Legal & Compliance

GDPR Policy

How CommercialUK.co.uk processes personal data under UK GDPR and the Data (Use and Access) Act 2025.

Last updated: 21 April 2026

Contents

  • Introduction
  • Contact & DPO
  • Data We Collect
  • Lawful Basis
  • Your Rights
  • International Transfers
  • Retention & Security
  • How to Complain

    • 01

    Introduction

    At CommercialUK.co.uk, we are committed to protecting the privacy of estate agents, letting agents, sellers, landlords, and individual users. This policy outlines how we collect, use, and safeguard your personal data in compliance with the UK GDPR and the Data (Use and Access) Act 2025.

    This policy is designed for CommercialUK.co.uk to align with the Data (Use and Access) Act 2025 and the UK General Data Protection Regulation (UK GDPR) as of April 2026.

    02

    Contact Details & Data Protection Officer

    Data controller

    Ioutsource Ltd (trading as CommercialUK.co.uk)
    Sutton Business Park, Restmor Way, Wallington, Surrey SM6 7AH
    Email: info@commercialuk.co.uk

    For any questions regarding our GDPR compliance or your data rights, please contact our Data Protection Officer (DPO).

    Data Protection Officer

    Vijayant Vashistha
    Sutton Business Park, Restmor Way, Wallington, SM6 7AH

    03

    Data We Collect

    As a commercial property listing platform, we collect:

    Identity data: names, titles, and company affiliations of agents and landlords
    Contact data: email addresses, phone numbers, and office addresses
    Listing data: property details, photos, and valuation information submitted by users
    Technical data: IP addresses, browser types, and usage patterns (via cookies)

    04

    Lawful Basis for Processing

    Under the Data (Use and Access) Act 2025, we process your data under the following legal grounds:

    Contractual necessity: to provide listing services and facilitate connections between sellers and buyers
    Consent: for direct marketing communications (which you can withdraw at any time)
    Recognised legitimate interests: we rely on this for service security, crime prevention (fraud detection in listings), and administrative tasks where no balancing test is required under the 2025 Act

    05

    Your Rights (Enhanced for 2026)

    You have the following rights under UK law:

    Right of access (DSAR): you can request a copy of your data. Under the 2025 Act, we apply a "reasonable and proportionate search" standard to these requests
    Right to complain: you have a legal right to complain directly to us using our mandatory complaint handling procedure before escalating to the Information Commissioner's Office
    Right to rectification & erasure: the right to correct or delete your personal data
    Automated decision making: we do not use automated systems to make significant decisions about you without human intervention, in line with updated safeguards for non sensitive data

    06

    International Data Transfers

    If we transfer your data outside the UK (for example, to cloud storage providers), we ensure it is protected by adequacy regulations or Standard Contractual Clauses (IDTA). Our transfers comply with the 2026 "Data Protection Test," ensuring protections are not significantly lower than UK standards.

    07

    Data Retention & Security

    We retain your personal data only as long as necessary to provide our property services. We have implemented robust technical and organisational security measures to prevent data breaches.

    08

    How to Complain

    If you are unhappy with how we handle your data, please contact the DPO (Vijayant Vashistha) at the address in section 2.

    You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.