/US (SCCs) |
| Geoapify | Postcode and address lookup | EU |
| getAddress.io | UK address lookup | UK |
| HM Land Registry | Property title and price data (public register) | UK |
| MHCLG / EPC Register | Energy Performance Certificate data (public register) | UK |
| Ordnance Survey | Mapping and geographic data | UK |
| Environment Agency | Flood risk and environmental data (public data) | UK |
| Natural England / Historic England | Heritage and environmental designations (public data) | UK |
| Police.uk / Home Office | Crime statistics (public data) | UK |
| Zoom | Video consultation meetings | US (SCCs) |
Public data sources (Land Registry, EPC Register, Environment Agency, etc.) are accessed via their official APIs and do not involve sharing your personal data with those organisations — we query them using a property address, not your name or contact details.
How Long We Keep Your Data
We retain records relating to completed instructions for 6 years from the date of the final report or last contact, in line with the Limitation Act 1980 and RICS guidance. After this period, records are securely deleted unless there is a legal reason to retain them further.
Enquiries that do not proceed to instruction are retained for 12 months and then deleted.
Analytics data (where consented) is retained in accordance with GoDaddy's data retention policy.
Sharing of Information
We will not sell, rent, or share your personal data with third parties for marketing purposes. We share data only:
- With processors listed above, to the extent necessary to deliver the service you have instructed
- Where required by law, regulation, or our RICS regulatory obligations
- To prevent fraud or money laundering
Your Rights
Under UK GDPR you have the following rights:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: ask us to delete your data (subject to legal retention obligations)
- Restriction: ask us to restrict processing in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests
- Not to be subject to automated decisions: we do not make solely automated decisions with significant effects
- Withdraw consent: where processing is based on consent (e.g. analytics cookies), you can withdraw at any time
To exercise any of these rights, please submit a request via our data request page or email us at [email protected]. We will respond within one calendar month.
Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
We would always prefer to resolve any concern directly — please contact us first at [email protected].
Trustees
Where you are a trustee, you agree to advise any beneficiary of the trust that their personal information will be dealt with on these terms.