See 'Who we share your personal data with' for further information on the steps we will take to protect your personal data where we need to share it with others.

7. MARKETING

We may send you communications about our services, appointment and enquiry updates, service announcements and insights, and (where permitted) promotional offers.

Where required by law (including under PECR), we will obtain your consent before sending you direct marketing by email, SMS, push notification or similar electronic means. Where consent is not required, we may send marketing on the basis of our legitimate interests, subject to applicable law and your right to opt out at any time. We will also seek consent where required for non-essential cookies or similar technologies used on the Website, and we maintain records of your marketing and consent preferences.

You will have the right to opt out of receiving marketing communications at any time by:

• contacting us at karen@kmjmproperty.co.uk

• using the 'unsubscribe' link included in all marketing emails you may receive from us

We will not sell your personal data to third parties for their own direct marketing purposes.

Photography and portfolio use: We may photograph completed styling projects (including images of your property) for our portfolio, website, social media and other promotional purposes. We rely on our legitimate interests in marketing and promoting our services as the lawful basis for this processing, having balanced those interests against your rights and interests; the images used for this purpose show the styled property and do not identify you. You have the right to object to this processing at any time, and you may also ask us not to use images of your property before service delivery, by contacting us in writing using the details in the 'How to contact us' section below, and we will stop using the relevant images on request. We will not use any image or information that identifies you personally for marketing or promotional purposes without your separate, explicit consent, which you may withdraw at any time (withdrawal will not affect the lawfulness of processing carried out before withdrawal).

For more information on your right to object at any time to your personal data being used for marketing purposes, see 'Your rights' below.

8. WHO WE SHARE YOUR PERSONAL DATA WITH

We share personal data only where necessary for the purposes set out in this Privacy Policy. As controller for our Website and services, we may share personal data with: (a) our service providers who help us operate the Website and deliver our services, such as website hosting, infrastructure, communications, analytics and CRM providers, (b) professional advisers, regulators, law enforcement and other third parties where required or permitted by law, (c) where we use a third-party appointment scheduling, invoicing or payment tool to manage client bookings or process payments, the relevant provider for that purpose (we currently use Stripe, Inc. to process payments made via the Website; Stripe's privacy policy is available at https://stripe.com/gb/privacy), and (d) photographers and contractors engaged in connection with the delivery of our services, including where property photographs are taken for portfolio, marketing or service delivery purposes. Where our service providers process personal data on our behalf, they do so under contractual obligations as processors (as applicable) and must only process personal data in accordance with our instructions.

We only allow service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you.

We or the third parties mentioned above may occasionally also need to share your personal data with:

• external auditors, e.g. in relation to the audit of our accounts and our company, the recipient of the information will be bound by confidentiality obligations

• professional advisors (such as lawyers and other advisors), the recipient of the information will be bound by confidentiality obligations

• law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations

• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. Usually, information will be anonymised, but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations

If you would like more information about who we share our data with and why, please contact us (see 'How to contact us' below).

We do not share your personal data with third parties except as described in this Privacy Policy or where required or permitted by law.

9. HOW LONG YOUR PERSONAL DATA WILL BE KEPT

We will keep personal data for as long as necessary for the purposes set out in this Privacy Policy. We generally retain enquiry, client and appointment data for as long as you are an active client and for a reasonable period afterwards to manage our business, comply with legal obligations, resolve disputes and enforce our terms. Any payment or invoicing records are retained as required for accounting, tax and regulatory purposes. Property photographs and other documents you provide are retained for as long as necessary to deliver the relevant service and for a reasonable period thereafter for dispute resolution or legal claims purposes. Following the end of the applicable retention period, we will delete or anonymise personal data in accordance with applicable data protection requirements, unless we are required to retain it (for example, due to legal obligations or a legal hold).

10. TRANSFERRING YOUR PERSONAL DATA OUT OF THE UK

We may transfer your personal data outside the UK (for example, where our service providers or their support teams process data in other countries). Some of our service providers, including payment providers, cloud or communications providers, customer support tools, analytics providers and verification providers, may operate globally and may process personal data outside the UK. Our primary data storage uses servers located in the United Kingdom. Where we transfer personal data outside the UK, we will ensure appropriate safeguards are in place to protect your personal data, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, and, where required, a transfer risk assessment (TRA), or another lawful transfer mechanism under UK data protection law.

Furthermore, under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an 'adequacy regulation') further to Article 45 of the UK GDPR; there are appropriate safeguards in place (such as the IDTA and, where relevant, the UK Addendum to the EU Standard Contractual Clauses), together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law.

• The EEA: we may rely on the UK adequacy regulations in respect of EEA countries (where applicable).

• Other countries: we will put in place appropriate safeguards (such as the IDTA and, where required, a TRA) and other measures required by UK data protection law.

In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.

11. YOUR RIGHTS

You generally have the following rights, which you can usually exercise free of charge. For all processing described in this Privacy Policy, Company is the controller and you can direct requests to us. For more information regarding these rights, please visit the ICO website here.