Privacy Policy
THE GUILD OF LETTING & MANAGEMENT LIMITED
PRIVACY POLICY
Introduction
The Guild of Letting and Management Limited (“GLM”, “we”, “us” or “our”) is a membership, education and training organisation. We provide training, CPD and professional development, advice, support and compliance resources to letting agents, property managers, block managers, landlords and local authorities.
We are committed to protecting the privacy of everyone whose personal information we hold, including our members, course delegates, Advice Line users, event attendees, website visitors, suppliers and anyone who contacts us.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have. It applies to all of our services and to our website at guildofletting.com and any other websites or online services (Virtual Learning Environment – VLE) on which this policy appears.
For the purposes of data protection law, GLM is the controller of your personal information. Our details are:
• The Guild of Letting and Management Limited, registered in England and Wales (company number 05394801)
• Registered office: First Floor, Hertfordshire Golf & Country Club, Broxbournebury Mansion, White Stubbs Lane, Broxbourne, Hertfordshire EN10 7PY
• Registered with the Information Commissioner’s Office
• Data protection contact: info@guild-let.co.uk (please mark your email “Data Protection”)
We are not required to appoint a Data Protection Officer, but we have a nominated member of staff who is responsible for data protection matters and who can be contacted using the details above and in section 16.
The Data Protection laws that apply
We process personal information in accordance with the following legislation (together, “Data Protection Legislation”):
• the UK General Data Protection Regulation (“UK GDPR”);
• the Data Protection Act 2018;
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), which govern electronic marketing and cookies; and
• the Data (Use and Access) Act 2025, which amends each of the above and whose data protection provisions have been brought into force in stages during 2025 and 2026.
References in this policy to the “ICO” are to the UK’s independent data protection regulator. From 30 September 2026 the Information Commissioner’s Office is replaced by the Information Commission, which takes over all of its functions and continues to be known as the ICO. Further information is available at ico.org.uk.
What personal information we collect and how we collect it
Information you give us
We collect personal information when you contact us or use our services, including when you:- • apply for or renew GLM membership, or register a firm or team members
• book or complete a training course, CPD or CPA module, webinar, assessment or event • register for a qualification or request information about a qualification
• register to use the GLM Virtual learning Environment (GLM VLE)
• subscribe to or use our Advice Line or other advice and support services
• purchase or download templates, guides or other resources
V1 GLM Privacy Policy 2026 Page 1 of 7
• sign up to receive newsletters, legislative updates or other communications • take part in surveys, market research, consultations or competitions or
• contact us by telephone, email, post, our website forms or social media.
The information we collect may include:
• Identity and contact details: name, job title, employer or trading name, business and personal address, company registration number, director names, email address and telephone number. • Professional information: role, qualifications, membership of other professional bodies or
redress schemes, training and CPD records, assessment results and certificates. • Account information: usernames, passwords (stored in encrypted form) and your preferences. • Transaction and payment information: details of products and services purchased, invoices
and payment records. Card payments are processed by our payment providers and we do not store card details.
• Enquiry information: the content of your enquiries, Advice Line queries and correspondence with us. Advice Line and other enquiries may include information about third parties (for example, tenants or landlords). Please share only what is necessary for us to answer your question. • Marketing and communications preference
• Special category information: we do not routinely collect this information. If you tell us about a disability or health condition so that we can make reasonable adjustments for a course, assessment or event, we will use it only for that purpose and with your explicit consent.
Information we collect automatically
When you visit our Sites we automatically collect certain technical information, such as your IP address, device type, browser, operating system, the date and time of your visit, the pages you view and how you arrived at our Sites. Some of this is collected using cookies and similar technologies.
Information we receive from third parties
We may receive personal information about you from your employer or firm (for example, where bookings are made for training or if your employer registers you under a firm membership), from event or training partners, from payment providers, and from publicly available sources such as Companies House. Where we receive information from a third party, we expect that party to have told you that your information will be shared with us.
How we use your personal information
We may only use your personal information where we have a lawful basis to do so under Article 6 of the UK GDPR. The table below sets out the main purposes for which we use personal information and the lawful basis we rely on.
Purpose
Lawful basis
Administering membership, Advice Line subscriptions and your GLM account
Performance of a contract with you (or steps taken at your request before entering into one). Where your employer holds the contract, our legitimate interests in providing the services it has purchased.
Delivering training, CPD and CPA courses, assessments, webinars and events; issuing certificates; keeping training records
Performance of a contract. Legitimate interests in verifying certificates and maintaining accurate training records.
Answering enquiries and providing advice and support
Performance of a contract, or our legitimate interests in responding to people who contact us.
Processing payments, invoicing and keeping financial records
Performance of a contract. Compliance with a legal obligation (for example, tax and accounting records).
V1 GLM Privacy Policy 2026 Page 2 of 7
Purpose
Lawful basis
Sending service messages (for example, booking confirmations, renewal reminders and changes to our terms)
Performance of a contract. Legitimate interests in keeping you informed about services you use.
Sending newsletters, legislative updates and marketing about our services
Consent, or, for existing members and customers, the “soft opt-in” under regulation 22 of PECR and our legitimate interests in direct marketing (see section 5).
Surveys, market research and improving our services
Legitimate interests in understanding our members’ needs and developing our services. Consent where required.
Operating, analysing and securing our Sites
Legitimate interests in running a secure and effective website. Consent for non-essential cookies where required.
Handling data protection complaints and requests to exercise your rights
Compliance with a legal obligation.
Disclosures to the police or other authorities to prevent or detect crime, or to safeguard vulnerable people
A recognised legitimate interest under Article 6(1)(ea) and Annex 1 of the UK GDPR, or compliance with a legal obligation.
Establishing, exercising or defending legal claims; obtaining professional advice
Legitimate interests in protecting our business and legal position.
Reasonable adjustments involving health or disability information
Explicit consent (Article 9(2)(a) UK GDPR), together with performance of a contract.
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and interests, and you have the right to object.
Where we rely on a “recognised legitimate interest” listed in Annex 1 of the UK GDPR, the law does not require the balancing test.
We may use your personal information for a new purpose that is compatible with the purpose for which it was collected, as permitted by the UK GDPR. We will not use it for an unrelated purpose without telling you and, where necessary, obtaining your consent.
Where we rely on your consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of anything we did before you withdrew it.
It is your responsibility to ensure that the information you give us, including in your account, is accurate and kept up to date.
5. Marketing communications
We will only send you electronic marketing where we are permitted to do so under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). This means we will send communications where you have consented, or, if you are an existing member or customer, where you have bought or negotiated for a similar service from us, were given the chance to opt out when your details were collected, and have not done so. Communications sent to a business email address may also be sent on the basis of our legitimate interests.
You can unsubscribe at any time by clicking the “unsubscribe” link in any marketing email, by updating your preferences in your account, or by contacting us. Opting out of marketing will not stop us sending you service messages about memberships, courses or products you hold with us.
We do not sell your personal information, and we will not pass it to other organisations for their own marketing without your consent.
V1 GLM Privacy Policy 2026 Page 3 of 7
Cookies and similar technologies
A cookie is a small file placed on your device when you visit a website. We use:
• strictly necessary cookies, which are essential for our Sites to work (for example, to keep you signed in or to process a booking);
• analytics and functionality cookies, which help us understand how visitors use our Sites, improve their performance and appearance, and remember your choices. Under PECR, as amended by the Data (Use and Access) Act 2025, certain low-risk cookies of this kind may be used without consent provided you are given clear information about them and a simple, free means of objecting; and
• other non-essential cookies (for example, advertising or third-party tracking cookies), which we will only set with your consent.
You can manage your choices through the cookie banner or settings on our Sites and through your browser settings. Blocking some cookies may affect how our Sites work, including your ability to sign in. Full details of the cookies we use are set out in our Cookie Policy at guildofletting.com. Independent information about managing cookies is available at ico.org.uk.
Who we share your personal information with
We share personal information only where necessary and in accordance with Data Protection Legislation. Recipients may include:
• Our service providers (processors), such as website, hosting and IT providers, email and communications platforms, e-learning and webinar platforms, customer relationship management systems, payment processors and professional advisers. They act only on our documented instructions, are bound by written contracts under Article 28 of the UK GDPR and may not use your information for their own purposes.
• Your employer or firm, where they have booked or paid for your membership or training, so that they can see your attendance, completion and certificates.
• Training and event partners, accrediting or awarding bodies, where this is necessary to deliver or certify a course or event you have booked. We will tell you at the time of booking if this applies.
• Regulators, courts, law enforcement agencies, HM Revenue & Customs and other public bodies, where we are required or permitted by law to do so.
• A purchaser or successor, if all or part of our business is sold or reorganised, subject to appropriate confidentiality protections.
We will not share your personal information with any other third party for its own purposes unless you have consented or we are required or permitted by law to do so in writing.
International transfers
We aim to store and process personal information within the United Kingdom. Some of our service providers may, however, process personal information outside the UK. We will only transfer personal information outside the UK where the transfer meets the requirements of Chapter 5 of the UK GDPR, as amended by the Data (Use and Access) Act 2025. In practice, this means that:
• the destination country is covered by UK adequacy regulations (for example, countries in the European Economic Area, or organisations in the United States certified under the UK Extension to the EU–US Data Privacy Framework); or
• we have put appropriate safeguards in place, such as the ICO’s International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, having assessed that the standard of protection will not be materially lower than in the UK.
You can ask us for more information about the safeguards we use by contacting us. How long we keep your personal information
We keep personal information only for as long as is necessary for the purposes for which it was collected, including to meet legal, accounting and reporting requirements. Our standard retention
V1 GLM Privacy Policy 2026 Page 4 of 7
periods are set out below. At the end of the relevant period, information is securely deleted or anonymised.
Type of information
Retention period
Membership and account records
Duration of membership plus 6 years
Training, CPD and assessment records and certificates
6 years from completion, so that certificates can be verified
Advice Line and enquiry records
6 years from the date of the enquiry
Financial and transaction records
6 years from the end of the financial year to which they relate
Marketing preferences and suppression lists
Until you unsubscribe; we keep a minimal record of opt-outs so that we do not contact you again
Data protection complaints and rights requests
2 years from closure
Website analytics data
In line with our Cookie Policy
We may keep information for longer where this is necessary to establish, exercise or defend legal claims, or where required by law.
How we keep your personal information secure
We use appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls, encryption where appropriate, secure systems and staff training. Access to personal information is limited to those staff and service providers who need it.
No transmission of information over the internet can be guaranteed to be completely secure, but we take all reasonable steps to protect your information once we receive it. If a personal data breach occurs, we will notify the ICO within 72 hours where required and will inform you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects for you. This includes but is not limited to the use of AI technology.
12. Children
Our services are intended for professionals and adults working in or with the private rented sector. They are not directed at children under 18 and we do not collect personal information about minors.
Your data protection rights
Subject to certain conditions and exemptions, you have the right to:
• be informed about how we use your personal information, which is the purpose of this policy • access a copy of the personal information we hold about you (a “subject access request”) • rectification, to have inaccurate information corrected or incomplete information completed • erasure, to have your information deleted where there is no longer a lawful reason for us to keep it
• restrict our use of your information in certain circumstances
• data portability, to receive information you provided to us in a structured, commonly used and machine-readable format, or to have it transferred to another organisation, where processing is based on consent or contract and carried out by automated means;
V1 GLM Privacy Policy 2026 Page 5 of 7
• object to our use of your information where we rely on legitimate interests. You have an absolute right to object to direct marketing at any time;
• withdraw consent at any time where we rely on your consent; and
• make a data protection complaint to us and, if you remain dissatisfied, to the ICO.
Subject Access Request
You can make a request verbally or in writing to us. We may need to ask you for information to confirm your identity, or to clarify your request, before we can respond.
We will respond without undue delay and in any event within 30 days of receipt of the request being made in writing.
Where we need to confirm your identity, request clarification or, in exceptional cases, a fee, the one month period starts once we have received what we need. We may extend the period by up to two further months where a request is complex or you have made a number of requests, and we will tell you if we do so and why. In responding to a subject access request (SAR) we will carry out reasonable and proportionate searches for your information.
We do not usually charge a fee. We may charge a reasonable fee, or refuse to act on a request, where it is manifestly unfounded or excessive. If we refuse a request, we will explain why and tell you about your right to complain.
How to make a data protection complaint
If you are unhappy with how we have handled your personal information, you have the right to complain to us. We would encourage you to raise any concern with us first, as we will usually be able to resolve it quickly. You can complain:-
• by email to info@guild-let.co.uk - Please mark your email “Data Protection Complaint” • by post to our registered office address ior
• by telephone or through any other channel you use to contact us.
When we receive a data protection complaint, we will:-
• acknowledge it within 30 days of receipt
• take appropriate steps to investigate it without undue delay, including making any necessary enquiries
• keep you informed of our progress and
• tell you the outcome without undue delay, including what we have done to resolve your complaint. If you are not satisfied with our response, you have the right to complain to the ICO:- • Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
The ICO will normally expect you to have raised your complaint with us first. Making a complaint does not affect any other legal rights you may have.
Changes to this Privacy Policy
We review this Privacy Policy regularly and may update it to reflect changes in the law, regulatory guidance or our services. The current version will always be available at guildofletting.com, and the date at the top of this policy shows when it was last updated. Where we make significant changes, we will notify members and customers by email or through our Sites.
Contact details
If you have any questions about this Privacy Policy, wish to exercise any of your rights or wish to make a complaint, please contact us:
• Email: info@guild-let.co.uk (marked “Data Protection”)
V1 GLM Privacy Policy 2026 Page 6 of 7
• Post: Data Protection, The Guild of Letting and Management Limited, First Floor, Hertfordshire Golf & Country Club, Broxbournebury Mansion, White Stubbs Lane, Broxbourne, Hertfordshire EN10 7PY
• Telephone: [telephone number]
• Website: guildofletting.com
V1 GLM Privacy Policy 2026 Page 7 of 7