Last updated: 5 May 2026
Real Estate Xchange Ltd (“REX”, “we”, “us”, “our”) is committed to protecting your personal data. This Privacy Notice explains how we collect, use, share and protect your personal data when you interact with us, in accordance with the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
This Privacy Notice should be read together with our Cookie Policy and our Terms of Use, which are available on our website.
1. Who we are
Data Controller: Real Estate Xchange Ltd, a company incorporated in England and Wales under company number 08979930.
Registered office: 62 St Martin’s Lane, London WC2N 4JS, United Kingdom.
Contact: info@realestatexchange.co.uk · +44 (0) 20 3807 4884 · www.realestatexchange.it
Information Commissioner’s Office (ICO) registration: ZA284919.
REX has not appointed a statutory Data Protection Officer, but data protection enquiries can be addressed to the contact details above and will be handled by the appropriate person within REX.
2. Who this Privacy Notice applies to
This Privacy Notice applies to all individuals whose personal data we process in connection with our property services. The main categories of data subjects are:
- Tenancy applicants and prospective tenants (including their guarantors and adult occupiers)
- Tenants during and after a tenancy granted through REX
- Landlords who instruct REX to let, manage or sell property
- Prospective buyers and sellers of residential or commercial property
- Investors and clients of our private agent or advisory services
- Visitors to our website and recipients of our communications
Where a section of this Notice applies only to specific categories of data subjects, we say so expressly.
3. The personal data we collect
Depending on your relationship with us, we may collect and process the following categories of personal data:
3.1 Identity and contact data
Title, full legal name, date of birth, nationality, photograph (where provided), telephone numbers, email address, current and previous addresses, and similar identifying information.
3.2 Application and referencing data
Employment status, gross annual income (declared and verified), employer details, course details (for students), pension details (for retirees), rental history, current landlord references, credit history, County Court Judgments (CCJs) and similar adverse credit information, declared by you or obtained through tenant referencing agencies.
3.3 Right to Rent and identity verification data
Identity documents (passport, national ID card, biometric residence permit, share code), evidence of immigration status, and the records of the Right to Rent check carried out under the Immigration Act 2014. These records are stored separately in our compliance file and are not attached to the tenancy agreement.
3.4 Financial data
Bank account details for payments and refunds, holding deposit and tenancy deposit amounts, rent and service charge payment history, and any debts or sums owed to us or to a landlord client. We do not retain card details. Where applicable, we collect AML/KYC documents required under the Money Laundering Regulations 2017.
3.5 Tenancy and property management data
Tenancy agreement details, inventories, condition reports, maintenance and repair records, contractor visits, compliance certificates (Gas Safety, EICR, EPC), correspondence regarding the property, complaints, and any disputes.
3.6 Sales, purchase and investment data
Property preferences, viewing history, offers made and received, transaction documentation, source of funds documentation where required, communications with solicitors and other professional advisers.
3.7 Marketing and website data
Marketing preferences, communication history, website usage data, cookie data (see our separate Cookie Policy), IP address, and similar technical information.
3.8 Special category data
We do not routinely collect special category data (such as data revealing health, religion or biometric data). Where you voluntarily provide such information (for example, mentioning a disability or accessibility requirement when arranging a property visit, or requesting a reasonable adjustment under the Equality Act 2010), we process it solely for the purpose for which it was provided and only with your explicit consent or another lawful basis under Article 9 UK GDPR.
4. How we collect your personal data
We collect your personal data through the following channels:
- Directly from you, when you complete our application forms, contact us, instruct us, attend a viewing, or interact with our website.
- From third parties acting on your behalf, such as your solicitor, accountant, tax adviser, or appointed representative.
- From tenant referencing agencies and credit reference agencies, when carrying out checks on your application.
- From public sources, such as Companies House, the Land Registry, professional registers and publicly available information, where lawful and proportionate.
- From our service providers and partners, such as portals (Rightmove, Zoopla and similar) when you submit an enquiry through them.
5. Why we use your personal data and on what legal basis
We process your personal data for the following purposes, on one or more of the lawful bases described in the table below.
| Lawful basis | Typical use by REX |
|---|---|
| Contract performance — Art. 6(1)(b) | Processing your application, managing your tenancy, handling sales/purchase instructions, processing payments, and providing the services you have requested. |
| Legal obligation — Art. 6(1)(c) | Right to Rent checks (Immigration Act 2014), tenancy deposit protection (Housing Act 2004), AML/KYC checks where applicable (Money Laundering Regulations 2017), HMRC record-keeping, statutory complaint handling, court orders. |
| Legitimate interests — Art. 6(1)(f) | Verifying identity, preventing fraud, recovering debts, communicating with prospective landlords or buyers about an application or offer, managing our business operations, sending property-related updates where you have an existing relationship with us. |
| Consent — Art. 6(1)(a) | Marketing communications by email or telephone where required, certain non-essential cookies on our website, optional services that are not part of the core contract. |
Where we rely on legitimate interests, we have carried out an assessment to ensure that our interests are not overridden by your interests, rights and freedoms. You have the right to object to processing based on legitimate interests — see Section 9 below.
6. Who we share your personal data with
We share your personal data only with the recipients listed below, and only to the extent necessary for the purposes set out in this Notice.
| Category of recipient | Purpose |
|---|---|
| Prospective or instructing landlords, buyers, sellers | To progress your application, transaction, or service request and communicate the relevant outcomes. |
| Tenant referencing agencies | HomeLet, or such other tenant referencing agency as we may use from time to time, to carry out referencing, affordability and identity verification checks. |
| Credit reference agencies | To run credit checks as part of the referencing process. Credit reference agencies record our search. |
| Tenancy deposit scheme | The Deposit Protection Service (DPS), Custodial scheme, to register and protect tenancy deposits in accordance with the Housing Act 2004. |
| Property maintenance contractors and service providers | Limited contact details and access information to enable repairs, gas, electrical or other compliance work, where you are a tenant or a landlord client. |
| Professional advisers | Solicitors, accountants, tax advisers, and other authorised legal or compliance advisers acting for REX or, with your authority, for you. |
| Software and IT providers (data processors) | Property management software (such as Alto), email and document management providers, cloud storage providers, electronic signature providers (such as DocuSign), all bound by data processing agreements under Article 28 UK GDPR. |
| Fraud prevention and debt recovery providers | Where lawful and proportionate, to investigate suspected fraud or recover sums lawfully due. |
| Public authorities and regulators | HMRC, the Home Office (for Right to Rent), local authorities, courts, the Information Commissioner’s Office, the Financial Conduct Authority, and other bodies where we are required by law to share information. |
| Redress scheme | The Property Ombudsman (TPO), Membership No. T00371, in the event of a complaint that requires referral to the redress scheme. |
REX does not sell your personal data to third parties under any circumstances.
7. International transfers of your personal data
Most of our processing takes place within the United Kingdom. However, in certain circumstances we may transfer your personal data outside the UK, for example:
- Where a landlord, buyer, seller or investor is based outside the UK (notably in Italy or other EU countries) and the transfer is necessary to perform the contract or take steps prior to entering it.
- Where one of our service providers (for example, a cloud or email provider) processes data in another jurisdiction.
Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place under Article 46 UK GDPR, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or any other lawful transfer mechanism. You can request a copy of the safeguards by contacting us at the email address above.
8. How long we keep your personal data
We retain your personal data only for as long as is necessary for the purposes for which it was collected, including any legal, accounting, or reporting requirements. The main retention periods are summarised below.
| Category of records | Retention period |
|---|---|
| Tenancy application records (successful) | For the duration of the tenancy plus six years thereafter (Limitation Act 1980 and HMRC record-keeping requirements). |
| Tenancy application records (unsuccessful) | Up to twelve months from the date of the decision, unless a longer period is required for fraud prevention, audit or legal claims. |
| Right to Rent records | For the duration of the tenancy plus the period prescribed by Home Office guidance (currently a minimum of one year after the tenancy ends). |
| Tenancy management records | For the duration of the tenancy plus six years thereafter. |
| AML/KYC records (where applicable) | Five years from the end of the business relationship or completion of the transaction (Money Laundering Regulations 2017). |
| Sales/purchase transaction records | Six years from completion of the transaction. |
| Accounting and tax records | Six years from the end of the relevant accounting period. |
| Marketing records | Until you withdraw consent, object, or until the records are no longer relevant, whichever is earlier. |
Where we retain anonymised data for analytical or statistical purposes, we may keep it indefinitely without further notice to you.
9. Your rights under UK GDPR
You have the following rights in relation to your personal data:
- Right of access (Art. 15) — to obtain a copy of the personal data we hold about you and information about how we process it.
- Right to rectification (Art. 16) — to ask us to correct inaccurate or incomplete personal data.
- Right to erasure (Art. 17) — to ask us to delete personal data we no longer need or that we are processing unlawfully (subject to legal exceptions, in particular our legal obligation to retain certain records).
- Right to restrict processing (Art. 18) — to ask us to limit the processing of your personal data in certain circumstances.
- Right to data portability (Art. 20) — to receive personal data you have provided to us, in a structured, commonly used, machine-readable format, and to transmit it to another controller, where the processing is based on consent or contract and carried out by automated means.
- Right to object (Art. 21) — to processing based on legitimate interests, and to object to direct marketing at any time.
- Right to withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Right not to be subject to solely automated decisions (Art. 22) — see Section 10 below.
To exercise any of these rights, please contact us at info@realestatexchange.co.uk. We will respond within one month, or sooner where possible. We may need to verify your identity before responding.
Right to complain to the ICO. If you believe that our processing of your personal data does not comply with data protection law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, or by calling 0303 123 1113. We would, however, appreciate the chance to deal with your concerns first.
10. Automated decision-making and profiling
Our tenant referencing process may involve automated assessment by the referencing agency (such as HomeLet), based on credit and affordability scoring. This automated processing is necessary for entering into, or performing, the tenancy contract. You have the right to request human review of any decision that significantly affects you and is based solely on automated processing, to express your point of view, and to contest the decision. Please contact us at info@realestatexchange.co.uk to exercise this right.
11. Security of your personal data
REX takes appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include access controls, encryption in transit, secure cloud storage, contractual safeguards with our processors, and staff training. Where we use third-party software (such as our property management system or document signature platforms), we select providers that meet appropriate security standards and we enter into data processing agreements under Article 28 UK GDPR.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and we will inform you without undue delay where the risk is likely to be high.
12. Other professional and redress affiliations
In addition to the redress scheme identified above (The Property Ombudsman, Membership No. T00371), REX maintains the following affiliations, which do not affect the redress route applicable to a tenancy or other transaction:
- UK Association of Letting Agents (UKALA) membership
- Property Redress Scheme membership (PRS018717), maintained through UKALA, separate from the statutory redress scheme identified above
These affiliations are listed for transparency and do not create an alternative redress route in respect of the services we provide.
13. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The most recent version is the one published on www.realestatexchange.it, with the date of last update shown at the top of this document. We will inform you of material changes by appropriate means (for example, by email or through a prominent notice on our website).
14. Contact us
If you have any questions about this Privacy Notice or about how we process your personal data, please contact us at:
Real Estate Xchange Ltd
62 St Martin’s Lane, London WC2N 4JS
Email: info@realestatexchange.co.uk
Telephone: +44 (0) 20 3807 4884
