GDPR Data Protection Statement — CABO Property Operations

1. Data Processing Principles

We process personal data lawfully, fairly and transparently. Data is collected for specified, explicit and legitimate purposes, kept accurate and up to date, and held only for as long as necessary.

2. Lawful Basis for Processing

Consent — when you submit an enquiry or sign up to receive communications.
Contract — when we deliver services under an engagement letter.
Legal obligation — to comply with HMRC, health & safety and other statutory duties.
Legitimate interests — to operate, secure and improve our services.

3. Data Security

We use technical and organisational measures including encrypted transport (TLS), access controls and secure cloud hosting to protect personal data against unauthorised access, alteration or loss.

4. Data Retention

Enquiry records are retained for up to 24 months. Client and financial records are retained for the duration of engagement plus 7 years to satisfy statutory and HMRC requirements.

5. Your Rights

Right of access to your personal data.
Right to rectification of inaccurate data.
Right to erasure ("right to be forgotten").
Right to restrict or object to processing.
Right to data portability.
Right to withdraw consent at any time.

6. Subject Access Requests

You may submit a Subject Access Request to receive a copy of the personal data we hold about you. We will respond within one month of receipt.

7. Data Deletion Requests

You may request deletion of your personal data. We will action requests promptly subject to overriding legal or contractual obligations to retain certain records.

8. Contact

Send all data protection enquiries and requests to hello@cabopropertyoperations.co.uk.