Privacy Policy

Steve Morris & Son LLP (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal data we collect, how we use it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are the data controller for the information we hold. Our registered office is 1 Coleshill Street, Sutton Coldfield, West Midlands, B72 1SD. We are registered with the Information Commissioner’s Office (ICO) (registration number ZB834895).

Information we collect

• Enquiry & contact details — your name, email, phone number and message when you use our contact, valuation or viewing forms.
• Property interest — the properties, areas and services you enquire about.
• Applicant & tenancy information — where you apply for a property, information needed for referencing, right-to-rent and tenancy administration (including optional photo ID you upload).
• Landlords & vendors — if you own a property we let, manage or sell: your name, contact details, correspondence address, bank details for payments to you, ownership and compliance documents, and records of our dealings with you.
• Our staff — our employees’ names, work contact details, roles, working hours and leave, and the records they create in our systems.
• Our staff app — our employees use a private iPhone app (Propdesk Staff). Through it we may create or hold photos of properties and rooms taken during viewings, inspections and visits; signatures when keys are signed out to someone (for example a contractor), as a receipt; text messages sent from our business number to applicants, tenants, landlords and contractors, and their replies; staff chat messages between employees, which may mention clients or properties; and the device information needed to send notifications to a staff member’s phone.
• Technical data — anonymised analytics about how the website is used (only with your consent — see our Cookie Policy).

How we use your information

• To respond to your enquiries and provide the services you request.
• To arrange valuations, viewings and property alerts.
• To carry out lettings and property management, including referencing and legal compliance.
• To meet our legal and regulatory obligations (e.g. anti-money-laundering and right-to-rent checks).
• To manage properties, tenancies, viewings, inspections and keys, including from staff phones while out of the office.
• To send and record text messages from our business number, and to act on replies. Replying STOP turns our texts off.
• To let our staff coordinate their work with each other, and to notify staff of appointments and changes assigned to them.

Our lawful bases

We process your data on the bases of your consent (enquiries and marketing), the performance of a contract (with landlords, vendors, tenants and applicants whose properties or tenancies we handle), our legitimate interests (running our business responsibly, including property photos, key records and signatures, internal staff chat, and texts about appointments and tenancies), legal obligation (compliance records such as right-to-rent checks, deposit protection, safety certificates and records of documents served), and our employment contracts (for our staff’s own data).

Who we share it with

We only share your data where necessary, for example with: referencing and credit-check providers (including Canopy); deposit protection (mydeposits); the Property Redress Scheme and Safeagent; trusted contractors for maintenance; and where required by law.

To run our systems we use service providers who process data for us under contract, including: Laravel Cloud (hosting), Twilio (text messages), Resend and Fastmail (email), Apple Push Notification service (notifications to staff phones), Signable (electronic signatures) and Cloudflare R2 (encrypted backups). We also use AI providers — Anthropic (Claude), Google (Gemini) and xAI (Grok) — to help our staff draft and summarise; where we do, we remove or replace personal details before data is sent wherever possible. We never sell your personal data.

How long we keep it

We keep personal data only as long as the law requires or we genuinely need it, then delete it securely.

• Financial and client money records (rent, payments, statements, invoices) — 6 years.
• Core tenancy and deposit records (the agreement, deposit protection and prescribed information with proof of service, notices and certificates served, the deposit return, and correspondence about repairs, complaints or the deposit) — 6 years after the tenancy ends.
• Inspection photos and routine correspondence — 1 year after the deposit is returned without dispute.
• Referencing documents (payslips, bank statements, credit reports and identity documents beyond right-to-rent) — deleted once the tenancy is set up, or soon after an unsuccessful application.
• Right-to-rent check copies — 1 year after the tenancy ends.
• Anti-money-laundering checks (sales) — 5 years after the sale or our relationship ends.
• Enquiries and applications that don’t lead to a tenancy or sale — 12 months.
• Marketing preferences — until you withdraw your consent.
• Texts, staff chat and key records linked to a property or tenancy — as long as that record, following the rules above.
• Texts and staff chat not linked to a property or tenancy — 2 years.
• Staff records — 6 years after employment ends.

Data on staff phones. Our staff app keeps a limited copy of work data on the staff member’s phone so it works without signal. That copy is encrypted by the phone, is excluded from device backups, and is erased when the staff member signs out or when we revoke their access (for example, when they leave).

Emails we send you

When we email you about your tenancy, property or enquiry, our email service tells us whether the email was delivered and when it was first opened. Opens are recorded using a small image in the email, which loads when you view it. We use this only to confirm that important messages, such as tenancy, rent, safety and legal notices, have reached you, so we can follow up if they haven’t. We don’t track which links you click, and we don’t use this information for marketing.

We rely on our legitimate interests in making sure you receive important information about your tenancy or property. If you’d rather we didn’t record when you open our emails, tell us at [email protected]. You can also stop it by turning off automatic image loading in your email app.

Your rights

You have the right to access, correct, erase, restrict or object to our processing of your data, and to data portability. These rights apply equally to data held through our staff app. To exercise any of these rights, contact us at [email protected].

Complaints

If you have concerns about how we handle your data, please contact us first. You also have the right to complain to the ICO at ico.org.uk.