Your information, handled properly.

1. Who we are

Middleton Estates and Lettings Ltd (referred to as “Middleton”, “we”, “us” or “our”) is the data controller responsible for the personal information covered by this policy.

We are a company registered in England and Wales under company number 16033653. Our registered office is 2 Whittle Gardens, Peters Mill, Alnwick, United Kingdom, NE66 2FL.

You can contact us about this policy or your personal information at admin@middletonestates.co.uk, by telephone on 01670 336860, or through our contact page.

2. Information we collect

Depending on how you deal with us, we may collect and use:

• Identity information, such as your name, date of birth, identification documents, nationality and Right to Rent information.
• Contact information, such as your address, email address and telephone number.
• Property information, including property address, ownership information, photographs, condition, occupancy, rental value, access details and repair records.
• Tenancy and application information, including household details, previous addresses, references, guarantor details and tenancy history.
• Financial information, including income, employment, affordability, bank or payment details, rent and deposit records, arrears and transaction information.
• Communication records, including emails, messages, call notes, enquiries, complaints and instructions.
• Compliance and risk information, including identity, fraud-prevention, sanctions, credit, referencing and legal checks where relevant.
• Technical information, such as IP address, browser/device information, security logs and information collected through website cookies or similar technologies.
• Special category or sensitive information where necessary, for example health, disability or vulnerability information needed to provide appropriate support, arrange access or respond to an emergency.

Please do not provide information that we have not asked for unless it is genuinely relevant to your enquiry, application, tenancy or property.

3. Where we obtain information

We normally receive information directly from you. We may also receive it from landlords, tenants, applicants, occupiers, guarantors, employers, previous landlords or agents, referencing and identity-check providers, contractors, insurers, deposit schemes, payment providers, public registers, local authorities, courts, regulators and other organisations involved in a tenancy or property transaction.

4. How and why we use information

Where we rely on legitimate interests, we consider whether our use is necessary and balanced against your rights and reasonable expectations. You may ask us for more information about this assessment.

5. Sensitive information

We only use special category information where it is necessary and an additional legal condition applies. This may include explicit consent, protecting vital interests, meeting legal obligations or dealing with legal claims. Access is restricted to those who genuinely need the information.

6. Who we share information with

Where necessary for the purposes described above, we may share relevant information with:

• landlords, tenants, applicants, occupiers and guarantors;
• referencing, credit, identity and fraud-prevention providers;
• deposit-protection schemes, rent-payment providers, insurers and utility or council services;
• maintenance contractors, inventory providers, surveyors and other property professionals;
• solicitors, accountants, debt-recovery providers, courts and professional advisers;
• local authorities, government bodies, regulators, law-enforcement agencies and the Home Office where required;
• property portals such as Rightmove and repair-reporting services used to deliver our services;
• website, hosting, email, form, document-signing, communications and other technology providers acting on our instructions; and
• a buyer, investor or successor if our business or assets are sold or reorganised, subject to appropriate confidentiality protections.

We require service providers to protect personal information and use it only for the agreed purpose. We do not sell personal information.

7. International transfers

Some technology providers may store or access information outside the United Kingdom. Where this happens, we use an appropriate legal safeguard, such as UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism. You may contact us for further information about the safeguards relevant to your information.

8. How long we keep information

We keep information only for as long as it is reasonably needed for the purpose collected, to meet legal and regulatory requirements, and to deal with complaints or legal claims. We review retention and securely delete or anonymise information when it is no longer required.

Typical periods include:

• enquiries and unsuccessful applications: normally up to 24 months after the last meaningful contact, unless a longer period is justified;
• client, tenancy, property, financial, complaint and contract records: normally for the relationship and up to six years afterwards;
• Right to Rent evidence: for the tenancy and at least one year after it ends, as required by the scheme;
• marketing records: until you opt out or the information is no longer useful following a periodic review; and
• security and technical records: for the period reasonably required to protect and investigate our systems.

These periods may be shortened or extended where the law, a regulator, a dispute, safeguarding concerns or another legitimate reason requires it.

9. How we protect information

We use appropriate organisational and technical measures designed to protect information against accidental loss, unauthorised access, alteration or disclosure. These include access controls, secure systems, appropriate supplier arrangements, staff procedures and limiting information to what is necessary. No online system is completely risk-free, but we review our protections and respond to suspected incidents.

10. Automated decisions

We do not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects. Referencing or fraud-prevention providers may use automated checks as part of their service. Where such processing is relevant, further information about the provider and available safeguards can be requested from us.

11. Website cookies and third-party content

Our website may use essential cookies and similar technologies for security, functionality and performance. Non-essential technologies should only be used where permitted. Embedded or linked services—such as Google reviews, Google-hosted fonts, Rightmove or a repair-reporting portal—may process information under their own privacy terms when you interact with them.

You can control cookies through any consent tool shown on the website and through your browser settings. Blocking some technologies may affect how parts of the site work.

12. Your data-protection rights

Depending on the circumstances, you may have the following rights:

These rights are not absolute and exemptions may apply. We may need to confirm your identity before acting on a request. We normally respond within one month and do not charge a fee unless a request is manifestly unfounded or excessive.

13. Questions, requests and complaints

Please contact us first if you have a question or concern so we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. Visit ico.org.uk/make-a-complaint/ or telephone 0303 123 1113.

14. Changes to this policy

We may update this policy when our services, systems or legal obligations change. The latest version will be published on this page with a revised date. Significant changes may also be brought to your attention by another appropriate method.

Last updated: 19 August 2026