Privacy & Cookie Policy
Last updated: 9 September 2026
1. Introduction
Cyclopean Estates Limited ("we", "us", "our") provides short-let property management to property owners across the United Kingdom.
We are the data controller for the information described in this policy. That means we decide why and how it is used, and we are responsible for it.
Cyclopean Estates Limited
Company number: 17389238
Registered office: 45 Barmpton Lane, Darlington, DL1 3HH
Website: cyclopean.co.uk
Email: luke@cyclopean.co.uk
This policy explains what we collect, why, what we do with it, who else sees it, how long we keep it and what you can ask us to do about it.
It covers property owners and anyone who enquires about our services, visitors to cyclopean.co.uk, and guests staying at properties we manage.
Responsibility for data protection sits with Luke Greenhow, director. Any question about this policy should go to luke@cyclopean.co.uk.
2. What information we collect
Information you give us
When you enquire through an advert on Facebook or Instagram. We run adverts using Meta's instant lead forms. If you submit one, we receive your full name, email address, phone number, the postcode of your property and the number of bedrooms it has. Meta pre-fills some of these from your Facebook or Instagram profile, and the form is completed on Meta's platform rather than on our website.
When you enquire through our website. Our forms ask for your name, email address, phone number and details about your property.
When you book a call with us. Your name, email address, phone number and the time you choose.
When you speak to us. Notes we take during a call — what you tell us about your property, your situation and what you are looking for.
When you become a client. Your identity and contact details, the property address and its access arrangements, the bank account we pay you into, your signed management agreement, and correspondence between us throughout the arrangement.
We do not ask for special category information — health, ethnicity, religion, sexual orientation, political opinions, biometric or genetic data — and we do not record it if it comes up in conversation.
Information collected automatically
Meta Pixel and Conversions API. Our website carries the Meta Pixel and its server-side counterpart, the Meta Conversions API. Together they record that a browser visited particular pages and took particular actions, and send that to Meta along with technical identifiers such as a cookie ID, IP address and browser information. We use this to measure whether our adverts work and to show adverts to relevant people. Neither runs unless you consent. Section 10 explains how that works.
Server logs. Our website host records standard technical information — IP address, browser type, pages requested and timestamps — as part of running and securing the site.
Information from other sources
Meta pre-fills lead forms from information you have already given Facebook or Instagram, so some of what reaches us came from Meta rather than directly from you.
When you ask us for an income projection, we look at public listings of comparable properties in your area and publicly available information about your property.
Where we manage a property, booking platforms and our channel manager pass us information about guests who book.
3. Our legal basis for using your information
UK GDPR requires a lawful basis for each purpose. Ours are as follows.
Legitimate interests. Responding to your enquiry, contacting you to discuss managing your property, keeping a record of enquiries, marketing our own services to people who have enquired, and defending ourselves if a dispute arises. Our interest is in running and growing a property management business. We have weighed that against your interests: you gave us your details specifically so that we would contact you, and you can tell us to stop at any time.
Performance of a contract. Everything we do to deliver management services once you are a client — running the listing, taking bookings, paying you, corresponding with you — and steps we take at your request before a contract exists, such as preparing a written income projection.
Legal obligation. Financial and accounting records, tax records, client money records, and anything we are required to keep by our redress scheme, our Client Money Protection scheme or our insurers.
Consent. The Meta Pixel and Conversions API, and any marketing to someone who has never enquired. You can withdraw consent at any time, and it is as easy to withdraw as it was to give.
4. How we use your information
- To call and email you about managing your property, after you have enquired
- To prepare an income projection for your property at your request
- To arrange and hold calls with you
- To run and manage your property listing if you become a client, and to communicate with guests
- To take bookings, handle payments and pay you what you are owed
- To keep the accounts, financial records and client money records we are required to keep
- To measure whether our advertising works, and to show adverts to people who have visited our site or who resemble people who have enquired — only where you have consented
- To send you further information about our services after you have enquired, unless you tell us not to
- To handle complaints, insurance matters and disputes, and to defend legal claims
- To keep our systems and the properties we manage secure
We do not sell your information. We do not make automated decisions about you that produce legal or similarly significant effects.
5. Who we share your information with
Some of the organisations below act only on our instructions. Others decide for themselves what to do with information, and their own privacy policies apply to that part.
Providers acting on our instructions
- Our customer relationship management system, which holds every enquiry and client record — your name, contact details, property details, call notes, correspondence and marketing history
- Our call booking system — your name, email address, phone number and appointment time
- Our email and document storage provider — correspondence and documents
- Our website host — server logs and form submissions
- Where we manage a property, our channel manager and payment processor — guest and booking information
- Cleaners, maintenance contractors and other suppliers at properties we manage, who receive only what they need to do the job
We have a written contract with each of these requiring them to protect your information, use it only as we instruct, and delete or return it when we stop using them.
Organisations that decide for themselves
Meta Platforms. Two separate things happen here.
When you submit a lead form, Meta hosts the form, pre-fills it from your profile and delivers the result to us. Meta handles that under its own terms and privacy policy. Once the completed form reaches us, we are responsible for it.
Where you have consented to the Meta Pixel, we and Meta together decide that information is collected on our site and sent to Meta. For that step we are joint controllers. What Meta then does with the information, including using it to improve its own advertising systems, is Meta's own decision, governed by Meta's privacy policy, and outside our control.
Booking platforms such as Airbnb and Booking.com, for guest bookings made through them.
Our accountants, solicitors and other professional advisers.
Our redress scheme and Client Money Protection provider, where a complaint or claim is made.
Our insurers, where a claim is made or notified.
HMRC, Companies House and other authorities, where we are required by law to provide information.
We may also share information where the law requires it, or where it is necessary to establish or defend legal claims.
6. How long we keep your information
We keep information only as long as we need it.
| What | How long |
|---|---|
| Enquiries that did not become clients | 24 months from your last contact with us |
| A minimal record that you asked us not to contact you | Kept indefinitely, so that we can honour it. This is a name and contact detail and nothing else |
| Client records — management agreement, correspondence, statements | Six years from the end of our arrangement, which is the period in which a contract claim can be brought |
| Financial and accounting records | At least six years from the end of the accounting period they relate to, as required by tax law |
| Client money records | For the period our Client Money Protection scheme requires |
| Property access and key safe codes | Deleted or changed immediately when an arrangement ends |
| Your bank details | Removed once the final payment to you has cleared and nothing further is due. We keep the record that a payment was made as part of our accounts, but not the account number |
| Guest booking records | For the length of the stay, then for as long as we need to handle any review, damage claim or dispute, and to meet our financial record-keeping duties |
| Your cookie choice | Six months, after which we ask again |
| Website server logs | For as long as our host retains them for security and diagnostic purposes |
When a period expires we delete the information, or where deletion is not practical we put it beyond use — archived, access restricted, and not used for anything.
7. Your rights
You have the following rights over your information.
To be told what we do with it. This policy.
To get a copy of it. Ask and we will send you the personal information we hold about you.
To have it corrected if it is wrong or incomplete.
To have it deleted. This right is not absolute. Where the law requires us to keep something — financial records, client money records — we will keep that, delete everything else, and tell you which is which and why.
To restrict what we do with it while a dispute about its accuracy or our grounds for holding it is resolved.
To object at any time to anything we do on the basis of legitimate interests. If you object to direct marketing, we will stop. There is no exception to that one.
To portability. Where we hold information you gave us and use it with your consent or under a contract, you can ask for it in a machine-readable format.
To withdraw consent at any time, where consent is what we rely on.
To exercise any of these, email luke@cyclopean.co.uk. We will respond within one month. If we need to confirm who you are, or to clarify what you are asking for, that month starts once we have what we need. If a request is complex we may extend by up to two further months, and we will tell you why within the first month. There is no charge.
8. Security
We take the following measures to protect your information.
- Access to systems holding personal information is limited to people who need it, and multi-factor authentication is enabled on those systems
- Passwords are unique to each system and held in a password manager
- Devices used to access those systems are encrypted and lock automatically
- Bank details and property access codes are held only in systems designed to hold them, and are not kept in email or in free-text notes
- We check that providers commit contractually to appropriate security before we start using them
- If a personal data breach happens, we record it, assess it, report it to the Information Commissioner's Office within 72 hours where the law requires, and tell affected people directly where there is a high risk to them
No system is completely secure, and we cannot guarantee the security of information sent to us over the internet.
9. Sending information outside the UK
Some of our providers are based in the United States, so some of your information is transferred there. UK law permits this only with specific protections in place. For each provider we rely on one of the following.
UK adequacy regulations, where the UK government has decided that a country or scheme provides adequate protection. This includes the UK Extension to the EU-US Data Privacy Framework, for US organisations that are actively certified to it. We check annually that any certification we rely on is still current.
The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a documented assessment of the risks of the transfer, where a provider is not certified.
If you want to know which protection applies to a particular provider, email us and we will tell you.
10. Cookies and similar technologies
This section covers cookies and anything else that stores information on your device or reads information from it, including pixels, tags and scripts.
What we use
Strictly necessary. These make the website work and record your cookie choice. They do not require consent and cannot be switched off. They do not track you and are not shared with anyone.
Advertising and measurement — consent required. The Meta Pixel and the Meta Conversions API. These set and read a Meta cookie on your device, tell us which adverts led to enquiries, and let us show adverts to people who have visited our site or who resemble people who have enquired. They involve sharing information with Meta, which also uses it for its own purposes.
We do not use analytics cookies.
What happens when you choose
If you accept, the Meta Pixel and Conversions API load, a Meta cookie is set on your device, and page views and actions such as submitting a form are sent to Meta. You may be added to our advertising audiences.
If you reject, nothing loads. No Meta cookie is set, and no information is sent to Meta by either the Pixel or the Conversions API. The only thing stored is a small record of your choice, so that we do not ask you again on every page.
If you close the banner or ignore it, we treat that as a refusal and nothing loads. Continuing to browse, scrolling or dismissing the banner does not count as consent.
Your choice lasts six months, after which we will ask again.
To change your mind, use the cookie settings link in the footer of any page. Rejecting later stops any further collection, but does not undo what has already been collected. If you want us to remove you from our advertising audiences, email luke@cyclopean.co.uk and we will do it.
11. Children's privacy
Our services are for property owners and are not directed at children. We do not knowingly collect information about anyone under 18 through our website or our advertising.
Where we manage a property, a booking may record how many people are staying and whether any of them are children. We use that only to prepare the property, and it is deleted with the rest of the booking record. We do not market to children and we do not build advertising audiences from guest information.
If you believe we hold information about a child, contact us and we will delete it.
12. Marketing communications
If you have enquired about our services, we may send you further information about short-let property management — income projections, guidance and details of what we do. We rely on our legitimate interests, and on the rule in the Privacy and Electronic Communications Regulations that permits this where you gave us your details while enquiring about the same kind of service. Every message contains a one-click unsubscribe.
Phone calls. If you gave us your number through one of our advert forms or our website, that form told you we would call you about managing your property. If you ask us to stop calling, we will stop.
If you have not enquired, we will not email or text you marketing without your consent.
Advertising audiences. We may share a list of people who have enquired with Meta, so that we can show adverts to those people or to people who resemble them. Meta matches the list against its own users and deletes it after matching. You can object at any time by emailing us, and we will remove you.
To stop hearing from us, use the unsubscribe link in any message or email luke@cyclopean.co.uk. We act on it straight away. We keep the minimum record needed to make sure we do not contact you again by mistake.
13. Changes to this policy
We update this policy when what we do changes. The date at the top tells you when it last changed.
If a change materially affects how we use information we already hold about you, we will tell you directly rather than relying on you to notice. Where a change requires your consent, we will ask for it.
14. Contact and complaints
For anything in this policy, or to exercise any of your rights:
Email: luke@cyclopean.co.uk
Post: Data Protection, Cyclopean Estates Limited, 45 Barmpton Lane, Darlington, DL1 3HH
If you want to complain about how we have handled your information, tell us by either route above. We will acknowledge your complaint within 30 days and respond as quickly as we can after that. It helps if you tell us what happened, what you would like us to do about it, and how you would like us to reply.
You can also complain to the Information Commissioner's Office, whether or not you raise it with us first:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
We would rather you gave us the chance to put it right first, but you are not required to.