Privacy Policy

Last updated: 8 April 2026. This Privacy Policy explains how 1031propertylists.com (the “Site”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you visit our website, interact with our email addresses, or otherwise engage with services we control. It should be read together with our Cookie Policy, which describes similar technologies in more detail. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as tailored by the Data Protection Act 2018, and with the Privacy and Electronic Communications Regulations (PECR) where they apply to cookies and electronic marketing. By using the Site you acknowledge that you have read this Policy. If you do not agree with how we process data, please discontinue use and adjust your browser or device settings as described below.

Data controller and contact details

The data controller responsible for personal data processed in connection with the Site is the legal entity operating 1031propertylists.com. For all privacy-related requests, including questions about this Policy, exercise of rights, or complaints, contact us at info@1031propertylists.com using “Privacy Request” in the subject line. We may ask you to verify your identity before disclosing or correcting information, which helps prevent unauthorised access. If we appoint a data protection officer or EU/UK representative for specific processing activities, we will update this section with their contact coordinates.

Categories of personal data we process

Depending on how you use the Site, we may process: (1) technical and usage data, including IP address, approximate geographic location derived from IP, browser type and version, device type, operating system, screen resolution, referring URL, pages viewed, time on page, click paths, HTTP status codes, and timestamps; (2) cookie identifiers, session tokens, and local storage keys where you have not blocked them; (3) communications data, including your email address, name (if provided), telephone number (if provided), and the content of messages you send to us; (4) records of consents, opt-outs, and cookie banner decisions where we log them; and (5) aggregated or pseudonymised analytics metrics that do not directly identify you. We do not intentionally collect special category data (such as health data) unless you voluntarily include it in a message, in which case we will use it only to respond and then delete or minimise retention where appropriate.

Purposes and legal bases under UK GDPR

We process personal data for the following purposes and on the following legal bases: operating, securing, and improving the Site (legitimate interests in running an information service, fraud prevention, and network security); responding to enquiries and correspondence (legitimate interests and, where relevant, steps prior to a contract); complying with legal obligations (such as responding to lawful requests from regulators or courts); analytics and performance measurement where permitted (consent for non-essential cookies where PECR requires it, otherwise legitimate interests in understanding aggregate traffic); and enforcing our Terms of Service (legitimate interests). Where we rely on legitimate interests, we balance our interests against your rights and offer opt-outs where required. Where consent is the legal basis, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Cookies, local storage, and similar technologies

We use cookies and related technologies as described in our Cookie Policy. Strictly necessary cookies may be set without consent where they are essential to provide a service you explicitly requested. For analytics, preference, or marketing-related technologies, we will seek consent where PECR requires. You can control cookies through your browser settings, industry opt-out tools, and our cookie banner where available. Blocking some cookies may impair Site functionality such as remembering your age-gate or cookie choices for the session.

Sources of data

Most data comes directly from your device when you load pages or send email. We may also receive technical data from content delivery networks, hosting providers, security services, and analytics partners acting as processors. If we receive personal data about you from third parties (for example, a forwarded complaint), we will treat it in line with this Policy and applicable law.

Recipients and processors

We use trusted service providers to host the Site, distribute content, monitor uptime, detect abuse, and analyse aggregated traffic. These processors process data only on our documented instructions and under contracts that require appropriate confidentiality and security measures. Categories of recipients may include infrastructure providers, email delivery services, analytics vendors (where consented), and professional advisers. Outbound links on the Site lead to independent operators whose privacy notices apply once you leave our domain; we are not responsible for their practices.

International transfers

Our primary hosting and support may be located in the United Kingdom or the European Economic Area. If we transfer personal data to countries outside the UK/EEA that are not subject to adequacy regulations, we will implement appropriate safeguards such as the UK International Data Transfer Agreement, UK Addendum, or EU Standard Contractual Clauses adapted for UK transfers, supplemented by technical and organisational measures including encryption in transit where feasible. You may request a summary of safeguards by contacting us.

Retention

We retain personal data only as long as necessary for the purposes described. Server logs and security telemetry are typically retained for a limited rolling period unless longer retention is needed to investigate incidents or defend legal claims. Analytics data may be aggregated or pseudonymised so it no longer identifies individuals. Email correspondence is kept according to operational needs, regulatory requirements, and limitation periods, after which it is deleted or archived securely. Cookie lifetimes vary by type and are listed in the Cookie Policy.

Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures may include access controls, TLS encryption for data in transit, patching, monitoring, and staff training. No method of transmission over the internet is completely secure; you should use strong passwords for your own accounts on third-party services and report suspected compromises promptly.

Your rights

Subject to applicable law, you may have the right to: access a copy of your personal data; rectify inaccurate data; erase data in certain circumstances; restrict processing; object to processing based on legitimate interests; data portability where processing is automated and based on contract or consent; and withdraw consent where processing is consent-based. You may lodge a complaint with the Information Commissioner’s Office (ICO) in the UK (www.ico.org.uk) if you believe our processing infringes data protection law. We will respond to rights requests within one month where feasible, or inform you of any extension permitted by law.

Automated decision-making and profiling

We do not use personal data for solely automated decisions that produce legal or similarly significant effects concerning you. We may use aggregated analytics to understand audience segments at a statistical level, but such analysis does not target individuals for automated credit, employment, or gambling eligibility decisions on our part.

Marketing communications

We do not send unsolicited commercial email unless you have opted in or we have another lawful basis. You can opt out of marketing at any time using instructions in the message or by emailing us. Service-related notices about security or policy changes may still be posted on the Site.

Children

The Site is not directed at individuals under 18, and we do not knowingly collect personal data from children. If you believe a minor has provided data, contact us and we will take steps to delete it promptly where required.

Changes to this Policy

We may update this Privacy Policy to reflect legal, technical, or business developments. Material changes will be highlighted on this page or through a notice on the Site where appropriate. The “Last updated” date will be revised accordingly. Continued use after changes constitutes acknowledgement of the updated Policy except where the law requires explicit consent for new processing.