Privacy Policy

1. Andrew Creighton Ltd is committed to protecting and respecting your privacy.

This notice explains how we collect, use, store, share and otherwise process personal data in connection with our business, services and website.

We process personal data in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018 as amended, and the Privacy and Electronic Communications Regulations 2003 (PECR), where applicable. This notice explains the purposes and lawful bases for processing, recipients, retention, international transfers (where relevant), your rights and how to contact us. We review this notice when our processing or legal obligations change.

Please read this notice to understand our practices regarding your personal data. This notice is provided for transparency. Continued use of our services or website does not, by itself, constitute consent to processing. Where consent is the appropriate lawful basis, we will request it separately, and you may withdraw it at any time, without affecting processing carried out before withdrawal. 

Any questions regarding this privacy policy should be sent by email to info@andrewcreighton.co.uk. 

2. About Andrew Creighton Ltd

Andrew Creighton Ltd is a firm of Chartered Surveyors and commercial and residential property agents. The registered address is 21 Aylmer Parade, Aylmer Road, London N2 0AT and the company number is 06765565. Andrew Creighton Limited is registered with the Information Commissioner's Office (ICO) under registration reference ZC283427.

Andrew Creighton Ltd is a data controller when it determines the purposes and means of processing personal data for its own business activities. For some property management or client engagements, we may process personal data on documented instructions from a client and act as a processor for that activity.

Depending on the activity, we may process personal data because it is necessary to perform a contract or take pre-contract steps, to comply with a legal obligation, for our or a third party’s legitimate interests where those interests are not overridden by your rights, or because you have consented. The lawful basis applicable to a particular purpose depends on the circumstances and is assessed internally.

3. What type of personal data do we collect?

We need certain personal information to be able to offer our services. You provide some of this data directly, for instance when you instruct us or contact us. We may also receive personal data indirectly through solicitors, property managers, clients or other third parties involved in an instruction.

Depending on the service or instruction, the people whose data we may process include clients and prospective clients, landlords and freeholders, leaseholders, tenants and residents, directors or representatives of management companies, contractors and suppliers, professional advisers, website visitors and people who contact us or whose details are provided to us in connection with a property or instruction.

When you contact Andrew Creighton Ltd, or when a third party contacts us on your behalf or provides your details in connection with an instruction, we may process the following personal data where relevant to the service or instruction:

• First name, last name and title;

• Property or postal address;

• Email address and telephone number;

• Payment and billing information, e.g. bank account (if applicable);

• Company name and business registration number (if applicable);

• Property, lease or tenancy information and details of the instruction

• Service-charge or ground-rent balances, payment history and related correspondence, where relevant

• Maintenance requests, inspection records, contractor details, complaints, arrears, insurance-related matters or dispute information, where relevant

• Identity documents or information needed for identity, legal, regulatory or compliance checks, where necessary and lawful

• Messages and correspondence you send us

• Technical information collected through cookies or similar technologies as described in section 9.

In connection with the management of properties for which Andrew Creighton Ltd is appointed as managing agent, we may also process mortgagee details, financial information relating to service charges and payments, and identification documents such as passports or driving licences where these are relevant and necessary for the instruction or for applicable legal, regulatory or compliance requirements.

Depending on the services we provide, we may also collect and process information relating to property valuations (residential and commercial), commercial rent reviews, lease renewals, lease advisory, residential lease extensions and collective enfranchisement. This may include property and lease details, rental amounts, valuation information and supporting evidence, relevant financial information, correspondence and details of the parties involved in the instruction. We only collect information that is relevant and necessary for the particular service or purpose.

We may receive personal data from third parties we work with or who are involved in an instruction. These may include solicitors, property managers, managing agents, clients, landlords, leaseholders, management companies, building contractors, professional advisers or public records. Where we obtain personal data from a source other than you, we will provide information about the source or relevant categories of sources where required by law, subject to applicable exceptions.

Where appropriate and lawful, we may collect information needed for legal, regulatory or compliance requirements, which may include identity or source-of-funds information where relevant. We may also collect bank details to process payments connected with the services we provide.

We may use your contact details and property requirements to send relevant property information or other marketing communications. You can opt out of direct marketing at any time. Opting out of marketing does not necessarily mean we must delete records we are legally required or otherwise entitled to retain.

Some information is necessary to consider or perform an instruction, verify identity where legally required, or comply with legal obligations. If you do not provide necessary information, we may be unable to provide the requested service or complete the relevant transaction.

4. Why do we use your personal data?

We use personal data for specified purposes and only where we have a lawful basis under applicable data protection law. The purposes and lawful bases depend on the particular service and processing activity. They may include the following:

Performance of contracts and pre-contract steps - to respond to enquiries, take steps at your request before entering into a contract, and provide the services you request.

Property management — to provide property management services under our contract with the relevant management company, freeholder or other client and to carry out necessary tasks as their appointed agent. This may include administering service charges, ground rent and other property-related payments, maintaining accounts and preparing financial reports, coordinating repairs, maintenance, inspections and contractors; responding to property-related enquiries and handling complaints, arrears and disputes.

Surveying, valuation and lease advisory services — to provide property valuations (residential and commercial), including valuations relating to lease extensions and collective enfranchisements. To advise on and negotiate commercial rent reviews and lease renewals and to provide related surveying, professional advice and negotiation services. This may involve processing the contact details of clients and other parties, property and lease information, rental details, valuation evidence, correspondence and relevant financial information as necessary to carry out the instruction.

Customer support - to support you in using our services and respond to any queries you may have, including discussing relevant matters with third parties you have asked us to engage with or where otherwise lawful and necessary.

Customer engagement and communication - we communicate with you via email, SMS text or other electronic media about invoices, reports, opening of a file, providing our surveying services, updating you of significant developments, resolving complaints and any other matters related to our services.

Marketing - We may occasionally send you information about our products and services that may be of interest to you. Where consent is required, we will obtain it first. Where a statutory exception applies, we will ensure its conditions are met. You can opt out of direct marketing at any time, as explained in section 5.

Safety, security and dispute resolution - to protect our business, people, property and systems, prevent or investigate suspected fraud or misuse, and establish, exercise or defend legal claims.

Legal obligations - We may process your information to comply with applicable laws. This includes lawful requests from competent authorities, administrative obligations and in cases involving legal disputes.

Improving and personalising our products and services - We use your personal information to improve our products and services where we have an appropriate lawful basis.

IT maintenance, development and incident management - to resolve issues, maintain and develop our systems, and manage incidents affecting our services or personal data.

Business administration, records and reporting - To be able to operate our business, we also use your personal data for general business processes. This includes accounting, archiving, insurance, audits, management reporting and related administration.

The lawful basis for processing will depend on the specific activity. These may include taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation, pursuing legitimate interests, or obtaining consent where appropriate.

Where we rely on legitimate interests, these may include administering property-management services, maintaining business records, communicating with relevant parties, managing payment issues, protecting our business and systems, improving our services, and establishing, exercising or defending legal claims. We consider the relevant interests and whether they are overridden by individuals’ rights and interests and document our assessment where required.

Where we process personal data for more than one purpose, the applicable lawful basis may differ depending on the purpose and circumstances.

5. Who do we share your personal data with? 

We may share personal data where necessary, proportionate and lawful for the purposes described in this notice. Depending on the instruction, the personal data may include names, addresses, telephone numbers, property or lease information, service-charge balances, payment information and relevant correspondence.

Recipients may include:

• Clients, landlords, freeholders, leaseholders, tenants, residents and management companies where relevant to the instruction

• Contractors, maintenance providers, managing agents and suppliers involved in property management or related services

• Solicitors, accountants, insurers, surveyors, professional advisers and other advisers involved in the relevant matter

• Banks, payment providers and other providers involved in processing relevant payments

• IT support, hosting, cloud, document-management and other service providers that support our business

• Debt-recovery providers or other parties where necessary to address outstanding payments or enforce agreements

• Regulators, public authorities, courts, law enforcement agencies or other parties where disclosure is required or permitted by law

This data sharing enables us to provide our property management, surveying, valuation and lease advisory services, fulfil our contractual and other professional obligations, and deal with matters arising from the relevant instruction.

We may disclose personal data where we are under a duty to do so to comply with a legal obligation, to enforce or apply agreements, or to protect the rights, property or safety of Andrew Creighton Ltd or others. We share only information reasonably necessary for the relevant purpose and consider the recipient’s role and the applicable lawful basis.

Where a service provider processes personal data on our behalf, we will put appropriate contractual and security arrangements in place. Where we process personal data on a client’s behalf, our arrangements with that client will govern our responsibilities for that processing.

You can opt out of direct marketing at any time using the method provided in the communication or by contacting info@andrewcreighton.co.uk . An opt-out from marketing does not automatically require deletion of records where we have a lawful reason or legal obligation to retain them. We will respond to requests concerning access, erasure or other rights in accordance with applicable law.

6. How do we protect your personal data?

We have implemented appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access or processing, and against accidental loss, destruction or damage. Access to personal data is restricted to individuals who have a genuine business need to access it. Anyone processing personal data on our behalf or under our authority is required to do so only in an authorised manner and is subject to appropriate confidentiality obligations.

We have procedures to assess suspected personal data breaches. We will notify the ICO and affected individuals where and when required by applicable law.

7. How long do we keep your personal data?

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, meet legal, regulatory, accounting and reporting requirements, and establish, exercise or defend legal claims.

Retention periods depend on the type of information, the nature of the instruction and any applicable legal or professional requirements. For example, financial and accounting records may need to be retained for a statutory period, while property management, surveying, valuation, contractual and dispute-related records may be retained for different periods depending on the circumstances.

When personal data is no longer required, we will securely delete it or anonymise it where appropriate. You may request erasure of your personal data, but this right is subject to certain conditions and exceptions. We may need to retain information where we have a legal obligation or another lawful reason to do so.

8. Your personal data rights

Under applicable data protection law, you may have the following rights, depending on the circumstances. Some rights are subject to conditions and exceptions:

• The right to be informed about how we use your personal data.

• The right to request access to your personal data and supplementary information.

• The right to request correction of inaccurate or incomplete personal data.

• The right to request erasure of personal data in certain circumstances.

• The right to receive certain personal data you provided to us in a structured, commonly used and machine-readable format and, where applicable, to transmit it to another controller.

• The right to object to processing of your personal data for direct marketing at any time.

• The right to object to certain other processing, including processing based on our legitimate interests, where the legal conditions are met.

• The right to request restriction of processing in certain circumstances.

• The right to withdraw consent where processing is based on consent; this does not affect processing carried out before withdrawal.

• The right to seek compensation where the legal conditions for a claim are met.

For further information on your rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO).

To exercise your rights, contact us using the details in section 11. We may need to verify your identity before responding. We will handle requests in accordance with applicable law.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are concerned about how we handle your personal data. The ICO can be contacted at https://ico.org.uk or on 0303 123 1113. Its postal address is Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We would appreciate the opportunity to address your concerns first, so please contact us in the first instance if you wish.

9. Cookies

Cookies and similar technologies may be placed on or accessed from your device when you use a website. They may be used for purposes such as enabling core website functions, remembering preferences, or measuring website use. The information collected and the legal requirements depend on the technology used.

Andrew Creighton’s website uses cookies to monitor use and experience for visitors to our website. This helps Andrew Creighton improve the site where necessary and produce resources that interest our visitors. Our cookies cannot identify you as an individual. We will obtain consent before using non-essential cookies or similar technologies where PECR requires it.

You can set your browser to not accept cookies, but browser settings alone may not satisfy the legal requirements for consent. Where required, our website will provide a compliant consent mechanism for non-essential cookies or similar technologies. Blocking certain technologies may affect website functionality.

10. Changes to Andrew Creighton’s privacy policy

This Privacy Policy was last updated on 28^th October 2026. Andrew Creighton Ltd may review and update this notice to reflect changes to our processing or legal requirements. We will publish the current version and update the date. Where required, we will bring material changes to the attention of affected individuals.

11. Contact

Questions, comments and requests regarding this Privacy Policy should be addressed to Andrew Creighton Ltd, 21 Aylmer Parade, Aylmer Road, London N2 0AT and info@andrewcreighton.co.uk. 

Registered office: 21 Aylmer Parade, Aylmer Road, London, N2 0AT. Company number: 06765565. ICO registration reference: ZC283427.

If you are not happy with the way we have managed your personal data, you can contact the ICO using the details in section 8.