Privacy Policy

Who we are

Bespoke Portfolio Management Limited (trading as BPM Cardiff) is a letting and property management agency operating in Wales.

We are the data controller responsible for your personal data.

​

Contact details
Email: Hello@bpmcardiff.co.uk
Address: 130 Henke Court
Telephone: 02922 362631

 

What information we collect

We may collect and process the following personal data:

​

Through website enquiries

• Name

• Email address

• Telephone number

• Any information you provide in enquiry forms

 

Contract-holders

• Identification documents (e.g. passport, driving licence)

• Contact details

• Employment and income information/ University enrolment

• Credit history (via referencing agencies)

• Tenancy history

 

Guarantors

• Name and contact details

• Identification documents

• Employment and income information

• Credit history

 

Landlords

• Name and contact details

• Bank details

• Property ownership information

• Licencing information

 

Property management

• Maintenance requests and communications

• Records of work carried out

 

Contractors

• Name and contact details

• Bank details to process payments

• Insurance documentation and accreditation

​

 

How we collect your Data

We collect data from:

​

• Website forms

• Direct communication (email, phone, in person)

• Third-party referencing agencies

• Public sources where necessary

 

How we use your Data

We use your personal data to:

​

• Respond to enquiries submitted via our website

• Arrange and manage property viewings

• Carry out tenant referencing and affordability checks

• Prepare and manage tenancy agreements

• Manage properties on behalf of landlords

• Arrange maintenance and repairs

• Comply with legal obligations

 

Legal basis for processing

We rely on the following legal bases:

​

• Contract – to perform tenancy or management agreements

• Legal obligation – for compliance with laws (e.g. Right to Rent checks)

• Legitimate interests – to operate and improve our business

• Consent – where required (e.g. marketing communications)

 

Sharing your Data

We may share your data with:

​

• Tenant referencing agencies

• Contractors and maintenance providers

• Deposit protection schemes

• Local authorities or regulatory bodies

• Professional advisers (e.g. accountants, solicitors)

​

We only share data where necessary and ensure appropriate safeguards are in place.

 

Data retention

We retain personal data only as long as necessary:

​

• Tenancy records: up to 6 years after the tenancy ends

• Financial records: up to 6 years (legal requirement)

• Enquiries: typically up to 12 months

 

Data security

Security measures in place include:

​

• Encrypted and secure storage

• Access controls

• Staff training

• Secure disposal practices

• Vetting of third party processors

 

Data breach response

In accordance with GDPR and 2026 breach expectations:

 

• We investigate suspected breaches immediately

• We notify affected individuals without undue delay

• We notify the ICO within 72 hours where required

​

Consent management

Where processing is based on consent (e.g., marketing, cookies):

 

• Consent is recorded and stored

• You may withdraw consent at any time

• Consent will be refreshed if our practices change

​

Your rights

You have the right to:

​

• Access your personal data

• Request correction of inaccurate data

• Request deletion of your data

• Object to processing

• Request restriction of processing

​

Policy updates

When we update this policy:

 

• The updated version will appear on our website

• The “last updated” date with change

​

More information on your rights can be found on the  Information Commissioner’s Office (ICO) website.

​

If you have previously given permission for us to contact you for marketing purposes, you may request we stop
at any point by emailing Hello@bpmcardiff.co.uk.

​

Under the Data Protection Act 2018 and General Data Protection Regulations you may request details of personal information which we hold about you by making a subject access request to Hello@bpmcardiff.co.uk or in writing to BPM Cardiff, 130 Henke Court, Cardiff, CF10 4EJ.

 

​

​​