GOLDMAN & CO
Privacy policy
How we handle your information.
Last updated: 9 October 2026 | Version 1.0
01 / Who we are and how to contact us
Goldman Consultancy Ltd trading as Goldman & Co (“we”, “us” or “our”) is the data controller for the personal information we use in our property business. This means we decide why and how it is used. Other parties, including landlords, referencing providers and insurers, may be separate controllers for their own activities.
Privacy enquiries and requests: info@goldmanandco.co.uk
Website: www.goldmanandco.co.uk
This notice covers buyers, sellers, landlords, tenants, occupiers, guarantors, enquirers and business contacts. It applies to our website and to property buying, relocation, sales, lettings, short lets, property management, auctions, design and refurbishment services. We handle information under the UK GDPR and the Data Protection Act 2018, as amended, and applicable electronic communications rules.
02 / Information we collect
- Identity and contact: names, dates of birth, addresses, email addresses, phone numbers and, where needed, identity documents, nationality and right-to-rent evidence.
- Financial and referencing: budgets, employment, income, benefit income where relevant, references, credit-check results, source-of-funds evidence, ownership details, bank details and payment records where necessary.
- Property and tenancy: requirements, offers, agreements, rent and deposit records, inventories, photographs, repairs, access arrangements, guarantor details and relevant communications.
- Website and preferences: enquiry forms, IP addresses, device and browser information, cookie preferences, marketing choices and records of consent, enquiries and complaints.
03 / Where information comes from
We obtain information from you and, where relevant, landlords, joint applicants, guarantors, other agents, property portals, employers or referees, referencing and credit agencies, professional advisers and public records such as HM Land Registry, Companies House and sanctions lists. If someone gives us your information, we provide this notice within one month, or by our first contact or disclosure if earlier, unless a lawful exception applies.
We identify information required by law or needed to assess an application or deliver a service when we ask for it. Without it, we may be unable to proceed and will explain why. Marketing preferences and consent to an optional product introduction are voluntary.
04 / Purposes and lawful bases
We use only information needed for the relevant purpose. The bases below apply according to your role and the service involved.
| Purpose | Lawful basis under Article 6 UK GDPR |
|---|---|
| Respond to enquiries, arrange viewings, discuss requirements and coordinate offers. | Contract – 6(1)(b) for steps you request towards a contract with us; otherwise legitimate interests – 6(1)(f) in responding and progressing property enquiries. |
| Deliver instructed property services, manage a tenancy or project, and communicate with the parties involved. | Contract – 6(1)(b) where you are our client; legitimate interests – 6(1)(f) for necessary coordination with other parties and managing property. |
| Check references, affordability, identity and suitability, and prevent fraud. | Legitimate interests – 6(1)(f) in protecting property owners, assessing applications fairly and preventing fraud; legal obligation – 6(1)(c) where a check is legally required. |
| Perform applicable anti-money-laundering, sanctions, right-to-rent, tax and regulatory duties. | Legal obligation – 6(1)(c), including the Money Laundering Regulations, Immigration Act requirements and tax law where they apply. |
| Introduce you to Zero Deposit or another optional product provider at your request. | Consent – 6(1)(a) for the initial optional referral. Administration and claims sharing are explained in section 9. |
| Send property updates and marketing, and use optional website technologies. | Consent – 6(1)(a) where required; otherwise legitimate interests – 6(1)(f) for marketing permitted by law. See section 8. |
| Protect systems, keep proportionate business records, handle complaints, recover money owed and establish or defend claims. | Legitimate interests – 6(1)(f) in security, accountability and protecting legal rights; legal obligation – 6(1)(c) where applicable. |
Contract is used only where processing is necessary for a contract with you or steps you ask us to take before entering it. When relying on legitimate interests, we assess necessity and balance those interests against your rights and reasonable expectations. You can object as explained in section 13.
05 / Sensitive information
We do not ask for unnecessary sensitive information. If you choose to provide health or disability information for access arrangements or assistance, we use it with explicit consent under Article 9(2)(a). If needed for legal claims, Article 9(2)(f) may apply. We explain any other applicable condition before use. We process criminal-offence information only where specifically authorised by law with the required safeguards.
06 / Who receives information
We share only what is necessary for the stated purpose. Depending on the matter, recipients may include:
- Property parties: landlords, sellers, buyers, tenants, guarantors, other agents, developers, managing agents and auction providers involved in your transaction or tenancy.
- Checks and professional support: referencing, identity-verification and credit agencies; solicitors, accountants, surveyors, lenders or mortgage advisers where you request an introduction or they are involved in the matter.
- Service delivery: contractors, architects, designers, inventory clerks and maintenance providers who need information to carry out instructed work.
- Business suppliers: hosting, email, CRM, document storage, payment, newsletter and IT-support providers operating under appropriate confidentiality and data-protection arrangements.
- Legal and regulatory recipients: HMRC, law-enforcement bodies, courts, regulators, insurers and dispute-resolution or debt-recovery providers where necessary and lawful.
We do not sell personal information. Some recipients process it on our instructions; others are independent controllers and explain their own use in their privacy notices.
07 / Referencing and decisions
Checks may involve credit-reference and fraud-prevention databases. The provider explains any credit-file footprint and its use of scoring. Goldman & Co does not make final decisions with a legal or similarly significant effect solely by automated means. Providers may use automated assessment or profiling; their notices explain the process and applicable rights. You can ask us to review an assessment we use, and ask the relevant provider for information, human intervention or to contest a qualifying automated decision.
08 / Marketing, cookies and email tracking
We send electronic marketing to individual subscribers only with consent or where the lawful existing-customer exception applies: we obtained details directly during a sale or discussions about our services, market our own similar services, and offered an opt-out at collection and in every message. Where permitted, relevant marketing to corporate business contacts may rely on legitimate interests. We identify ourselves and provide a clear way to stop marketing.
Unsubscribe using the link in an email or contact info@goldmanandco.co.uk. This does not stop necessary communications about a current instruction or tenancy. Website technologies requiring consent, including relevant analytics or advertising cookies, are used only with that consent. You can change choices through cookie settings. Where email open or click tracking requires consent, it is optional and permission is requested. See our Cookie Policy for the website cookie notice.
09 / Zero Deposit, Deposit+ and Guarantor+
For an optional product introduction, we ask for and record your consent before sending your personal details to Global Property Ventures Limited trading as Zero Deposit. We provide its privacy notice before referral. We share only the details needed, such as names, contact details, date of birth where required, the rental address, rent and tenancy dates. Relevant reference or identity-check results are shared only where needed for the requested assessment.
Zero Deposit is a separate controller. Its insurer, including Equitable Rental Insurance Limited where identified in the product documents, and The Dispute Service Limited may also process information for their own insurance or claims purposes. Their notices explain their recipients, retention and rights arrangements: zerodeposit.com/privacy-policy.
Once cover or deposit administration is in place, necessary updates and claims evidence may be shared to perform our contract with you, or on legitimate interests in administering the tenancy, protecting landlords and resolving claims. This can include tenancy agreements, rent statements, inventories, photographs and relevant communications. If a cash deposit is administered through Deposit+, we explain the necessary administration sharing in advance.
An optional product referral is separate from marketing permission. You may decline or withdraw referral consent by contacting us. Withdrawal does not undo earlier lawful processing or prevent necessary processing on another lawful basis, such as an existing claim. Other people whose information is referred receive appropriate privacy information and, where consent is the basis, we obtain their own consent.
10 / International transfers
Some technology suppliers and overseas parties may process information outside the UK. Requested international property or relocation services may involve parties in Turkey or the United Arab Emirates; an insurer involved in Zero Deposit may be based in Guernsey. Where a restricted transfer is made, we use applicable UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with the required risk assessment. We explain any exceptional legal transfer basis before using it. You can request details and a copy of relevant safeguards, with confidential material redacted.
11 / Protecting your information
We use proportionate technical and organisational safeguards, limit access to people who need it, and require appropriate confidentiality and security from suppliers acting on our instructions. We handle information securely and address personal-data breaches in accordance with applicable notification duties.
12 / Our retention schedule
Our standard retention periods are below. We retain only the relevant records for each purpose; a long-lived transaction file does not mean every identity document or bank statement is kept for the same period.
| Record category | Standard retention period or rule |
|---|---|
| General enquiries that do not progress | Up to 12 months after the last meaningful contact, unless you request continued contact or the enquiry becomes an active matter. |
| Unsuccessful or withdrawn tenancy applications | Normally 6 months after the outcome, keeping only what is needed to address enquiries or disputes. Active applicant searches and legal holds are treated separately. |
| Core client, transaction, tenancy and project records | Normally 6 years after the relevant transaction, tenancy or client relationship ends, for business accountability and legal claims. Unnecessary supporting documents are removed sooner. |
| Accounting and tax records | Normally 6 years from the end of the relevant accounting period, or the period required by applicable tax law. |
| Anti-money-laundering due-diligence records | 5 years after the business relationship ends or the occasional transaction completes, where the Regulations apply. They are then deleted unless further retention is specifically permitted by law. |
| Right-to-rent evidence for English tenancies | For the tenancy and 1 year after it ends, where we are responsible for the check. A separate lawful retention duty may require specified records to be kept longer. |
| Marketing choices and suppression records | Contact data while you remain subscribed or eligible for lawful marketing, subject to regular relevance reviews. After opt-out, only the minimum suppression and permission-history records needed to honour your choice and demonstrate compliance. |
| Website, cookie and security records | Cookie lifetimes are explained in the cookie notice or settings. Security and incident records are kept only for as long as needed to protect systems, investigate the incident and resolve associated claims. |
Relevant records may be kept longer for an ongoing complaint, legal claim, regulatory investigation or another legal requirement, but only to the extent necessary and lawful. We review retention and securely delete or anonymise records no longer needed.
13 / Your rights and how to use them
Depending on the processing and applicable exemptions, you can:
- Access your personal information and receive information about its use.
- Correct inaccurate or incomplete information.
- Request erasure where we no longer have a lawful reason to keep it.
- Restrict processing in the circumstances provided by law.
- Receive and transfer data where portability applies to automated processing based on consent or a contract.
- Object to processing based on legitimate interests, including related profiling. Your right to object to direct marketing is absolute.
- Withdraw consent at any time, without affecting processing already carried out lawfully.
- Request safeguards for qualifying automated decisions, including information, representations, human intervention and a way to contest the decision.
Send requests to info@goldmanandco.co.uk. We may ask for proportionate evidence of identity. We normally respond within one month and explain any lawful extension or pause. Requests are normally free; we explain any fee or refusal permitted by law. If we cannot fulfil a request, we explain the reason and your complaint options.
14 / Privacy complaints
You can complain directly by emailing info@goldmanandco.co.uk, with “Privacy complaint” in the subject if helpful. Please describe the concern and the outcome you seek; you do not need legal terminology. We acknowledge data-protection complaints within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint. Postal contact: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Contacting us first may help resolve your concern, but does not remove your right to complain to the ICO.
15 / Changes and further information
We review this notice and update it when our practices or the law change. We bring material changes or new uses to your attention before they apply. The date at the top of this policy identifies this version. Contact us for this notice in another accessible format or for further details about any processing described here.
Copyright
© 2026 Goldman & Co. Website text, branding and original materials may not be reproduced for commercial purposes without prior written permission, except where permitted by law.
© 2026 Goldman & Co. All rights reserved.