Privacy Policy

Last updated: 31 October 2026

1. Who is responsible

ESTATEREAL Limited is the controller responsible for the processing described in this notice. Contact us about this notice or your data using the details below. The email address is masked to discourage automated harvesting; selecting it opens an email to our team.

This notice covers the software marketing website. The separate ESTATEREAL OS application, trial accounts, staging demo and third-party websites have their own applicable privacy information. This website form is not intended for tenant records or sensitive documents.

2. Information we collect

• Enquiries: your name, email, optional mobile number and its country code, optional company, role, portfolio-size range, message, privacy acknowledgement, submission time and enquiry reference.
• Newsletter: your email address, selected language, newsletter consent version, signup time and email-confirmation time.
• Security and delivery: short-lived form-check records, a daily hashed network identifier, submission counters and notification-delivery status. Hosting infrastructure also processes normal connection information, which may include IP addresses, request details and security logs.
• Cookie choices: your analytics and marketing choices, notice version and the date of your choice, saved in your browser.
• Optional tracking: after the relevant consent, page visits, browser/device information, online identifiers, approximate location and interactions may be processed by Google Analytics or Meta Pixel. Their servers receive the connection information needed to deliver these services.

Do not submit passwords, tenant identity documents, payment details or information about another person that you are not authorised to share.

3. Purposes and lawful bases

We handle enquiries to respond, understand your requirements and manage the resulting business conversation. Depending on the circumstances, this is necessary for steps you request before a contract or for our legitimate interest in communicating with prospective customers and business contacts.

We use security checks and limited technical records for our legitimate interest in preventing abuse and protecting the website. Necessary storage remembers your privacy choices and supports requested website functions. We rely on your consent for optional Google Analytics and Meta Pixel processing. An enquiry acknowledgement is separate from cookie consent and does not subscribe you to marketing.

Newsletter signup is optional. We use your consent to send ESTATEREAL product updates. We confirm control of your email address with a one-time code before recording a subscription; submitting an enquiry does not opt you in.

4. Google Analytics

If you enable Analytics, we load Google Analytics 4 to understand visits, page usage and website performance. The tag uses first-party identifiers and sends measurement data to Google. Our implementation keeps Google advertising storage, advertising user-data consent and ad personalisation denied, disables Google signals in the tag configuration, and omits query strings and fragments from the page-view URLs we explicitly send.

The Analytics tag is blocked until you consent. We do not intentionally send your enquiry text, name, email or tenant records to Google Analytics. Google’s handling of information is explained in its Privacy Policy and information about data from sites using Google services.

5. Meta Pixel / Facebook Pixel

If you enable Marketing, we load Meta Pixel to record page visits, measure advertising and support relevant audiences or retargeting on Meta services. Meta receives technical information such as online identifiers, IP address, browser details and visited URLs. Depending on your Meta account and settings, it may associate website activity with your Facebook or Instagram account and process information for its own advertising purposes.

The Pixel is blocked until Marketing consent. We do not configure advanced matching with enquiry fields or intentionally send form contents to Meta. For Meta’s own processing and available controls, read its Privacy Policy and Cookies Policy.

6. Your tracking choices

You can accept all, reject optional technologies or choose Analytics and Marketing separately. Both optional categories start off. Refusing them does not prevent you from browsing or sending an enquiry. Use Cookie settings on any page to change or withdraw consent. We then stop the relevant tag, clear accessible first-party cookies we control and reload the page to discard loaded tracking code. Withdrawal does not undo processing that already took place lawfully.

7. Sharing and international processing

Authorised team members and service providers supporting hosting, database storage, security and business communications may handle enquiry information. This preview uses Cloudflare-based hosting and storage through Sites. Accepted form submissions are intended for delivery, including their full contents, to the general channel in the ESTATEREAL HQ Slack workspace for team follow-up once its server-side connection is configured. Authorised channel members can then see those details. Email delivery may also be used where configured. We do not send your enquiry to advertising tools simply because you submit the form.

Google and Meta receive data only when you enable their respective categories; they may also act as controllers for their own purposes under their policies. Providers may process information outside the United Kingdom, including in the United States. Relevant transfers must be covered by applicable adequacy arrangements or appropriate safeguards, such as approved contractual protections. Contact us for information about the arrangements relevant to your data.

When email delivery is configured, Resend delivers your enquiry to our team and a transactional confirmation to the email address you provide. These emails are used to handle your enquiry and do not subscribe you to marketing.

SMS verification uses Yuboto to deliver a one-time code to the number you supply. Codes expire after five minutes, and a successful check can be used once within 30 minutes. We keep protected checks, the verification time and short-lived records; expired verification records are removed during routine form housekeeping.

HubSpot stores website enquiries and confirmed newsletter contacts in our CRM for follow-up. The CRM records the source as Website visitor and keeps the latest enquiry context or newsletter-confirmation time. Existing CRM relationships may have their own owner and retention arrangements.

8. Retention

Website enquiry records older than 180 days are removed during routine form housekeeping. An ongoing customer relationship, correspondence, legal obligation or dispute may require separate business records to be kept longer. Those records are retained for as long as needed for that purpose, taking account of applicable legal requirements. Slack messages and email correspondence follow the respective workspace/mailbox retention settings, which are separate from this website database.

Form-check tokens expire after one hour; expired checks and submission counters are cleared during housekeeping. The network hash changes daily. Cookie choices are remembered for up to 180 days. Our Google Analytics cookie setting is 180 days; Meta cookie lifetimes and provider-side data retention are described in the Cookie Policy and linked provider policies. Cookie expiry is distinct from retention of information already received by a provider.

Unconfirmed newsletter checks expire after 15 minutes and are removed during routine housekeeping. Confirmed newsletter records are kept while you remain subscribed. You can withdraw newsletter consent by contacting us. Newsletter emails will include an unsubscribe option. CRM contacts and business correspondence may be retained separately where needed to manage an ongoing relationship.

9. Your rights and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data. You may withdraw consent at any time without affecting earlier lawful processing. You may object to processing based on our legitimate interests, and you have the right to object to direct marketing. Contact us to exercise a right; we may need proportionate information to verify the request.

You can raise a concern with us or complain to the UK Information Commissioner’s Office or another competent supervisory authority. We do not use this marketing website to make solely automated decisions producing legal or similarly significant effects about you.

10. Security and updates

We restrict access and use proportionate technical safeguards, including validation, form checks and rate limits. No internet service can guarantee absolute security. We may revise this notice as the website or processing changes; the date above identifies this version. A materially different optional tracking purpose requires a fresh choice.