To sell or rent a property you collect some of the most sensitive data there is: ID cards, payslips, bank details, family situations. Most agencies gather it over WhatsApp and personal email and store it on shared drives — convenient, and a textbook GDPR breach waiting to happen.
The reality
None of this is malicious — it's just how the work flows. But each one is a real GDPR gap a buyer, a competitor or a disgruntled ex-employee can report.
Buyers send ID cards, payslips and bank details by WhatsApp. They land on a personal phone, in cloud chat backups, with no encryption, access control or deletion.
Contracts and identity documents live in a personal Gmail/Outlook account shared by the whole office — searchable, forwardable, never deleted.
A single Google Drive or Excel with every client, owner and prospect, accessible to all staff and freelance collaborators with no access levels.
Old enquiries get added to newsletters and WhatsApp broadcast lists without a valid legal basis or a way to opt out — a classic complaint trigger.
Expired mandates, failed buyers and years-old leads sit in the CRM and inbox indefinitely — data you no longer need but are still responsible for.
Client data is passed to portals, mortgage brokers, notaries and CRMs with no data-processing agreement and no idea where it's stored.
It only takes one. A lost phone, a forwarded email, a buyer who asks "what data do you hold on me and why?" — any of these can turn into a complaint to the data protection authority. The fix is far cheaper than the incident.
The fix
We don't hand you a policy and leave. We change how data actually flows through your agency, with tools your team will actually use.
A simple, encrypted way for clients to send IDs and documents — replacing WhatsApp and personal email — that your staff and clients find easier, not harder.
Client data encrypted and organised with proper access levels: who can see what, with audit logs — no more one-drive-for-everyone.
The right legal basis mapped to each flow (mandate, AML, marketing) and a clean, documented consent and opt-out for newsletters and listings alerts.
A retention schedule for mandates, leads and AML records — with automated clean-up so you stop holding data you no longer need.
Data-processing agreements and storage checks for your portals, CRM, email and cloud tools — so your supply chain is covered too.
A short, practical staff briefing and a simple breach procedure (including "I lost my phone"), plus the records an authority will ask for.
How we work
We follow a real deal end-to-end: where the ID, the payslip and the contract go, and on which device or tool.
We flag the non-compliant flows and the concrete risks — prioritised, in plain language, not a 90-page report.
We set up secure intake, encryption, consent, retention and the DPAs — and migrate you off WhatsApp and shared inboxes.
A short team briefing, a breach plan and the records of processing — so it stays compliant day to day.
FAQ
The questions agencies ask us most.
Tell us how you take in client documents today. We'll show you the gaps and the fix — response within 4 working hours, no commitment.
EN
IT
ES