Privacy notice.

Rivermark uses personal information to respond to enquiries, carry out commercial property work and run its business. This notice covers website visitors, clients and prospective clients, owners, occupiers, counterparties, advisers, introducers, contractors and other business contacts, including their representatives and beneficial owners.

Version 2.2. Updated: 28 October 2026.

Who is responsible

Rivermark Property Ltd is the controller for the uses described here. It is registered in England and Wales under company number 17076568 at 133 Whitmore Road, Harrow, England, HA1 4AG. Its ICO registration reference is ZC199403.

For privacy questions, requests or concerns, contact Elia Samir Yousf at hello@rivermarkproperty.com, call 07356 245 869, or write to the registered office above. You can request a copy of this notice in another accessible format.

Where Rivermark processes information solely on a client’s documented instructions, the client’s privacy information and the relevant processing agreement also apply. This notice describes Rivermark’s own records and responsibilities as controller.

Information Rivermark uses

Depending on the relationship, Rivermark uses:

• names, roles, organisations, business addresses, email addresses and phone numbers;
• property requirements, locations, budgets, timing, ownership, sites, transaction roles and instructions;
• correspondence, meeting notes, approvals, approaches, introductions, contracts, fees, invoices and payment records;
• company, directorship, beneficial ownership, control and signing-authority information;
• conflict checks, referral arrangements, complaints, disputes, fraud concerns and data-rights records.

Where necessary for identity, anti-money-laundering, sanctions or related risk checks, Rivermark may also need date of birth, nationality, residential address, identity and address documents, screening results, and relevant funding or source-of-wealth evidence. Requests explain what is needed and why. If required information is not provided, Rivermark may be unable to start or continue the work.

Rivermark does not seek unnecessary sensitive information, criminal-offence information or children’s information. If the work requires such information, it must have a lawful basis, any additional legal condition and safeguards matched to the risk.

Where information comes from

Information comes from you, your organisation or representative, clients, counterparties, advisers, referrers and suppliers. Research may use Companies House, HM Land Registry where lawfully accessed, sanctions lists, other official registers, business websites, professional profiles, directories, property listings and published documents. Screening providers may be used where needed for the checks.

When information comes directly from you, Rivermark provides privacy information when collecting it. For information obtained elsewhere, Rivermark provides it within a reasonable period and no later than one month, or earlier at the first communication or disclosure if that happens first, unless a lawful exception applies. Relevant communications identify or explain the source where required; you can ask about the source of your information.

Purposes and lawful bases

Rivermark uses personal information for the following purposes:

• Enquiries and agreed services: assessing the enquiry, agreeing a brief, researching property, recording instructions, making approved approaches and introductions, and administering the relationship. Rivermark relies on legitimate interests in running its property business. Contract or requested steps before a contract apply where the individual is personally party to the contract; company representatives’ information is normally handled under legitimate interests.
• Identity, authority, AML and sanctions checks: meeting applicable legal obligations and, for proportionate checks beyond those obligations, legitimate interests in preventing fraud and managing risk.
• Business contacts and referrals: identifying relevant owners, occupiers, agents and advisers, recording responses, managing conflicts and disclosing agreed referral arrangements. Rivermark relies on legitimate interests, with consent where electronic-marketing law requires it.
• Accounts, complaints and legal matters: invoicing, financial records, investigating complaints, correcting problems and establishing, exercising or defending legal rights. Rivermark relies on legal obligations where applicable and legitimate interests in accurate records and resolving disputes. Contract also applies where necessary for a contract with the individual.
• Website, security and requested guides: delivering the site and requested information, responding to forms, preventing abuse and understanding aggregate website use. Rivermark relies on legitimate interests, or requested pre-contract steps where applicable. The separate optional request for one padel-site contact relies on consent.
• Data rights and compliance: responding to requests, keeping necessary compliance records and protecting information, under legal obligations and legitimate interests in maintaining secure and accountable business records.

Before relying on legitimate interests, Rivermark considers whether the use is necessary, proportionate and balanced against your interests and rights. A privacy acknowledgement records delivery of information; it is not marketing consent.

Website forms and analytics

Enquiries collect your role, the type of help, property or site, location, name and email address. Phone number, organisation and a short note are optional. Data-centre enquiries can also include optional capacity and target-date details. An enquiry about an advertised requirement includes its reference. Call requests collect your role, topic, name, phone number and email address, with optional location or organisation details. Guide requests collect an email address, the selected guide and any separate request for one padel-site contact.

Investor network registration collects your name, email, phone number and details of what you want to buy, sell or lease, including any budget, asking terms, locations and other details you choose to provide. Rivermark uses these to review your requirements and contact you about your property or relevant opportunities. General property news by email is a separate optional choice. Investor network answers are sent only when you submit; closing the form retains them on the current page, but they cannot be restored after a reload.

Form answers are sent when you submit the completed form. Forms do not accept document uploads or save answers in cookies, local storage or session storage. Call requests use Rivermark’s own form; Rivermark contacts you to arrange a time, without an embedded booking calendar.

Hosting and security systems process request information needed to deliver and protect the site. Form abuse checks turn the network address and submission details into short-lived keyed hashes. These abuse-control entries contain hashes rather than raw addresses or enquiry text. Upstash separately stores enquiry progress as described below.

Vercel Web Analytics provides aggregate page views, referrers, approximate locations, browser, device and operating-system information without cookies or persistent personal identifiers. Vercel uses a visitor hash discarded after 24 hours. Rivermark also counts form opens and successful enquiries, call requests and guide requests. These events include only fixed service categories and broad page sections, not names, contact details, free-text answers, property locations or requirement references. See the cookie notice for more information.

Sharing and service providers

Rivermark shares relevant information only where needed for the purpose, with:

• clients, approved counterparties and their authorised representatives for the agreed work;
• solicitors, surveyors, planning consultants, accountants, insurers and other professional advisers;
• authorised contractors, researchers and introducers, subject to confidentiality and data-protection duties;
• identity, AML, sanctions or screening providers where used;
• providers of hosting, analytics, email, restricted cloud storage, technical support and business administration;
• courts, regulators, HMRC, law enforcement or other authorities where necessary and lawful;
• a successor to the business where necessary, with confidentiality and data safeguards.

Current website services use Vercel for hosting and analytics, Resend for transactional email and Upstash for enquiry progress storage and short-lived abuse controls. Business email and restricted document storage use Google services. Other working records are held in Rivermark’s restricted workspace and CRM. Rivermark does not sell personal information or use website information to build advertising profiles.

International transfers

Some provider processing or support access takes place outside the UK, including in the United States. Resend identifies the United States as its primary processing and account-data storage location; a European email-sending region does not mean all information remains in Europe.

For a restricted transfer, Rivermark must use an applicable UK adequacy route or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with any required transfer assessment and additional measures. Contact Rivermark for information about the safeguard relevant to your information and how to obtain a copy, subject to necessary redactions.

How long information is kept

The normal periods under Rivermark’s retention policy are:

• Guide requests that do not become enquiries or client relationships: 12 months after delivery.
• Unconverted enquiries and business prospects: 24 months after the last meaningful contact.
• Client mandate, contract, introduction and protected-opportunity records: six years after closeout or termination.
• AML identity and transaction records where the Money Laundering Regulations apply: five years after the business relationship ends or the occasional transaction completes, as applicable; then deletion unless a lawful exception applies. Other risk-check evidence is kept only for its documented purpose and period.
• Referral, conflict and anti-bribery records: six years after the relationship or relevant mandate ends.
• Complaints and disputes: six years after closure.
• Data-rights requests: three years after closure, limited to evidence of how the request was handled.
• Accounting and invoice records: six years, or longer where a documented legal requirement applies.
• Marketing suppression records: the minimum identifier and objection details for as long as needed to respect the objection.
• Website abuse-control hashes: 10 minutes for rate counters and 15 minutes for duplicate markers.
• Website request and runtime logs: the provider’s account-plan retention period; no separate export without a documented need. Aggregate Vercel analytics have a 12-month guaranteed reporting window under Rivermark’s current plan; Vercel may retain them longer to allow a plan upgrade.

Records are reviewed for deletion or anonymisation. A legal duty, active complaint, claim, investigation or other documented hold may justify keeping relevant records longer, with a review date. This does not mean all identity or funding evidence is automatically kept for six years.

Business contact and marketing choices

Rivermark may make relevant, proportionate business contact where lawful. Consent is used where electronic-marketing rules require it, including where the rules for sole traders or certain partnerships apply. Communications identify Rivermark and provide a way to object.

You can object to direct marketing at any time. Contact Rivermark using the details above or use the opt-out in the message. Rivermark will stop that use and retain only the minimal suppression record needed to respect your choice. A guide request does not add you to a mailing list. The optional request for one padel-site contact is separate and may be withdrawn at any time.

Your rights

Depending on the circumstances and lawful basis, you may ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. You may withdraw consent where it is used, without affecting earlier lawful processing. Some information must be kept for legal obligations or valid legal claims.

Contact Rivermark using the details above. A particular form or subject line is not required. Rivermark may request proportionate identity or authority evidence where reasonably needed and will explain a secure way to provide it. Requests are normally free. Rivermark responds without undue delay and normally within one calendar month, subject to any lawful identity-verification, clarification or extension rules. Any permitted extension and its reasons will be explained within the applicable deadline.

Rivermark does not make solely automated decisions about people with legal or similarly significant effects. Screening informs human decisions.

Complaints about personal information

You can complain directly to Rivermark by email, phone or post using the details above. The complaints procedure explains the process. Rivermark aims to acknowledge complaints within three business days and will acknowledge a data-protection complaint within 30 calendar days of receipt. It will investigate appropriately, keep you informed and communicate the outcome without undue delay. These complaint timings do not replace the deadlines for a data-rights request.

You also have the right to complain to the Information Commissioner’s Office, telephone 0303 123 1113. Raising the concern with Rivermark first gives it an opportunity to resolve the problem; it does not remove your rights.

Security and changes

Rivermark restricts access to personal information and separates identity and financial evidence from ordinary correspondence. Do not send passports, bank statements or funding evidence through a website form, an ordinary first email or a public sharing link. Wait for a specific request and an access-restricted upload or another agreed secure route.

Rivermark reviews this notice when its services, tools or legal duties change. Where required, it will actively explain material changes affecting you. A later website update does not itself change your agreed commercial terms or fees. A copy is available on request.

Saving an unfinished enquiry

For ordinary enquiries and call requests, once you enter a valid email address and pause briefly or leave the email field, we save your unfinished enquiry. We then save changes to the available contact and property answers, including if you leave before sending. We record the browser-reported form start separately from server receipt, capture, activity and submission times, along with the website, form, canonical page and allowlisted campaign parameters. This information is available to Rivermark through its private CRM and owner notifications, and is kept out of visitor analytics. Investor network forms are saved only after submission.

A random identifier in browser storage lets you resume on this browser for up to 30 days. The answers are held on the server, not in browser storage. Unconverted draft and submitted enquiries follow the existing 24-month retention period after last activity. Clearing browser storage removes this browser’s ability to resume; you may ask us to delete the server record using the contact details above.

Entering an email is not marketing consent or permission to follow up. We do not automatically contact visitors who leave an unfinished form. A submitted enquiry is recorded only after the completed form passes validation. Only a submitted enquiry triggers the existing acknowledgement. Guide requests remain separate and are sent only when you request the guide.