Our commitment to protecting your data rights
Last updated: September 2026
The General Data Protection Regulation (GDPR) and the UK GDPR provide enhanced rights regarding personal data. This page outlines how Cragbrook complies with these regulations and explains your rights as a data subject.
Cragbrook acts as the data controller for personal information collected through this website and in connection with our property search services. We determine the purposes and means of processing your personal data.
Contact details:
Cragbrook
47 Brazennose Street
Manchester, M2 5PB
[email protected]
We process personal data under the following lawful bases:
When you submit an enquiry form or contact us, you consent to our processing of your data to respond to your request. You may withdraw consent at any time by contacting us.
Processing is necessary when you engage our services, allowing us to fulfil our contractual obligations to you.
We may process data based on legitimate business interests, such as improving our services, provided these do not override your rights and freedoms. We conduct assessments to balance our interests against potential impacts on you.
Some processing is required to comply with legal requirements, such as maintaining business records or responding to lawful requests from authorities.
You may request confirmation of whether we process your personal data and obtain a copy of that data. We will respond within one month of receiving your request.
If your personal data is inaccurate or incomplete, you have the right to request correction. We will address such requests promptly.
Also known as the "right to be forgotten", you may request deletion of your personal data in certain circumstances, such as when data is no longer necessary for its original purpose or when you withdraw consent.
You may request that we limit how we use your data while concerns are investigated, such as during a dispute about data accuracy.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used format.
You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently engage in such automated decision-making.
To exercise any of these rights, contact us at [email protected] with sufficient information to verify your identity and specify your request. We aim to respond within one month, though complex requests may require additional time (up to three months total), in which case we will inform you.
There is no fee for most requests. However, we may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on such requests.
We implement appropriate technical and organisational measures to ensure security appropriate to the risk, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where required, we will also notify affected individuals without undue delay.
Your data is primarily processed within the United Kingdom. If data transfer outside the UK becomes necessary, we ensure adequate protection through appropriate safeguards such as standard contractual clauses or adequacy decisions.
If you are dissatisfied with how we handle your personal data, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
www.ico.org.uk
We may update this GDPR information periodically to reflect changes in our practices or legal requirements. We encourage you to review this page regularly.