Privacy Policy

This policy applies to John Grants (Estate Agents) Ltd, trading as John Grants (“we”, “us”, “our”). We are an independent estate agency registered in England, based at 267 Fore Street, Edmonton, London N18 2TY. We are the data controller for the personal information collected through this website.

If you have a question about this policy or your information, contact us at admin@johngrants.com or on 020 8345 5533.

This policy covers this website only. If you become a client (for example you instruct us to sell, let or manage a property), we collect more information from you in the branch and through our back-office systems. That information is not covered by this policy.

Enquiries and valuation requests. When you use a form on this website we collect your name, your email address, your phone number (optional) and your message. The forms also ask a few short questions, depending on what you choose:

• If you want to sell or let a property: the property's address, its type and its number of bedrooms.
• If you want to buy or rent: the area or areas you are interested in, the type of property and the number of bedrooms.
• If you are enquiring about a particular property (including asking to arrange a viewing): which property you mean.
• If you use the valuation form on the Selling page: the same property questions, plus an optional note.

Please do not put sensitive details (for example health, passport, payment or ID details) in the message box. We do not ask for them.

Address lookup. On the property address box of the valuation form and the “sell” and “let” steps of the contact form, what you type is sent to Google's address-lookup service (the Google Places API) to suggest matching addresses as you type. When you pick a suggestion, we ask Google for the full postal address. Details:

• This happens from our server, not from your browser. Google sees the text you typed, a random session code, and our account key. It does not see your IP address, browser or cookies.
• It starts only once you have typed four or more characters in that box. Nothing is sent until then.
• No Google script is loaded into your page for this.
• We keep your IP address and the time of each lookup for 30 days, to stop the feature being abused (see “Technical information”).
• Google handles what it receives under its own terms and privacy policy.

The address you finally submit is stored with your enquiry (see section 6).

Contact by phone or email. If you call, email or write to us, we keep what you tell us so we can reply.

Testimonials. If you send a testimonial through our testimonial page, we collect your name, your star rating and what you write, and you must tick a box to say you are happy for your name and review to appear on this website. It is saved as a draft and we read every one before anything is published. We also show reviews that customers have left on independent review sites such as GetAgent. These appear with a first initial and surname.

Saving homes and searches. If you tap the heart on a property or save a search, that list is kept in your own browser only. We do not hold it and it is not linked to you. The website does send a simple “saved” or “unsaved” signal for that property so we can see how popular it is. This is a running total with nothing to say who you are. We keep your IP address for 30 days to limit abuse of that counter.

Our property listings. The properties shown on this website come from our own back-office property software (a “BLM” listing file, which the website collects over FTP about every 15 minutes). The website reads only property details: address, price, number of rooms, description, features, photos, floor plans and documents such as energy certificates. The file's field list holds no vendor or landlord names, phone numbers or email addresses, and the website does not read any. A property's address can still point to who lives there, which is why we only publish a listing at the owner's instruction. The website also sends each property's postcode to postcodes.io, a free public postcode service, so we can place the property on a map. It receives the postcode only, and no visitor information.

Technical information.

• When you submit a form, or use the address lookup, or save a property, we record your IP address and the time. This is kept for 30 days and used only to stop spam and abuse (for example someone sending hundreds of enquiries a minute). Your IP address is not saved with your enquiry itself.
• When we send you a confirmation email, we keep a scrambled (hashed) version of your email address for 30 days so the same address cannot be sent more than three confirmations a day. The scrambled version cannot be turned back into your address.
• Our hosting provider also keeps standard server logs.
• Our bot check (Cloudflare Turnstile) receives your IP address and some browser signals when you reach the end of a form.

Analytics.

• Vercel Analytics runs on every visit. It does not use cookies and does not store anything on your device. It records the page you view, the page you came from, your approximate location (country and region), and your device, browser and operating system, and notes when you submit an enquiry (the fact that you did, not what you wrote). According to Vercel it does not keep your IP address or follow you from site to site.
• Google Analytics runs only if you accept analytics cookies in the banner. It records which pages you visit, roughly where you are, what device and browser you use, and when you submit an enquiry. If you decline, none of this is collected.
• Microsoft Clarity runs only if you accept analytics cookies in the banner. It records how pages are used: where visitors click, tap and scroll, how the mouse moves, which pages they view, roughly where they are, and what device and browser they use. We can watch this back as a recording and see it as a heatmap, to find parts of the website that are confusing. Anything you type into our forms and calculators is hidden from the recording. If you decline, none of this is collected.

Maps. Property pages (with a map) and area guide pages show a Google Map. It loads with the page, so Google receives your IP address and the address of the page you are on as soon as the map is requested, and Google may set its own cookies. We do not control those. If you do not want that, you can block third-party content in your browser, and the website still works; the “Open in Google Maps” and “Get directions” links open Google Maps in a new tab instead, and Google receives your information then only because you chose to go there.

The map view on the property search page (“Map”) uses OpenStreetMap. It loads only when you open that view, and the OpenStreetMap servers receive your IP address and the address of the page you are on as they send the map pictures. OpenStreetMap sets no cookies through this. The pins show only the street and the first half of the postcode of each property.

Videos. Some property pages have a video hosted on YouTube. It does not load when the page opens. You see a placeholder with a “Play video” button, and a link to watch it on YouTube. YouTube (which is owned by Google) receives your IP address and the address of the page you are on only after you press “Play video”, and it may then set its own cookies. We do not control those. We use YouTube's privacy-enhanced address (youtube-nocookie.com) for the player. If you choose “Watch on YouTube” instead, YouTube opens in a new tab, and it receives your information only because you chose to go there.

Our team. People who manage this website sign in to a private area. For security we record every sign-in attempt, successful or not: the email address typed, the time, the IP address and browser details. That includes attempts by anyone who tries to sign in, not just our team. When a team member signs in successfully, we also find their approximate location (city, region and country) by sending the IP address to ipapi.co. Staff accounts are held by Supabase, our sign-in provider. They use a password, an authenticator code and optionally a passkey.

Children. Our services and this website are for adults aged 18 and over. We do not knowingly collect information from children.

• To reply to your enquiry, arrange a valuation or viewing, and take steps you ask for before you become a client: we do this to take steps at your request before a contract (UK GDPR Article 6(1)(b)). For general questions and feedback it is our legitimate interest in answering you (Article 6(1)(f)).
• To send you the automatic confirmation email after you enquire: the same basis as above.
• To help you complete a form with the address lookup: our legitimate interest in making the form quick and accurate (Article 6(1)(f)).
• To protect this website from spam and abuse, including recording IP addresses for 30 days, the confirmation-email limit and the bot check: our legitimate interest in keeping the site secure and our inbox usable (Article 6(1)(f)).
• To keep sign-in records for staff accounts, and to check where sign-ins come from: our legitimate interest in keeping client data secure (Article 6(1)(f)), and our duty to keep personal data secure (Article 32).
• To publish a testimonial you send us: with your consent (Article 6(1)(a)), given by ticking the box on the form, which you can withdraw at any time. For reviews already public on a review site, our legitimate interest in showing real customer feedback (Article 6(1)(f)).
• To publish a property listing: this is done for the owner, as part of the service they have asked us for.
• To count visits with Vercel Analytics: our legitimate interest in understanding how the website is used and improving it (Article 6(1)(f)). It stores nothing on your device, so it does not need cookie consent.
• To measure how the website is used with Google Analytics: only with your consent through the cookie banner (Article 6(1)(a)).
• To see how the website is used with Microsoft Clarity recordings and heatmaps: only with your consent through the cookie banner (Article 6(1)(a)).
• To show you a Google Map on property and area pages: our legitimate interest in showing where a property is, which a visitor would expect from an estate agent's listing (Article 6(1)(f)).
• To show you the search results on an OpenStreetMap map when you choose Map view: our legitimate interest in letting a visitor see where properties are (Article 6(1)(f)).
• To play a YouTube video on a property page: your consent, which you give by pressing “Play video” (Article 6(1)(a)).
• To keep proper business records, deal with complaints and meet our legal duties as an estate agent: legal obligation (Article 6(1)(c)) and legitimate interests.

We do not send marketing emails or texts. We do not sell your information. We do not use it to make automated decisions about you.

These companies process information for us, under their own data protection terms and only to provide their service:

• Vercel: hosts this website, and runs Vercel Analytics (above). It handles your page requests and its servers' standard logs.
• Supabase: provides our database and file storage. Enquiries, testimonials, sign-in records, and our records of emails we have sent are held there, and the staff sign-in system runs on it. Your browser also loads the property photos directly from Supabase's storage address, so Supabase can see your IP address when a photo loads.
• Resend: sends the emails the website generates: the alert we receive when you send an enquiry (which contains your name, email address, phone number and message) and the confirmation we send you. It sees those emails.
• Microsoft 365: hosts our email accounts, so enquiries sent to our sales, lettings and admin inboxes, and our replies, are stored there.
• Google: (1) the address lookup (above); (2) the maps on property and area pages (above); (3) YouTube, which Google owns, only after you press “Play video” on a property that has one (above); (4) Google Analytics, only if you accept analytics cookies.
• Microsoft (Clarity): records how visitors use the website (clicks, scrolling and the pages viewed, with anything typed into forms hidden) and stores the recordings for us, only if you accept analytics cookies.
• Cloudflare (Turnstile): checks that a form is being filled in by a person and not a bot. It loads a script from Cloudflare when you reach the last step of a form and receives your IP address and some browser signals.
• ipapi.co: looks up the approximate location of the IP address of each team member who signs in successfully to our admin area, for the sign-in record. It receives only that IP address, and never visitor information.
• OpenStreetMap (OpenStreetMap Foundation): provides the map pictures in the search page's Map view, only when you open it. It receives your IP address and the page address, and nothing else we hold about you.
• postcodes.io: receives the postcode of each property we list, to place it on the map. It receives no visitor information.

When you ask about a property, we may pass your enquiry to the person at John Grants who deals with it.

We may also share information where the law requires it, for example with the police or a regulator.

The site links to Facebook, Instagram, LinkedIn, GetAgent and other sites. Those links only take you to them when you click. We load no code from them, and what they do with your information is up to them.

Some of these companies are based in the United States or process information there, including Vercel, Supabase, Resend, Google, Microsoft, Cloudflare and ipapi.co. When information leaves the UK we make sure it is protected by an approved safeguard: the UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses.

These are the periods the website actually applies. A clean-up job runs on the first day of each month, so something past its limit may stay until the next run.

• Enquiries, valuation requests and property enquiries: 24 months from the date you sent them, then deleted automatically. We keep them that long in case you get back in touch about the same property.
• Enquiries marked as spam: 30 days.
• Copies of the emails the website sends (enquiry alerts and confirmations): 12 months.
• IP addresses kept for spam and abuse protection (form, address lookup and save-a-home limits) and the scrambled email check: 30 days.
• Staff sign-in records (including IP address, browser and approximate location): 90 days.
• Testimonials: until you ask us to remove them, or we choose to. They are not removed automatically.
• Property listings: while the property is on the market. When a listing is archived, we keep only its basic details and first five photos, for our records.
• Saved homes and searches: in your own browser until you clear it.
• Analytics data in Google Analytics: no longer than 14 months. Vercel Analytics: according to Vercel, as set by its service and not by us.
• Recordings and heatmaps in Microsoft Clarity: 30 days. According to Microsoft, recordings we mark as favourites, and a random sample Clarity keeps, are held for longer, up to 9 months.
• Emails you send us directly, and replies in our mailboxes: for as long as we need them to deal with your enquiry and keep proper business records, and for as long as the law requires.
• Records we are legally required to keep, such as proof of identity checks and accounts, are kept for the period the law requires. They are held in our back-office systems, not on this website.

If you ask us to delete your information sooner, we will, unless the law requires us to keep it.

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct anything that is wrong
• ask us to delete your information
• ask us to restrict how we use it, or object to how we use it (in particular where we rely on our legitimate interests)
• ask for it in a portable format
• withdraw any consent you have given us, at any time

To use any of these rights, email admin@johngrants.com or call 020 8345 5533. We reply within one month and do not charge, and we may ask you to confirm who you are first. Because the website keeps enquiries under your email address, giving us that address helps us find everything quickly. If you also want your IP-address records removed, give us the address you used (we cannot find it from your name).

If you are not happy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live outside the UK, you can also complain to the data protection authority in your own country.

Cookies are small files a website stores on your device. Browser storage works in a similar way. We use as few as possible.

When you first visit, a banner asks whether you accept analytics cookies. It has “Decline”, “Customise” and “Accept”. Until you choose, Google Analytics and Microsoft Clarity are not loaded and no analytics cookie is set. “Decline” is as easy as “Accept”, and the website works exactly the same either way. Before you choose, only Vercel Analytics runs, and it stores nothing on your device. The Google Map on property and area pages loads with the page (see section 2), but a property's YouTube video loads only if you press “Play video”.

Changing your mind. Use “Cookie preferences” at the bottom of every page, or the button on this page, to change your choice at any time. Withdrawing consent stops Google Analytics and Microsoft Clarity from then on and removes their cookies from your browser. You can also clear cookies in your browser settings.

We do not use advertising or tracking cookies, and we do not use any Meta (Facebook) or other advertising pixel.

The Google Analytics and Microsoft Clarity rows apply only if you accept analytics cookies. Staff who sign in to our admin area also receive a sign-in cookie (named sb- followed by letters and -auth-token) and, while editing, a short-lived preview_frame_ok cookie. Visitors never get these.

Vercel Analytics sets no cookie and uses no browser storage. Google Maps and our address lookup are described in section 2. Cloudflare Turnstile, which protects our forms, uses technical checks from your browser to tell people from bots. It does not set advertising or tracking cookies for us.

We may update this policy from time to time, for example if we start using a new tool or service. The current version is always on this page, with the date it was last updated at the top.