Privacy notice

Version en-GB-2026-08-26, last changed on 26 August 2026. This version number is stored against every address we hold, so it can be established later which text you were shown.

Who is responsible

BSI OÜ, registrikood 14591080, Maakivi tn 8-2, 61708 Räni alevik, Kambja vald, Tartumaa, Estonia. Contact: info@propertydatacheck.com. The company's details are on the legal notice and the register that holds them is public.

What we collect

Only what you type, and there is very little of it.

Your email address, which is the only required field on the form.

A property address, if you choose to give one. It is optional, it is never looked up, and it is carried through to the request page as plain text. The page shows it back to you labelled as what you asked about, never as what we found, because nothing has been looked up. There is no country field and no hidden country value: the form asks one question and stores one answer.

Technical data needed to run the request. The truncated IP address of the request and the browser's user agent string, and a session identifier derived from them server-side using a salt that rotates daily. The identifier is never written to your device.

The exact text you were shown. The wording of the notice above the button, and the wording of the consent declaration inside the confirmation email, are stored against your record byte for byte. A stored tick is not evidence of what somebody agreed to. The text is.

We do not collect a name, a telephone number, a budget, a timescale, a country or a marketing preference, because the form does not ask for any of them.

Why, and on what lawful basis

Two purposes, and they are stated separately because they rest on different bases.

To answer the request you made. Storing your address and sending you exactly one confirmation email. The basis is article 6(1)(b) of the GDPR, second limb: steps taken at your own request before entering into anything. Independently, and in the alternative, article 6(1)(f) would apply, and the legitimate interest is our interest in replying to a person who has asked us to write to them and in being able to show we did so lawfully.

To email you when something changes. Everything after the confirmation click. The basis is article 6(1)(a), consent, and the evidence of it is the click itself, together with the stored declaration text.

The two never merge. Nothing is sent under the second purpose until the click under the first has happened.

The confirmation email, and what happens if you ignore it

You leave an address. We store it as unconfirmed and send one email. That email contains the declaration setting out who we are, what we would send, how often, and how to stop, and a button that is an act of agreement rather than an act of verification.

If you click it, your address becomes confirmed and we may write to you as the declaration describes: at most one email a month.

If you do not click it, nothing else is ever sent. There is no reminder email and no second attempt. An unconfirmed address is unreachable from every query that could send anything, and it is deleted completely 30 days after it was entered.

How long we keep it

| What | How long | |---|---| | An unconfirmed address | 30 days from entry, then deleted | | A confirmed address | Until you unsubscribe or ask us to erase it | | A confirmed address that we have not written to for a year | We send one last message with an unsubscribe link and then stop | | The raw IP address of a request | 7 days, then truncated | | The notice text and declaration text shown to you | For as long as we hold the address, as the record of what you agreed to | | A suppression record after erasure | Indefinitely, and it holds no address. See below |

Who else sees it

Two processors, and nobody else.

Neon, for the database, with the data stored in the European Union in the eu-central-1 region. Neon's parent company is established in the United States, and we disclose that as a transfer even though the database region is in the European Union, because the parent's position is what matters rather than the region label.

Scaleway SAS, a company established in France, for sending the confirmation email, in the fr-par region. That is not a transfer outside the European Union.

Vercel, for hosting, with the functions that handle your request pinned to the fra1 region in Frankfurt.

We do not sell, share or pass your address to any third party. There is no partner network on this site, no referral arrangement and no introduction service, and no clause on this page reserves a right to create one later. An ePrivacy consent runs to the sender who obtained it and cannot be handed on, so a reservation of that kind would be worthless as well as wrong.

What we do not do

No cookie banner, because there is nothing to consent to. This site sets no analytics cookie, no advertising cookie and no third-party cookie. It uses no local storage, no session storage and no service worker, and it loads no script, font or image from any other host. One cookie is set, on the request endpoint only, and it exists solely to make that one form submission safe.

No client-side analytics, no tag manager, no heatmap, no session recorder and no chat widget.

No tracking pixel and no open-tracking in any email we send, and the confirmation link is not wrapped in a click-tracker.

No automated decision-making and no profiling. Nothing about you is scored, segmented or predicted.

No IP address is printed in any email. If somebody else typed your address into our form, printing the IP would disclose a stranger's IP to the one person who did nothing.

Your rights

You can ask for access to what we hold, correction of it, erasure, restriction of processing, a copy in a portable form, and you can object to processing. Where processing rests on consent you can withdraw it at any time, and withdrawing it does not affect the lawfulness of anything done before you did.

Two of those need no email at all.

Unsubscribe is one click, from the link in any email we send, and it takes effect immediately. No login, no preference centre, no question about why, and no re-entering your address.

Erasure is also one click, from the same place. It deletes the record. It also writes a suppression record holding nothing but an irreversible hash of your address, the time, and the reason, in the same transaction. That hash exists so that your address can never be added again by accident, and it cannot be turned back into an address.

For anything else, write to info@propertydatacheck.com.

Complaints

You can complain to a supervisory authority.

Ours is Andmekaitse Inspektsioon (AKI), the Estonian Data Protection Inspectorate, at aki.ee.

You may also complain to the authority where you live. For readers in the United Kingdom that is the Information Commissioner's Office. For readers in Ireland it is the Data Protection Commission.

Two things we have not resolved, stated rather than hidden

A United Kingdom representative. A controller established outside the United Kingdom that offers services to people in the United Kingdom may be required to appoint a representative there under article 27 of the UK GDPR. The primary audience of this site is British. Whether the obligation applies to a site that sells nothing has not been settled, and if a representative is appointed their name and address will be added to this page.

United States privacy law. One page on this site draws more measured search demand in the United States than in the United Kingdom, so some readers here will be American. The exposure under individual United States state privacy statutes has not been analysed, and this notice does not claim to address it.

Both are recorded rather than glossed over, because a privacy notice that hides what is unresolved is worth less than one that names it.

Changes to this notice

If this notice changes materially, the version number and date at the top change with it, and the version you were shown stays stored against your record. We do not change it silently. Who writes this site and how it is checked is on who writes this, and the company's details are on the legal notice.