Legal
Privacy Notice
For users, estate agents, vendors, occupiers, contractors and other individuals
Version 1.0 | Effective date: 10 August 2026
This Notice reflects the approved launch configuration and current processing arrangements. VBYM keeps the Notice under review and updates it where active providers, cookie tools, hosting arrangements, AI services, payment services, retention periods or international-transfer arrangements materially change.
1. Who we are
1.1 View Before You Move Ltd (“VBYM”, “we”, “us” or “our”) is the controller of Personal Data described in this Notice unless we state otherwise.
1.2 We are registered in England and Wales under company number 16896041. Our registered office is 10A King Street, Luton, England, LU1 2DP.
1.3 Contact privacy@vbym.co.uk for privacy matters.
1.4 This Notice explains how we use information when you browse, create an account, search, enquire, act for an Agency, arrange or attend a capture, appear in media, work with us or otherwise interact with VBYM.
2. Personal information we collect
Category
Account and identity data
Examples
Name, email, telephone, password hash, user ID, account type, authentication and verification status.
Category
Property-search data
Examples
Searches, filters, saved properties, alerts, preferred areas and interactions.
Category
Enquiry and communication data
Examples
Enquiry content, preferences, support messages, complaints, feedback and notes.
Category
Agency and professional data
Examples
Agency name, role, office, work contacts, authority, branch, account users, onboarding, plan, credits and CRM information.
Category
Booking and access data
Examples
Property address, appointment, vendor or occupier contact, electronic-signature status, authority and audit record, reminders, access instructions, parking, keys, hazards, pets and status.
Category
Property media
Examples
Photographs, video, 360-degree footage, audio, floor plans, measurements, room labels and items visible or audible.
Category
Payment and transaction data
Examples
Orders, invoices, amounts, VAT, payment status, provider references and limited billing information.
Category
Technical and usage data
Examples
IP address, device, browser, identifiers, logs, pages viewed, errors, security events and media interactions.
Category
Location data
Examples
Approximate IP location, search locations, property locations and service-area or appointment location where needed.
Category
Marketing data
Examples
Preferences, consent records, campaign interactions and suppression records.
Category
Supplier and workforce data
Examples
Professional contacts, identity verification, role, permissions, availability, allocation, access logs and contracts.
3. How we obtain information
3.1 We collect information directly when you create an account, search, save, enquire, book, order, upload, contact us, approve a listing, join a pilot or work with us.
3.2 We may receive information from estate agents, vendors, landlords, occupiers, developers, CRM providers, payment providers, electronic-signature and communications providers, authentication services, analytics tools and approved suppliers.
3.3 Where an Agency imports data, it is responsible for the appropriate lawful basis and privacy information.
3.4 We may derive account status, service usage, interaction statistics, service area and security risk from information we hold.
4. Purposes and lawful bases
4.1 We select the lawful basis for each purpose before processing begins. Contract applies only where the processing is necessary for a contract with the individual or steps they requested. Authority to record or publish is an operational permission and is not itself a UK GDPR lawful basis. Where we rely on legitimate interests, we document the purpose, necessity and impact on individuals.
Purpose
Provide accounts, saved searches and alerts
Data used
Account, search, technical and preference data
Typical lawful basis
Contract where needed to provide a registered-user service; legitimate interests in providing requested functionality and operating the Platform.
Purpose
Send enquiries to agents
Data used
Name, contacts, message, property and metadata
Typical lawful basis
Legitimate interests in transmitting and managing the enquiry requested by the sender; contract or steps requested where applicable.
Purpose
Onboard Agencies, Orders and billing
Data used
Agency, identity, transaction and communications
Typical lawful basis
Contract with the Agency; legal obligations for tax, accounting and compliance; legitimate interests in administration, verification and fraud prevention.
Purpose
Arrange Capture Appointments, authority and preparation
Data used
Booking, contact, authority, signature status, communications, access, location, safety and Property data
Typical lawful basis
Contract with the Agency; legitimate interests in arranging an authorised appointment safely and efficiently, obtaining and evidencing operational authority, and providing preparation information.
Purpose
Process media and create drafts
Data used
Media, audio, measurements, Agency Content and approvals
Typical lawful basis
Contract with the Agency; legitimate interests in creating authorised property-marketing materials, subject to privacy safeguards.
Purpose
Publish and host listings
Data used
Property data, media, agent details and approvals
Typical lawful basis
Contract with the Agency; legitimate interests in authorised property marketing and Platform operation. Consent is used only for optional promotional uses where consent is the appropriate basis.
Purpose
Operate CRM and exports
Data used
Listing, account, CRM, audit and media data
Typical lawful basis
Contract with the Agency; legitimate interests in operating authorised integrations and maintaining audit records.
Purpose
Develop, maintain and support the Platform
Data used
Technical, account, listing, media, logs and support data
Typical lawful basis
Contract where applicable; legitimate interests in reliable, secure and supported Platform operation.
Purpose
Security and fraud prevention
Data used
Account, identity, technical, payment and communications
Typical lawful basis
Legitimate interests in security and fraud prevention; legal obligation where a specific law requires processing.
Purpose
Support, complaints and legal rights
Data used
Account, communications, orders and evidence
Typical lawful basis
Contract where applicable; legitimate interests in support, complaint handling and legal claims; legal obligation where applicable.
Purpose
Analytics and improvement
Data used
Usage, technical and aggregated data
Typical lawful basis
Consent where required for storage/access technologies; otherwise legitimate interests in service measurement and improvement, using minimised or aggregated data where practical.
Purpose
Direct marketing
Data used
Contacts, role, preferences and campaign interactions
Typical lawful basis
Consent where required for individual marketing; otherwise legitimate interests for proportionate business-to-business marketing, subject to the right to object.
Purpose
Legal compliance
Data used
Relevant categories
Typical lawful basis
Legal obligation where a specific duty applies; legitimate interests in establishing, exercising or defending legal claims.
5. Property media, incidental information and children
5.1 Media may incidentally record people, voices, family photographs, documents, screens, number plates, security devices, artwork or belongings.
5.2 The Agency is responsible for confirming its authority to market the Property, arrange access and provide the relevant contact details. VBYM will normally send a direct electronic Property Media Capture and Publication Authority to the vendor, owner, landlord or authorised occupier, copy the Agency contact into the initial communication or provide equivalent status visibility, and send reminders where appropriate.
5.3 The initial authority email may contain concise preparation and privacy information. Once the Authority is signed, VBYM will normally send the signatory and Agency a confirmation and the full Vendor Filming Preparation Guide. The Agency remains responsible for monitoring and chasing an unsigned Authority before the appointment.
5.4 We do not intentionally collect Special Category Data through ordinary capture. Such information should be removed or concealed.
5.5 We may restrict, blur, replace or delete sensitive information where reasonably practical.
5.6 Children should not create accounts or appear in media without appropriate authority and safeguards.
6. AI-assisted processing
6.1 We may use AI-assisted tools to create draft descriptions, organise content, identify quality issues or support internal workflows.
6.2 AI-generated property descriptions are drafts requiring human and Agency review.
6.3 We do not use solely automated decisions producing legal or similarly significant effects.
6.4 We minimise information sent to AI providers and use settings and contracts intended to prevent use for general model training where available.
8. UK production, approved technical support and service providers
8.1 Routine Property capture, media editing, processing, room labelling, floor-plan preparation, draft-description creation and draft-listing preparation are performed in the United Kingdom by VBYM employees or approved UK-based workers or contractors.
8.2 The same suitably trained UK-based person may perform capture and subsequent processing/editing.
8.3 VBYM retains ownership and control of the principal production accounts, recovery methods and access approvals. Approved live technical administration may be performed by Cyber Nexus (SMC-Private) Limited through Abdul Kabeer, who is the only Cyber Nexus person currently authorised for production access.
8.4 Cyber Nexus develops and maintains the Platform under the existing MSA and SOW, as novated to Cyber Nexus. Fiza Asad and Hassan Omar are approved Cyber Nexus contractors with GitHub development access only and no authority to access production Personal Data, live databases, storage, credentials or administrative systems.
8.5 Development and testing must use dummy, synthetic, anonymised or otherwise non-live information and must not use or modify live production records. Where a live issue requires technical support, access is limited to the minimum necessary, uses individual accounts and multi-factor authentication, and is subject to VBYM authorisation, logging where available, incident controls and applicable processing and international-transfer terms.
8.6 We may use approved hosting, database, authentication, payment, communications, electronic-signature, booking, monitoring, security, backup and support providers. Some providers may process information outside the United Kingdom or permit support access from another country.
8.7 Where use of an active provider involves a restricted international transfer, VBYM will use an appropriate safeguard recognised under UK data-protection law and will carry out the required assessment and supplementary measures.
8.8 We maintain internal records of active providers, processing purposes, locations and safeguards and review them when the live technology stack changes.
9. Retention
Record
Consumer account
Typical retention
While active, then normally deleted or anonymised within 24 months after closure unless needed for disputes, security or law.
Record
Property enquiries
Typical retention
Normally up to 24 months after the enquiry.
Record
Agency contracts, Orders, invoices and payments
Typical retention
Normally 6 years after the relevant financial year or relationship.
Record
Booking and access records
Typical retention
Normally 3 years after the appointment, longer where needed for safety, disputes or claims.
Record
Raw Property media
Typical retention
Normally 90 days after final approval or delivery unless rework, backup, dispute or legal hold requires longer.
Record
Processed assets and immersive content
Typical retention
While the listing or hosting is active. Founder PAYG immersive hosting is normally included for 12 months from first publication or until sold, let or withdrawn, followed by any agreed renewal or restricted archive and deletion process.
Record
Agent approval and authority records
Typical retention
Normally 6 years after the relevant listing or service ends.
Record
Support and complaint records
Typical retention
Normally 3 years after closure, and longer where reasonably necessary for a legal claim, regulator enquiry or documented complaint outcome.
Record
Security and technical logs
Typical retention
Normally up to 12 months, longer where needed for investigation or security.
Record
Production-administrator access and audit records
Typical retention
Normally at least 24 months after the access or deployment event, and longer where required for investigation, contract evidence or regulatory accountability.
Record
Marketing preferences
Typical retention
Until objection or withdrawal, with a minimal suppression record.
Record
Cookie and consent records
Typical retention
For the duration stated in the Cookie Policy and consent tool.
11. Security
11.1 We use measures designed to protect information, including role-based access, authentication, encryption where appropriate, logging, backups, supplier controls and incident procedures.
11.2 Production access is restricted to specifically authorised VBYM personnel and approved named supplier personnel using individual accounts, multi-factor authentication and least-privilege permissions. Live production data is kept separate from development and testing, and production credentials, backups and identifiable logs are limited to people whose authorised duties require them.
11.3 No online service is completely secure. Users must protect passwords and notify us of suspected compromise.
11.4 We notify the ICO and affected individuals where legally required following a Personal Data Breach.
12. Your rights
12.1 Depending on the circumstances and lawful basis, you may have rights of access, correction, erasure, restriction, objection, portability, withdrawal of consent and complaint.
12.2 To exercise a right, contact privacy@vbym.co.uk. We may request proportionate information needed to verify identity and locate the relevant records.
12.3 Rights are not absolute and lawful exemptions or retention duties may apply.
12.4 IMPORTANT — RIGHT TO OBJECT: where we rely on legitimate interests, you may object to that processing. You have an absolute right to object to processing for direct marketing.
13. Data-protection complaints
13.1 You may make a data-protection complaint by emailing privacy@vbym.co.uk with the subject line “Data Protection Complaint”, or by writing to our registered office.
13.2 We will acknowledge receipt within 30 days. We will take appropriate steps to investigate without undue delay, keep you appropriately informed and communicate the outcome without undue delay.
13.3 A complaint should include your name and contact details, a description of the concern, relevant dates and any outcome you are seeking. Please do not send unnecessary identity documents or sensitive information by ordinary email.
13.4 You may complain to the Information Commissioner’s Office at any time. Contacting us first may allow the concern to be resolved more quickly.
14. Controllers and processors
14.1 When an estate agent receives and handles an enquiry for its own purposes, it is normally a separate controller.
14.2 Where VBYM processes data only on Agency instructions, the Agency is controller and VBYM is processor.
14.3 Where VBYM determines its own purposes for Platform operation, security, billing, legal compliance, analytics or marketing, VBYM is controller.
14.4 Approved live-service providers and Cyber Nexus may act as processors to VBYM and may act as subprocessors in relation to Agency-controlled data. Written processing terms, subprocessor authorisation and any required international-transfer safeguards apply. VBYM remains responsible for selecting, instructing and monitoring its processors.
15. Changes and contact
15.1 We may update this Notice to reflect changes in law, systems, suppliers, data flows or business practice.
15.2 Material changes will be communicated by an appropriate notice.
15.3 Privacy contact: privacy@vbym.co.uk. Postal address: View Before You Move Ltd, 10A King Street, Luton, England, LU1 2DP.