Privacy Policy

Last updated: July 2026

Oyster Properties is a trading name of Rafiki Ltd (company number 03744449), registered in England and Wales. Registered office: 845 Honeypot Lane, Stanmore, Greater London, HA7 1AR.

This Privacy Policy explains when and why we collect personal information about the people who visit our website, enquire about our services, or become our clients; how we use it; the conditions under which we may share it; and how we keep it secure. It also sets out your rights and how to exercise them.

We are the "data controller" for the personal data we process. Rafiki Ltd is registered with the Information Commissioner's Office (ICO) as a data controller under registration number Z1830634.

1. How to contact us about your data

If you have any questions about this policy, or you wish to exercise any of your rights, please contact our Compliance Manager:

2. The personal data we collect

Depending on your relationship with us, we may collect and use the following categories of personal data:

• Identity data — name, title, date of birth, and where relevant marital status and household details.
• Contact data — address, email address, and telephone numbers.
• Financial data — bank account and payment details, and (for tenancy and purchase applications) income and affordability information.
• Transaction data — details of payments to and from you and the services you have received from us.
• Identity verification data — information required for anti-money laundering and Right to Rent checks, including copies of identity documents.
• Tenancy and property data — references, condition reports, inspection records, and correspondence relating to a property or tenancy.
• Technical data — internet protocol (IP) address, browser type and version, device information, operating system, and other identifiers collected when you use our website.
• Usage data — information about how you use our website, including pages visited and time spent.
• Communications data — records of your correspondence with us, including emails, messages, and recorded telephone calls (see section 5).
• Marketing data — your preferences for receiving marketing from us.

We do not generally seek to collect special category data (such as health or ethnicity). Where it is necessary to process such data — for example, information relevant to a reasonable adjustment or a vulnerability — we will do so only with an appropriate lawful basis.

3. How we collect your data

We collect personal data:

• Directly from you — when you enquire about a property, request a valuation, register for alerts, apply for a tenancy or purchase, contact us by phone, email, or in branch, or otherwise interact with us.
• Automatically — when you use our website, through cookies and similar technologies (see our Cookie Policy).
• From third parties and public sources — including property portals (Rightmove, Zoopla, OnTheMarket, PrimeLocation), referencing and credit reference providers, anti-money laundering verification providers, Companies House, the Electoral Register, mortgage brokers and other professional introducers, and your landlord, tenant, or guarantor where relevant.

4. How and why we use your data (our lawful bases)

Under data protection law we must have a lawful basis for processing your personal data. We rely on the following:

To perform our contract with you, or to take steps before entering a contract:

• Providing estate agency, lettings, and property management services.
• Valuing your property and marketing it for sale or to let.
• Arranging viewings, referencing, tenancy agreements, and deposit protection.
• Processing rent, payments, and maintenance.
• Arranging EPCs, inventories, inspections, and compliance certificates.

To comply with our legal and regulatory obligations:

• Anti-money laundering and Right to Rent checks.
• Deposit protection and prescribed information requirements.
• Responding to complaints and cooperating with redress schemes and regulators.
• Retaining records for the periods required by law.

For our legitimate interests (where these are not overridden by your rights):

• Managing and improving our services and website.
• Keeping records, recovering debts, and establishing or defending legal claims.
• Recording telephone calls for training, quality, and dispute-resolution purposes (see section 5).
• Direct marketing of our own similar services to existing clients, where you have not opted out.

With your consent:

• Sending marketing communications where consent is required.
• Placing non-essential cookies (see our Cookie Policy).

You can withdraw consent at any time by contacting us or using the unsubscribe link in our emails.

5. Telephone call recording

We record incoming and outgoing telephone calls. We do this for training and quality-assurance purposes, to keep an accurate record of instructions and agreements, to help resolve disputes, and to meet our regulatory obligations.

Our lawful basis for recording calls is our legitimate interests, and where applicable our legal obligations. We have assessed that recording is necessary and proportionate for these purposes, and that it does not override your rights and freedoms. Where calls are analysed using automated tools (for example, transcription or quality scoring), this is treated as a separate processing activity and is covered by the same purposes and safeguards.

Call recordings are stored securely with restricted access and are retained only for as long as necessary for the purposes above, after which they are deleted. You have the same rights over call recordings as over your other personal data (see section 9), including the right to request a copy.

6. Who we share your data with

We do not sell or rent your personal data. We share it only where necessary, and only with parties who are required to keep it secure and use it in line with our instructions and the law. These may include:

• Service providers acting on our behalf — referencing and credit reference providers, anti-money laundering verification providers, tenancy deposit schemes, inventory and inspection providers, maintenance contractors, IT and communications providers, and our marketing providers.
• Property portals — where you have asked us to market or find a property.
• Your counterparties — your landlord, tenant, or guarantor, where necessary to manage a tenancy.
• Professional advisers — solicitors, accountants, mortgage brokers, and similar, where relevant to a transaction.
• Authorities and regulators — including HMRC, the police, local authorities, redress schemes, and the courts, where we are required to do so by law or to establish or defend legal claims.
• Successors — a buyer or successor if we sell or reorganise our business, subject to appropriate protection of your data.

7. International transfers and processing outside the UK

Some of the people and service providers who process personal data on our behalf are located outside the United Kingdom. This means your personal data may be accessed, stored, or processed outside the UK in the course of providing our services to you.

Where personal data is transferred to or accessed from outside the UK, we ensure an appropriate level of protection is in place in accordance with UK data protection law. This includes relying on an adequacy decision where one applies, or putting in place appropriate safeguards such as the ICO's International Data Transfer Agreement (or an equivalent contractual mechanism), together with additional security and confidentiality controls.

You can obtain more information about the safeguards we use for international transfers by contacting our Compliance Manager.

8. How long we keep your data

We keep your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements.

In general, where you are or have been a client, we retain your personal data for the duration of our relationship and for at least seven years afterwards, to meet our legal, regulatory, and accounting obligations. Some records — for example, anti-money laundering records — are subject to their own statutory retention periods. Call recordings and website data are kept for shorter, defined periods. Where we no longer need to identify you, we may anonymise your data and retain it indefinitely for statistical purposes.

9. Your rights

Under data protection law you have the following rights, which apply in certain circumstances and subject to certain exceptions:

• The right to be informed about how we use your data (this policy).
• The right of access to the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure of your data in certain circumstances.
• The right to restrict our processing of your data in certain circumstances.
• The right to data portability for data you provided to us, where processing is based on consent or contract and carried out by automated means.
• The right to object to processing based on legitimate interests, and to direct marketing at any time.
• Rights relating to automated decision-making and profiling.
• The right to withdraw consent at any time, where we rely on consent.

To exercise any of these rights, please contact our Compliance Manager (section 1). We will respond within one calendar month. There is normally no charge.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact our Compliance Manager in the first instance so we can try to resolve it. We operate a data protection complaints process and will acknowledge and respond to your complaint.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk/concerns
• Helpline: 0303 123 1113

11. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, including secure storage, access controls, and encryption where appropriate. No transmission of data over the internet can be guaranteed as completely secure, but we work to protect your data once we receive it.

12. Links to other websites

Our website may contain links to other websites operated by other organisations, including property portals and partner services. We are not responsible for the privacy practices or content of those websites. Please read their privacy policies before providing them with personal data.

13. Changes to this policy

We keep this policy under regular review and may update it from time to time. We will post any changes on this page and, where appropriate, notify you. Please check this page periodically.