DATA PROTECTION POLICY

BACKGROUND:

Oakling Properties Ltd understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of anyone who takes the time to fill in our “Property Onboarding Questionnaire” and only collect and use your personal data as described in this Data Protection Policy. Any personal data we collect will only be used as permitted by law.

Please read this Data Protection Policy carefully and ensure that you understand it. Your submission of answers to our “Property Onboarding Questionnaire” implies your acceptance of this Data Protection Policy.

1. Definitions and Interpretation

In this Data Protection Policy, unless the context otherwise requires, the following expressions have the following meanings:

“We", "Us" or "Our” means Oakling Properties Ltd, a limited company registered in England under company number 14161524, whose registered address is 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX.

“Personal Data” means any and all data that relates to an identifiable person who can be directly or indirectly identified from that data, as defined by the UK GDPR and the Data Protection Act 2018 (the “Data Protection Legislation”)

“You" or "Your” means the property owner(s), or where applicable, individual(s) and/or entity or entities with legal authority to sell the property on behalf of the property’s owner(s), who is/are engaging with Oakling Properties Ltd for the proposed sale of the Property.

2. About Oakling Properties Ltd

Oakling Properties Ltd is a limited company registered in England and Wales under company number 14161524, with our registered office address held at 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX.

Data Protection Officer: Bindal Davies; email address: bindal@oaklingproperties.co.uk; telephone number: 07471416613.

3. What Is Personal Data?

Personal data is defined by the UK GDPR and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

4. Confidentiality Obligations

Both you and we agree to treat all information exchanged during the process of selling your property as confidential. Neither party shall disclose any sensitive or commercially significant information to any third party, except where disclosure is:

• Required by law or regulatory authorities.

• Necessary for the completion of the sale of your property, including necessary disclosures to legal representatives, financial institutions, surveyors, or vetted third-party investors involved in the sale.

• Expressly agreed upon in writing by both parties.

We do however reserve the right to share relevant and necessary information about you, your property, the deal and the sale with our sister company where required to facilitate the sale of your property.

5. Data Protection Compliance

We comply with the Data Protection Legislation when handling any personal data provided by you. By engaging with us, you consent to the processing and sharing of your personal data, for which we will:

• Collect and process only the data necessary for the purposes of conducting our Initial property assessment, negotiating a deal with you, conducting due diligence and progressing the sale of your property to completion.

• Store your data securely and restrict access to authorised personnel only.

• Retain personal data only for as long as necessary to fulfil legal and operational requirements.

• Ensure that data shared with third-party service providers (e.g., other Oakling Group companies, solicitors, surveyors, financial institutions) is handled in compliance with data protection laws.

6. Seller’s Rights Regarding Personal Data

Under UK GDPR, you have the right to:

• Access your personal data held by us.

• Request correction of inaccurate or incomplete personal data.

• Request deletion of personal data where it is no longer necessary for the purposes collected, subject to legal or regulatory retention obligations.

• Object to the processing of your personal data in certain circumstances.

• Request data portability where applicable.

To exercise any of these rights, you must submit a written request to our Data Protection Officer (DPO), Bindal Davies, via details provided in Part 10. We will acknowledge and respond to such requests within 30 days, in accordance with UK GDPR regulations.

For more information about our use of your personal data or exercising your rights as outlined above, please contact Us using the details provided in Part 10.

It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first, using the details in Part 10.

7. Third-Party Data Sharing & Security Measures

Subject to your consent, we may seek to share your personal data with our sister company to progress the sale of your property, and third parties directly involved in the sale, including but not limited to vetted third-party investors, solicitors, financial institutions, and surveyors, as appropriate. Any third-party recipient of your data must adhere to strict confidentiality and data protection standards.

We employ appropriate technical and organisational measures to protect your data from unauthorised access, loss, or misuse. However, we shall not be held liable for data breaches resulting from cyber-attacks, security vulnerabilities in third-party systems, or circumstances beyond our control, provided reasonable data security measures were in place.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

If any of your personal data is transferred to a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above in Part 6.

8. How Do You Use My Personal Data?

Where we collect any personal data via “Property Onboarding Questionnaire”, it will be processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with our obligations and safeguard your rights under the Data Protection Legislation at all times. For more details on security see Part 9, below.

Any and all emails containing your personal data will be deleted no later than 2 working days after you inform us of not wanting any further communication from us (you can inform Us of this either in writing via email or verbally over the phone), and no other personal data will be retained for any longer than is necessary.

We do not routinely share your personal data with third-parties other than storage on an email. We may however, subject to your consent, seek to share your personal data with another ‘Oakling Group’ company and prospective third-party investors to facilitate the sale of your property.

9. How and Where Do You Store My Data?

We will only store your personal data in the UK. This means that it will be fully protected under the Data Protection Legislation.

Personal data security is essential to us, and to protect personal data, we take the following measures:

• Limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality.

• Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so.

10. How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Bindal Davies):

• Email address: bindal@oaklingproperties.co.uk

• Telephone number: 07471416613.