Privacy Policy

Privacy Policy & Data Protection Notice. We are committed to protecting your privacy and ensuring your personal information is handled in a safe and responsible manner, in accordance with the applicable laws and regulations.

General guidance

This Privacy Policy explains how Finvise collects, uses, shares, retains and protects personal data. We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), each as amended, including by the Data (Use and Access) Act 2025.

We collect personal data that you provide to us (for example through our website, our platform or when you contact us), that our clients provide to us (for example lenders instructing a valuation), and, for business contacts, that we obtain from publicly available professional sources, as described in this policy.

Who this policy applies to

This policy is applicable to the following categories of individuals:

• Website visitors
• Finvise product users
• Finvise customers and their authorised users
• Business contacts and prospects: people working for organisations we work with, or would like to work with (see “Business contacts and prospects” below)
• Payers: mortgage applicants and other people who pay a valuation fee through a payment link on behalf of the lender or other client that instructed us (see “Payers and people named in valuation instructions” below)
• Borrowers, property owners, occupiers and other people whose details are included in a valuation instruction
• Consultants, suppliers and partners: consultant valuers, advisors and introducers we engage, people who sign agreements with us (such as non-disclosure agreements) or act for an organisation that does, and people working for our suppliers, partners and professional advisers (see “Consultants, suppliers and partners” below)
• Job applicants: people who apply to work with us, or whom we consider for a role

Where personal data about borrowers, property owners, occupiers or other people is included in a valuation instruction, we process it to carry out that instruction as a processor on behalf of the client that instructed us, and that client’s privacy notice applies to that processing. We act as an independent controller, and this policy applies, for the purposes described in “Payers and people named in valuation instructions” below.

Where we obtain personal data

We obtain personal data from the following sources:

• Directly from you – when you visit our website, submit an enquiry, create an account, use our platform, make a payment, enter into an agreement with us, or correspond or speak with us.
• From our clients – for example lenders or other organisations that instruct us provide details relevant to an instruction and details of their staff who use our services.
• From publicly available professional sources – such as LinkedIn and other professional networking sites, organisation websites, professional and industry directories, and public registers (such as Companies House and the RICS register).
• From business contact data providers – such as Apollo.io and similar services that compile and verify business contact information.
• From people who refer you – such as colleagues, introducers or business partners, and, for job applicants, recruitment agencies and referees.
• Automatically – through cookies and similar technologies on our website, including, where you consent, analytics and session recording tools, and through campaign tags in links you follow to our website (see “Cookies, analytics and similar technologies” below and our Cookie Policy).

What information we collect and lawful basis for collection

Further details of the information collected through cookies and similar technologies are set out in “Cookies, analytics and similar technologies” below and in our Cookie Policy.

Business contacts and prospects

If you work for an organisation that may have a professional interest in our services, such as a lender, mortgage broker, insurer, valuation firm, property business or public body, we may contact you in your professional capacity. We do so either because we have been in touch with you or your organisation before, or because we obtained your business contact details from publicly available professional sources, such as LinkedIn or your organisation’s website, or from business contact data providers such as Apollo.io.

The information we hold about business contacts is limited to your name, job title, organisation, business email address, business phone number, professional profile URL and a record of our communications with you, including any marketing preferences or objections.

We use this information to contact you about our valuation services and to manage our relationship with you and your organisation. We rely on our legitimate interest in promoting our services to organisations that are likely to benefit from them. We have assessed that this does not override your rights, because we contact you only in your professional capacity, only about services relevant to your role, and you can stop our communications at any time.

We send marketing emails without your prior consent only to business email addresses of people working for companies, limited liability partnerships and other corporate bodies. We do not send marketing emails to sole traders, partners in unincorporated partnerships or personal email addresses unless you have consented, or you are an existing customer (or have negotiated to buy our services) and we are marketing similar services to you.

Every marketing email we send identifies Finvise and tells you how to object to further marketing.

We keep prospect records for up to 24 months after our last meaningful interaction with you, after which they are deleted. If you ask us not to contact you, we will keep only your email address and the date of your request on a suppression list, so that we can make sure we do not contact you again.

Payers and people named in valuation instructions

If you pay a valuation fee through a payment link we send you, for example as a mortgage applicant, you pay on behalf of the lender or other client that instructed us. You do not become our client: our contract is with that client, and the valuation is prepared for that client’s purposes only.

Payment links open a payment page hosted by our payment service provider, Stripe. Stripe collects your card details; we do not receive or store them. We use the information described in the table above to collect our fee, send you a receipt, handle refunds and chargebacks, keep our financial records, and tell the client that instructed us that payment has been received.

Where your details are included in a valuation instruction, we usually receive them from the lender or other client that instructed us, not from you. We act as a processor for that client when we carry out the instruction. We act as an independent controller when we keep professional records and reports as required by RICS, our professional indemnity insurers and the law; handle complaints and legal claims; prevent fraud and misuse; collect our fees; and develop and improve our valuation models and services, using de-identified or aggregated data wherever practicable.

Consultants, suppliers and partners

If you work with us as a consultant valuer, advisor or introducer, or you (or an organisation you act for) enter into an agreement with us, such as a services agreement or a non-disclosure agreement, we use your personal data to enter into and perform that agreement, pay you, keep the accounting, tax and regulatory records required by law, and manage our relationship with you. Where you contract with us yourself, we rely on the performance of that contract; where you act for an organisation, we rely on our legitimate interest in managing our relationship with it. We keep accounting, tax and other records because the law requires us to.

If you are a consultant valuer, we may check your membership on the public RICS register. We name you as the valuer on the reports you prepare for us, and we share your details with the clients who instructed those reports, with our professional indemnity insurers and, where required, with RICS. We keep valuation records, including the identity of the valuer, for 15 years from the date of the report.

If we grant you a share option, we keep records of the option and of any shares issued on its exercise. We may share them with our professional advisers, shareholders and prospective investors, under appropriate confidentiality obligations, and include them in filings at Companies House where the law requires.

Electronic signatures

We sign agreements electronically using DocuSign, whoever we contract with, including clients, consultants, suppliers and partners. When you sign an agreement with us, whether for yourself or on behalf of an organisation, DocuSign processes your name, email address, signature and a record of the signing process (including IP address and time stamps) on our behalf. We keep the completed agreement and its signing record for as long as we keep the agreement itself, as described in “Retention of personal data” below.

Cookies, analytics and similar technologies

We use strictly necessary cookies to make our website work securely. We use analytics and session recording tools only if you consent through our cookie banner. You can change your choice at any time using the “Cookie settings” link at the bottom of every page of our website.

With your consent, we use:

• Google Analytics (Google) – to produce statistics on how our website is used and how visitors find it;
• HubSpot – to record the pages you visit and, if you submit a form or are already a business contact, to link those visits to your contact record in our CRM; and
• Microsoft Clarity (Microsoft) – to produce heatmaps and recordings of how visitors navigate our pages, so that we can find and fix usability problems. Text you type into forms is masked and not recorded. Microsoft may also use this data for its own purposes, including improving its products and for advertising, as described in the Microsoft Privacy Statement.

We do not use these tools on our client platform or on payment pages. Payment pages are hosted by Stripe, which uses its own cookies as described in its cookie policy. Links in our emails, posts and on partner websites may contain campaign tags. If you submit a form on our website, we record these tags with your enquiry so that we know how you found us. If you click a link in an email we send you, we may record that you did so.

Details of each cookie, its provider and how long it lasts are set out in our Cookie Policy.

Our legitimate interests

Where we rely on legitimate interests, those interests are:

• running and developing our business, including promoting our services to organisations that are likely to benefit from them;
• managing our relationships with clients, consultants, suppliers, partners and business contacts, and providing customer support;
• keeping our website and platform secure and preventing fraud and misuse;
• collecting our fees, including payments made through payment links on behalf of our clients, and handling refunds and chargebacks;
• improving our services, website and technology, including developing and training our valuation models and using completed valuations as comparable evidence, and understanding which of our marketing activities and referral partners are effective;
• complying with RICS requirements and the requirements of our professional indemnity insurers, and establishing, exercising or defending legal claims; and
• where relevant, a potential investment in, financing of, or sale or reorganisation of our business.

We balance these interests against your rights and freedoms. You can ask us for more information about this assessment by contacting us.

Your right to object to marketing

You have the right to object at any time to our use of your personal data for direct marketing, including any profiling related to such marketing. If you object, we will stop.

To object, reply “stop” to any of our marketing emails, or write to complaints@finvise.com. We will act on your request promptly. If you are a client, objecting to marketing will not affect service communications that we need to send you in connection with our services.

Special category data and minors

Finvise does not ordinarily process special category personal data for the purpose of providing this website or the services. Users must be over the age of 18, and Finvise does not knowingly collect the personal data of minors.

If you apply for a role and tell us about a disability or health condition so that we can make adjustments to the recruitment process, we use that information only for that purpose, as employment law permits.

Payment links are intended for adults. Finvise does not knowingly collect or process the personal data of minors in connection with payments.

Automated decision-making and use of technology

Finvise uses proprietary technology, including automated valuation models and artificial intelligence tools, to support its valuation services. These tools assess properties, not individuals. We also use property and valuation data, de-identified or aggregated wherever practicable, to develop, train and test these tools. We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects for them. Lending decisions are made by the relevant lender, not by Finvise.

Where we use third-party artificial intelligence services, we do so subject to contractual confidentiality and data protection obligations and, where data is transferred outside the United Kingdom, the safeguards described below.

Retention of personal data

We keep personal data only for as long as necessary for the purposes for which it was collected. In particular:

• Business contacts and prospects: up to 24 months after our last meaningful interaction with you.
• Marketing suppression records: for as long as we carry out direct marketing, limited to your email address and the date of your request.
• Website enquiries that do not lead to a business relationship: up to 24 months.
• Job applications that do not lead to employment: up to 6 months after we tell you our decision, unless you agree that we may keep your details for future vacancies.
• Client account and contract data: for the duration of the relationship and 6 years after it ends.
• Consultant, advisor, introducer, supplier and partner records, including agreements such as non-disclosure agreements and their signing records: for the duration of the agreement and any obligations that continue after it ends, and 6 years after that.
• Share option and shareholding records: for as long as the option or shareholding exists, and afterwards for as long as company law requires.
• Payment transaction records (including receipts, refunds and transaction references): 6 years from the date of the relevant transaction.
• Valuation instruction records and reports: 15 years from the date of the report.
• Website analytics data (Google Analytics): 14 months. Analytics cookies themselves may remain on your device for longer, as set out in our Cookie Policy.
• Session recordings and heatmaps (Microsoft Clarity): kept by Microsoft in accordance with its retention periods, currently up to 30 days for recordings.
• Website activity linked to a contact record: for the retention period that applies to that record above.

These retention periods reflect: (a) HMRC requirements for the retention of financial and VAT records; (b) the limitation periods applicable to contractual and negligence claims under the Limitation Act 1980, including the 15-year longstop for negligence claims; and (c) our obligations as a RICS-regulated firm and the requirements of our professional indemnity insurers. At the end of the applicable retention period, records are securely deleted or anonymised unless a longer period is required by law or regulatory obligation, or to establish, exercise or defend legal claims. Cookie retention is described in our Cookie Policy.

Sharing personal data and third-party processors

Finvise uses third-party processors as part of its product and business operations. The following categories of processors act on our instructions:

• Hosting, storage, website security and content delivery services (such as Cloudflare)
• Email, document storage, collaboration and internal messaging services (such as Microsoft 365, including Outlook, Google Workspace and Slack)
• Email, communication and marketing providers
• CRM, sales and marketing platforms
• Sales intelligence and email verification tools
• Artificial intelligence and data analytics services
• Subcontracted valuers, surveyors and property inspectors
• Website analytics and consent management providers (such as Google and HubSpot)
• Payment service providers (such as Stripe), which provide our payment links and process card payments
• Electronic signature services (such as DocuSign)

Lenders and other clients. If you pay a valuation fee through a payment link, we tell the lender or other client that instructed us that payment has been received, and we deliver the valuation report to that client, not to you. The client processes this information as an independent controller for its own purposes, such as its lending decision. Please refer to its privacy notice for further information.

Other recipients. We may also share personal data, where necessary, with:

• Microsoft, in connection with Microsoft Clarity, as described in “Cookies, analytics and similar technologies” above;
• Stripe, which acts as an independent controller for some purposes, such as preventing fraud and meeting its own legal and regulatory obligations, as described in the Stripe Privacy Policy;
• our professional advisers, such as lawyers, accountants and auditors;
• our insurers and insurance brokers;
• RICS, HMRC, Companies House, the Information Commissioner and other regulators, courts or law enforcement authorities, where required by law or regulation; and
• our shareholders (for example, records of share options and shareholdings) and prospective investors, financiers or purchasers of all or part of our business, under appropriate confidentiality obligations.

Processing by our processors is subject to contractual obligations to keep your personal data confidential and secure. We do not sell or rent your personal data to third parties.

International transfers of personal data

Some of our service providers and staff are located outside the United Kingdom, including in the United States and the United Arab Emirates. Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, by relying on UK adequacy regulations (including the UK–US Data Bridge for certified US organisations) or by putting in place the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner. Email, documents and internal messages may be processed in the United States by Microsoft, Google and Slack, website analytics, CRM and session recording data by Google, HubSpot and Microsoft, payment data by Stripe, and electronic signature data by DocuSign. You can request details of the safeguards we use by contacting us.

How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including access controls, encryption in transit and restricting access to staff and processors who need it.

Your data protection rights

Under UK GDPR, you have the following rights, some of which apply only in certain circumstances:

• Right to be informed of processing
• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing, including the absolute right to object to direct marketing (see “Your right to object to marketing” above)
• Rights in relation to automated decision-making
• Right to withdraw consent, where we rely on consent

Subject access, rights and complaints handling

Where Finvise processes personal data on the basis of consent, you may withdraw your consent at any time; however, this may prevent us from providing certain services. To exercise any of your data protection rights, contact us at complaints@finvise.com. We may need to verify your identity before responding. We will respond within one month, which may be extended by up to two further months if your request is complex or you have made several requests, in which case we will tell you within the first month.

If you are unhappy with how we have handled your personal data, please contact us first at complaints@finvise.com. We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to respond to it, and inform you of the outcome without undue delay.

If we are not able to resolve your complaint, or you otherwise wish to do so, you may also raise a complaint with the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Please note that where your personal data has been collected in connection with a payment transaction or a valuation instruction, the right to erasure (Article 17 UK GDPR) may be restricted where we are required to retain that data to comply with a legal or regulatory obligation (for example, HMRC VAT record-keeping requirements) or to establish, exercise or defend legal claims. In such cases, we will inform you of the applicable restriction and the expected retention period.

Updates and changes

Any changes we may make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by email. The version number and effective date at the top of this page show when it was last updated.

Contact information

You may contact us about this Privacy Policy or our use of your personal data by email at complaints@finvise.com or by post at: Privacy, Imperium Global Ventures Ltd, 66 Paul Street, London, EC2A 4NA.