Privacy notice

Who we are

The data controller is Shreef Holdings Ltd, trading as Keyfolio, a company registered in England and Wales with company number 15918102. Its registered office is 3rd Floor, 86-90 Paul Street, London, EC2A 4NE. Contact us about privacy through our contact form, by email at info@key-folio.com or by phone on 07466 949440. We are registered with the Information Commission (ICO) under number ZC281448.

Where we get your information

• From you, when you ask for a quote, contact us or email us, leave a review, apply to be a partner or use the private page for your quote.
• From a partner who introduced you, such as an estate agent or mortgage broker, if you agreed that they could pass on your details: usually your name, contact details, the property and the type of transaction. When we receive them we email you to say so.
• From a solicitor or conveyancer acting for you, if they ask through our website for a law firm to act for your mortgage lender (separate representation): your name, the property's address and postcode, price or value and tenure, the lender, the type of transaction and of mortgage, whether the mortgage offer has been issued and, if they give them, the mortgage amount, the target completion date and anything else that affects the work for the lender (such as a new build, a gifted deposit or a borrower that is a company).
• From the law firm handling your matter: the stages your matter reaches, such as exchange and completion.
• From our website, about how you reached it (see Cookies below).

What we collect

• Contact details: your name, email address and telephone number.
• The full name of each person in your transaction (each buyer, seller or owner, for example), so that the law firm can check who each one is. If you give us someone else's name, please let them know and point them to this notice.
• Once you have asked to go ahead, if you tell us: who else is involved in your move (your estate agent, your mortgage broker and the other side's conveyancer), with their business contact details, so that your law firm has them from the start. If you give us a person's own name or number, please let them know.
• Property and transaction details: addresses, postcodes, prices, tenure, mortgage and ownership circumstances.
• Messages you send us, including through the private page for your quote, and emails, with anything attached, and notes of our conversations.
• If a partner introduced you, the partner's name and referral reference.
• If you are a solicitor or conveyancer asking through our website for a law firm to act for a mortgage lender: your firm's name, its SRA or CLC number and your reference.
• How you found us, such as a search engine, an advert, an email or a partner's website, recorded with your quote or your enquiry. If you came by clicking one of our Google adverts, the reference Google adds to that click is kept with your quote: a code, not your name or contact details.
• When you last opened the private page for your quote, so we know a quote has been read.
• Your choices, such as whether you agreed that a partner who introduced you may be kept updated on your matter, and whether you asked us not to send reminders.
• If you have an account with us as a member of staff, a law firm or a partner: your name, work email address, role and sign-in records, including the internet address and browser used, to keep accounts secure.
• Technical information needed to run and protect the website, such as your IP address and browser type, kept in security logs.

Please do not send us health or other sensitive details unless they affect the work; if you do, we use them only for your matter. Our service is for adults aged 18 or over.

Do you have to give us your information?

No. But without your name, email address, phone number and the property details we cannot prepare a quote, and the law firm will need more before it can act for you. We ask for your phone number so that our team, and the law firm if you go ahead, can call you about your quote and your matter.

How we use it and our lawful bases

• To prepare your quote and respond to your enquiry, including the emails you send us. This is necessary to provide the quote you ask us for under our terms.
• If you, or a solicitor or conveyancer acting for you, ask through our website for a law firm to act for your mortgage lender (separate representation), to pass the request to the law firm on our panel that acts for lenders, email the quote and a copy of the request to whoever asked, and tell them the firm's answer. When you ask, this is necessary to take the steps you ask for; when your conveyancer asks, it is our legitimate interest in passing on a request made for you.
• If you came by clicking one of our Google adverts, to tell Google Ads which clicks became a quote and which went ahead, using only the click's reference and when it happened, so we can see which adverts work. This is our legitimate interest in knowing which of our adverts bring clients. You can object at any time, and we will stop.
• To send you up to three short follow-ups about a quote you asked for (reminders that go by themselves, or a short email from our team) and, when your matter ends, one request for a review. You can say no on your quote's page once you have your quote, and every one of these emails has a link to stop them all, which also tells our team, so that no more are sent. This is our legitimate interest in following up a quote you asked for. You can object at any time, and we will stop.
• To introduce you to a law firm when you ask us to go ahead. Once the firm accepts you, it deals with you directly, and tells us the stages your matter reaches (such as exchange and completion), so that what it pays us is worked out correctly. This is necessary to provide the introduction you ask for under our terms, and for our legitimate interest in running the service.
• If a partner introduced you, to tell them your name, your quote reference, the type of transaction, when your quote is ready, whether your matter goes ahead, completes or closes, and the law firm acting, so we can credit and pay them. This is our legitimate interest in paying our partners. If you agree, your law firm can also keep them updated on your matter through us, with updates such as your searches being back or your completion date, and they hear when contracts are exchanged; your firm records your agreement, and you can withdraw it at any time by telling your firm or us. They never see your quote or your messages.
• If you agree that more than one law firm may contact you, to share your enquiry with a small number of law firms on our panel (the number is shown when you agree), so they can send you their own quotes. This is your consent, which you can withdraw at any time.
• If you ask about another moving service, such as a survey or removals, to contact you about that service or pass your details to one provider of it. This is your consent, given by ticking the service, which you can withdraw at any time.
• To check requests for spam and misuse before we act on them. Our screening looks at what was sent and how, and may hold a request until a member of our team has checked it. This is our legitimate interest in protecting the service and the people who use it.
• To publish your review, only if you agree, with the name you give. This is your consent, which you can withdraw at any time to have the review removed. We check reviews against our records before publishing them: our legitimate interest in publishing only genuine reviews.
• If a partner passed us your details, to contact you about the quote they asked us to prepare for you, and to introduce you to a law firm: the firm on our panel you asked them for, if you did, when we take on their introduction (or another firm on our panel if it cannot act for you), and otherwise a firm when you ask us to go ahead. This is our legitimate interest in answering an introduction you agreed to. We email you as soon as we receive your details, and you can object at any time.
• If you have an account (as a member of our team, a law firm or a partner), to provide it and keep it secure. This is necessary for our agreement with you or your organisation, and our legitimate interest in keeping accounts secure.
• To consider an application to become a partner, which is necessary to take steps at your request before a contract.
• To understand which of our marketing works, using counts of visits and quote forms, of how many visits were made by people rather than programs, and the channel each quote or enquiry came from. This is our legitimate interest in running and improving the service; the counts do not identify you, and you can object to them (see Cookies).
• To keep accounts, handle complaints and meet legal and regulatory duties. This is necessary for compliance with legal obligations.
• To protect the website from misuse, fraud and attacks. This is our legitimate interest in keeping the service secure.

We do not send you marketing about anything else, and we never pass your details to anyone for their own marketing.

Who we share it with

• The law firm allocated to your matter, so it can confirm its fees, carry out checks and act for you if you instruct it. The firm may copy your details into its own case management system, where its own privacy notice applies.
• If you agreed to compare firms, the law firms on our panel your enquiry is shared with (no more than the number shown when you agreed). Each may pay us a fee for your enquiry, as we tell you when you agree.
• If you asked about another moving service, one provider of that service, for that service only. The provider may pay us a fee for the introduction.
• The partner who introduced you, as described above.
• Google, if you came by clicking one of our Google adverts: the click's reference, and whether it became a quote or went ahead, with when. Nothing else goes to Google: not your name, contact details, the property or your quote. Google handles it under its own terms and privacy policy.
• The law firm on our panel that acts for lenders, at present Ackroyd Legal, if you or your conveyancer ask through our website for a law firm to act for your mortgage lender, so it can consider the case, confirm its fee and act for the lender.
• Cloudflare, which acts for us as our processor under a contract that requires it to protect your information: it runs and protects our website, stores our records, documents and backups, sends our emails and forwards emails sent to our email address to the mailbox our team reads, provided by Microsoft (Outlook.com). Cloudflare also uses some information about visits, such as internet addresses, to detect and block malicious activity, as a separate controller under its own privacy policy.
• The provider of a software tool our team uses to see how the business is doing, which may handle it outside the UK: only matter references, the type of transaction, its stage, the law firm, dates and amounts, never your name, contact details, address or anything you write to us.
• Our accountant and other professional advisers, where they need it.
• Regulators, courts and law enforcement where the law requires it.

The law firms, partners and providers we pass your details to use them for their own purposes too, as separate controllers under their own privacy notices.

Where it is stored, and transfers outside the UK

Our website runs on Cloudflare, which acts for us as our processor. Our records, the documents you send us and our backups are stored by Cloudflare in the European Union, and the website itself runs in Cloudflare's data centres in the European Union; UK law approves transfers to the European Economic Area. Cloudflare, Inc. is a US company, and to deliver and protect the website and to receive, send and forward our emails, Cloudflare and the companies it uses may also handle your information in the United States and other countries. Transfers to Cloudflare in the United States rely on its certification under the UK Extension to the EU-US Data Privacy Framework, which UK regulations approve. Other transfers, and transfers to the United States if that certification ever lapses, are protected by the EU standard contractual clauses with the UK International Data Transfer Addendum, in Cloudflare's data processing addendum: you can read it at cloudflare.com/cloudflare-customer-dpa, or ask us for a copy through our contact form or email info@key-folio.com.

How long we keep it

• Quotes and enquiries that do not proceed, call back requests, partner applications that do not lead to a partnership, referrals that are not taken up and requests for other moving services: 24 months from the last contact.
• Matters that proceed: 7 years after the matter closes, to deal with any claims and to meet legal duties.
• Complaints, and requests about your personal information: 7 years after we close them, to show how we handled them.
• Invoices to law firms, which can show a client's name and matter reference: at least 6 years, as tax law requires.
• Reviews: while they are published. Reviews we do not publish: 24 months.
• Emails we send, and those you send us with anything attached: a copy of each, as it was sent, for 24 months, or until what it is about is erased, if that is sooner.
• The reference of a Google advert click kept with a quote: 90 days from the quote, as long as Google Ads takes it.
• Our list of addresses that asked not to receive reminders or review requests: as long as we need it to respect that request.
• Accounts (our team, law firms and partners): while the account is open, and 7 years after it is closed, as the record of who did what.
• Security records: internet addresses up to 12 months; the record of who did what in our systems, 7 years. A coded form of the internet address a request came from is kept with the request, to spot repeats, for as long as the request is kept.
• What our team deletes (a quote, an enquiry, a message, a document or an email, say): kept for 30 days in case it was deleted by mistake, so it can be put back, then deleted for good. Information we erase at your request is never kept this way.
• Backups: daily backups are replaced after 30 days, and other backups are deleted after 90 days, except the latest copy made before a software update, which we keep until the next update.

After these periods we delete or anonymise the information.

Automated calculations and screening

Your quote is calculated automatically from the fee schedule and the answers you give. It does not produce a legal decision about you, and a law firm reviews your matter before confirming any fees. Our screening may hold a request for a member of our team to check; if it blocks one as likely spam, the website tells you straight away and gives you another way to reach us, so that a person can help you instead. When you press go ahead, we may ask you to confirm your email address with a link and code we email you, so that only genuine requests reach a law firm, and we record when you confirmed it.

Your rights

You can ask for a copy of your information, ask us to correct it, delete it, restrict or object to its use, or transfer it to someone else. You can object at any time to our reminders and review requests, and we will stop sending them. Where we rely on consent, you can withdraw it at any time. Use our contact form or email info@key-folio.com; we respond within one month. We may need to confirm your identity first.

Your right to object

Where we rely on our legitimate interests (telling the partner who introduced you how your matter went, answering a partner's introduction, checking requests for spam, counting visits, telling Google Ads which of our advert clicks became quotes, and keeping the website secure), you can object at any time, and we will stop unless we have compelling reasons to continue or need the information for a legal claim. You can object to our follow-ups about a quote and our review requests at any time and we will always stop: use the link in any of those emails, the choice on your quote page, or contact us or email info@key-folio.com.

Complaints

You have the right to complain to us if you think we have not handled your personal information properly. Use our complaints form. We acknowledge your complaint by email straight away, and always within 30 days, look into it, keep you updated and tell you the outcome without undue delay. You can also complain to the Information Commission, the UK's data protection regulator (still known as the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies

We count visits to the website ourselves, on the Cloudflare service that runs it for us, without cookies, and without tracking scripts or analytics from other companies, and you can object to being counted. We use a cookie to remember your quote or the partner who referred you only if you choose that. See our cookie notice.

Changes to this notice

We update this notice when what we do changes. The date at the top shows when it last changed.