Privacy notice
What our web host records when you visit, what happens to the details you enter if you ask for an introduction, and how we are paid for it.
On this page
The short answer
When you visit, our host Cloudflare processes technical request data, including your IP address, to deliver and protect the site. If you fill in the route finder and ask for an introduction, we keep the details you enter and pass them to one firm, with your agreement. That firm may pay us for the introduction. We set no cookies of our own and run no analytics.
UK data protection law requires an organisation to tell people who it is, what it does with their personal data, why, for how long, and what rights they have.1 This notice is the one place on the site where that is set out in full.
Who is responsible for your data
The House Desk is responsible for the personal data described in this notice. You can reach us about it at hello@thehousedesk.co.uk or through our contact page.1
We have not appointed a data protection officer. The ICO lists that as information to give only where it applies.1
What personal data is processed
Visiting any page. Cloudflare serves the site. It says that when people visit its customers' websites it processes their IP addresses, traffic routing data and other information about that traffic.3 Its documentation shows that its request logs can include the client IP address, the page requested, the request method and the response.5 Your browser also sends details such as its type, which can appear in the same records.
Asking for an introduction. The route finder form, and the same form on the contact page, collects your name, phone number, email address, the postcode of the property, the best time to call and your answers to its three questions. If you choose to, it also takes the type of property, the number of bedrooms, whether it is freehold or leasehold, and anything you write in the message box. Please leave out anything about your health or finances that the firm does not need. We also record the page you were on, the consent wording you agreed to and when. Your IP address is kept only as a scrambled code, used to stop repeated or automated sending.
Using a calculator. Most of the calculators run entirely in your browser and send nothing anywhere. The sold prices search and the cash offer calculator send the postcode you type straight from your browser to HM Land Registry and to postcodes.io, a public postcode lookup, to fetch sales near it. We do not receive or keep that postcode.
What the site does not do
- Accounts or sign-ups
- None
- Analytics or tracking
- None
- Advertising
- None
- Fonts from third parties
- None; fonts are served from this site
- Selling or renting your details
- Never
Why it is processed, and the lawful basis
Request data is processed to deliver the pages you ask for, to keep the site available and to protect it against abuse and attack. We rely on legitimate interests. The ICO's guidance says this basis fits uses people would reasonably expect with minimal privacy impact, and names IT security as a potential legitimate interest.2 Our interest is running a secure, working website. A web page cannot be delivered without an IP address to send it to.
The details you enter to ask for an introduction are processed on the basis of your consent, given when you press send, or when you confirm a firm we have emailed you about. You can withdraw it at any time. Neither set of data is used to profile you, to market other products to you or to make an automated decision about you.
Introductions
If you use the route finder and ask to be introduced, this is what happens to your details.
- One firm only. Your details go to one firm for the route you chose, never to a list of firms and never to several firms to compete over.
- Named before anything is sent. We email you the firm we propose, with its registration details, and your details go to it only when you confirm.
- Why the firm receives them: so it can contact you about selling the property. Anything you agree with the firm after that is between you and the firm, on its own terms.
- How we are paid: the firm may pay us a fee for the introduction. The email that names the firm also says how we are paid. What a firm pays us never changes what our research says about it or about any other firm.
- The firm's own use: the firm keeps what it receives under its own privacy notice.
If you would rather approach a firm yourself, the guides to estate agents, selling at auction, house-buying companies and ways to sell your home explain what to check first.
Who receives it
Cloudflare, Inc. processes request data on our behalf as our hosting provider, and also stores the details of an introduction request and runs the check that the form was sent by a person. Its data processing terms set out that the website owner is the controller and Cloudflare the processor.4 Under those terms Cloudflare may use companies in its group and data centre operators as sub-processors. Because Cloudflare runs a global network, data can be processed outside the UK. For transfers from the UK, its terms rely on standard contractual clauses as amended by the UK Addendum.4
Emails about an introduction, to you or to the firm, are sent through an email delivery provider acting on our behalf. Apart from these providers and the one firm you agree to, nobody else receives your details.
How long it is kept
We keep the details of an introduction request for 180 days, after which they are deleted automatically.
Cloudflare does not publish one fixed retention period for request data. Its privacy policy says retention depends on the purpose for which the data was collected and any legal requirements.3 Its processing terms say customer personal data is processed until the service ends or processing is no longer necessary, then deleted or returned.4 For its log retrieval service, Cloudflare documents that request logs can be retrieved going back at least 3 days and up to 7 days.5 We do not copy Cloudflare's logs into any system of our own.
Your rights
Under UK data protection law you have rights over your personal data, including the rights of access, rectification, erasure and restriction, and, for the details you give us with your consent, data portability.1
You can withdraw consent to an introduction at any time. We will then delete what we hold and tell the firm you have withdrawn. If the firm has already contacted you, ask it directly as well.
You have the right to object to the processing of request data, because it relies on legitimate interests. We must then stop, unless there are compelling legitimate grounds to continue, such as keeping the site secure.2
To exercise a right, use the details on contact. Requests about this site come to us: Cloudflare says it has no direct relationship with visitors to its customers' sites and passes rights requests to the website owner.3 For request data alone, we may need an IP address and a date and time from you to find a record, and it may already have been deleted.
Complaining to the Information Commissioner's Office
You have the right to complain to the Information Commissioner's Office, the UK regulator for data protection.1 The ICO recommends raising your concern with the organisation first. You can reach the ICO on 0303 123 1113 or through its website.10
Cookies and your device
The site sets no cookies of its own. Regulation 6 of the Privacy and Electronic Communications Regulations bars storing or reading information on a user's device except under the exceptions in its Schedule A1.78 The ICO's guidance says the same rules cover any technology that stores information on a device, with an exemption for what is strictly necessary for a service the user asked for.9
The one thing the site stores is a note in your browser's session storage that you closed the reminder bar at the foot of the page, so it stays closed. It holds nothing about you and is deleted when you close the tab.
Cloudflare can set its own cookies when certain features are switched on, such as bot management or load balancing.6 Any cookie Cloudflare sets for this site is listed here with its purpose and duration.
Organisations that use personal information must pay the ICO a data protection fee unless they are exempt.11 We pay it, or record why we are exempt.
Changes to this notice
This notice is updated before the site's use of personal data changes. The date at the top shows when it was last updated.
Sources
(11)
Numbers in the text link to these. Each was read on the date shown. How we research
- What privacy information should we provide?
- Legitimate interests
- Cloudflare Privacy Policy
- Cloudflare Customer Data Processing Addendum
- Logpull: understanding the basics
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1
- Check if you can complain
- Data protection fee