How Letterbox Auctions processes personal data for property auctions, account journeys, compliance checks, document access, bidding records and customer support.
Letterbox Auctions Ltd is the data controller for this service unless a separate written notice says otherwise. Confirmed details: company number 17269053. To ask about your personal data or exercise your privacy rights, use the contact form and select Privacy or data request.
We may collect name, address, email, telephone number, account credentials, role, company details, property information, bidding activity, watchlists, identity documents, proof-of-address/funds evidence, payment status, legal-pack acknowledgements, device data, IP address, audit logs, enquiries, support communications and admin/compliance decisions.
Data is used to operate auctions, create and manage accounts, verify bidder eligibility, support AML/KYC checks, provide legal-pack access, receive and record bids, manage post-auction payments, handle enquiries and complaints, prevent fraud, secure the platform, maintain audit evidence and comply with legal duties.
Processing may rely on contract performance, steps before entering a contract, legal obligations including AML/accounting duties, legitimate interests in running a secure and evidenced auction service, consent for optional marketing or non-essential cookies, and establishment, exercise or defence of legal claims.
Information may be shared with auction staff, sellers, agents, solicitors, payment providers, KYC/AML providers, hosting/security/email providers, professional advisers, regulators, law enforcement and courts where lawful or required. A processor/subprocessor register should be maintained and reviewed before launch.
Some technology providers may process data outside the UK. Where this happens, appropriate transfer safeguards such as adequacy regulations, UK International Data Transfer Addendum or other lawful transfer mechanisms should be confirmed with each provider.
Records are kept only for as long as required for auction administration, AML/KYC, accounting, dispute handling, audit evidence, legal claims and legitimate business purposes. Bid, auction, payment, legal-pack and compliance records may need to be retained even where profile details are anonymised. See the Data Retention Schedule in the Legal Centre.
Under UK GDPR you may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Some requests may be limited where records must be retained for AML, accounting, contract, legal-claim, security or auction-evidence reasons. You may complain to the ICO at ico.org.uk if you are unhappy with how your data is handled.
We use authentication, role-based access, private KYC storage, audit logging, public data minimisation, HTTPS/security headers and database-level protections for critical auction records. No online service is risk-free; suspected data incidents should be reported promptly through the published contact channels.
Property auction documents should be reviewed with appropriately qualified legal, financial, tax and surveying advisers before any binding decision is made.