PIC Searches Privacy Notice

1. Introduction

Property Information Company Limited, trading as PIC Searches (“PIC Searches“, “we“, “us” or “our“), is committed to protecting personal data and respecting the privacy rights of individuals whose personal data we process.

This Privacy Notice explains how and why we collect, use, disclose, retain and otherwise process personal data in connection with our business, including through our website at www.picsearches.com, our online services and portals, property search and conveyancing-related services, insurance introductions, customer and supplier relationships, and other business activities.

This Notice is intended to satisfy the transparency requirements of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Data (Use and Access) Act 2025 (“DUAA”), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), in each case as amended from time to time.

This Privacy Notice does not form part of any contract with you and does not create contractual rights. We may update it from time to time in accordance with section 24.

2. Who we are and our regulatory status

PIC Searches is a trading name of:

Property Information Company Limited

Company number: 09778810

Registered office: Langley House, 53 Theobald Street, Borehamwood, England, WD6 4RT

For the purposes of UK data protection law, Property Information Company Limited acts as a controller for the great majority of the personal data described in this Privacy Notice. We act as controller wherever we determine why and how personal data is processed for our own business purposes; for example, when producing a property search, conveyancing or insurance-related report using our own systems, methodology and sources; administering customer and portal accounts; invoicing and accounting; preventing fraud; handling complaints or legal claims; and maintaining our own business records. The fact that a customer specifies the property, transaction or individual to which a search or report relates does not, of itself, make us a processor: we remain the controller for that processing because we determine the means by which the search or report is produced.

We act as a processor only in the more limited circumstances where a written contract with a customer expressly designates us as a processor, and we process personal data solely on that customer’s documented instructions without determining the purpose or the essential means of that specific processing; for example, where we host, store or transmit data purely as directed under a data processing agreement, with no discretion of our own over how or why it is used. Where that applies, the customer’s own privacy information and the relevant contractual data-processing terms will also govern that specific processing.

Property Information Company Limited is an Affiliate Member of COPSO (https://www.copso.org.uk/) and is regulated by the Property Codes Compliance Board as a Search Code subscriber and affiliate member.

Property Information Company Limited (FCA firm reference number: 1009795) is an Introducer Appointed Representative of CLS Property Insight Limited (https://www.clsq.com), which is authorised and regulated by the Financial Conduct Authority (https://www.fca.org.uk/) under firm reference number 718255.

Where an insurance product or other regulated service is introduced, arranged or provided through or in connection with our services, the relevant insurer and other regulated or professional organisations may process personal data as separate controllers for their own purposes. Their own privacy notices may therefore also apply.

3. Scope of this Privacy Notice

This Privacy Notice applies to personal data relating to customers and prospective customers; solicitors, licensed conveyancers and other legal or property professionals; clients of our professional customers; buyers, sellers, registered proprietors, occupiers, borrowers, lenders and other individuals connected with a property or property transaction; users of our website, portal and other digital services; individuals who contact us; business contacts; suppliers, contractors and professional advisers; recipients of our marketing communications; complainants and individuals involved in disputes or claims; job applicants; and other individuals whose personal data is provided to us or generated in connection with the provision or administration of our services.

Where a solicitor, conveyancer, other professional adviser or customer provides personal data to us about another individual, that organisation is responsible for ensuring that it has a lawful basis for disclosing that data to us, or that it has told the individual why and how PIC Searches will use their personal data and has that individual’s permission to provide it to us.

4. What is personal data?

“Personal data” means information relating to an identified or identifiable living individual.

It does not include information that has been rendered anonymous in such a manner that the individual is no longer identifiable.

Certain information receives additional protection under data protection law. This includes “special category data”, such as information concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data used for identification, and information concerning a person’s sex life or sexual orientation.

Information relating to criminal convictions and offences is also subject to additional statutory safeguards.

5. Categories of personal data we process

Depending upon the nature of your relationship with us, we may process:

• Identity and contact data, including name, title, job title, organisation, address, email address and telephone number.
• Account and customer data, including registration details, usernames, authentication information, user permissions, customer references, preferences and service history.
• Property, conveyancing and transaction data, including property addresses, title numbers and title information, tenure, matter or client references, details relevant to property searches and reports, information contained in title or property records, and information relating to purchasers, sellers, owners, occupiers, borrowers, lenders or other persons connected with a transaction. Depending on the type of search, this might include some personal data recorded against a property by a water, drainage, electricity, gas or other utility or statutory undertaker, when that data is provided to us (for example on a copy utility bill or account reference) in order to identify the correct account or property to search against.
• Insurance and regulated-services data, where necessary to make an introduction, obtain information or quotations, facilitate a requested service, communicate with insurers or other related providers, maintain regulatory records, or deal with enquiries, complaints or claims.
• Billing and payment data, including billing details, invoices, payment status and transaction references.
• Communications and customer-service data, including correspondence, emails, telephone records or notes, web form submissions, support requests, complaints and records of instructions.
• Technical, security and usage data, including IP address, browser and device information, login records, access times, pages or functions used, referral information, event data, security alerts and system logs.
• Marketing and preference data, including marketing preferences, consent records, suppression records and engagement with marketing communications.
• Recruitment data, including CVs, qualifications, employment history, application information, interview notes and references.

Special category personal data

We do not ordinarily require special category personal data to provide our core services. Where we process special category or criminal offence data, we will do so only where both a lawful basis under Article 6 UK GDPR and any additional statutory condition required by law are satisfied.

6. How we obtain personal data

We may obtain personal data:

1. Directly from you, for example when you register for an account, place an order, request a service or quotation, contact us, submit a web form, make a complaint, subscribe to marketing or apply for employment.
2. From professional customers and other third parties, including solicitors, licensed conveyancers, law firms, estate agents, mortgage brokers, lenders, other property professionals, CLS Property Insight Limited, insurers, intermediaries, claims-related service providers, water, drainage, electricity, gas and other utility or statutory undertakers, search providers and payment or IT service providers.
3. From public and commercial sources, including HM Land Registry, local authorities, water and drainage undertakers, environmental, planning, mining and property-data providers, Companies House, professional directories and other public records or commercially available data sources.
4. Automatically, through server logs, cookies and other storage or access technologies when you use our website, portal or systems.

7. Personal data obtained indirectly

In the conveyancing and property sector, we occasionally receive personal data from a solicitor, licensed conveyancer or other professional customer, rather than from the individual to whom the information relates.

Where Article 14 UK GDPR applies, we will provide the required privacy information within the period required by law, ordinarily no later than one month after obtaining the personal data, or sooner where we first communicate with the individual or first disclose the personal data.

There are statutory exceptions, including where the individual already has the relevant information or another applicable exemption permits us not to provide it directly.

This Privacy Notice is publicly available so that individuals whose information may be supplied to us indirectly can understand how we process personal data.

8. Purposes of processing and lawful bases

We process personal data only where a lawful basis applies.

On smaller screens, swipe horizontally to view the full table.

Where we rely on legitimate interests, we assess the purpose and necessity of the processing and balance our interests against the individual’s interests, rights and freedoms.

Where we rely upon a recognised legitimate interest under the UK GDPR as amended by the DUAA, we will do so only where the processing falls within a statutory recognised-interest condition.

Where we rely on consent, consent may be withdrawn at any time without affecting processing lawfully carried out before withdrawal.

Withdrawing consent does not affect any other, separate processing of your personal data that is lawfully based on a different basis, such as legitimate interests, where that basis was accurately identified for that processing at the outset. We will not treat legitimate interests as a means of continuing the same processing activity for which consent was the stated basis, after that consent has been withdrawn.

9. Where provision of personal data is required

In some circumstances, personal data is required because it is necessary for us to enter into or perform a contract, fulfil an order or provide a requested service, comply with law or regulation, or establish and administer a customer account.

If information that is necessary for one of those purposes is not provided, we may be unable to open or maintain an account, process an order, provide a search or report, facilitate an insurance introduction, process payment, respond fully to a request, or comply with a legal or regulatory requirement.

10. Property transaction data and our role as controller or processor

Our customers are principally organisations and professionals involved in conveyancing and property transactions. They may therefore provide us with information concerning their clients or other individuals connected with a property transaction.

The test we apply to determine whether we act as a controller or a processor for that information is set out in section 2. In summary, we act as a controller where we determine why and how personal data is used for our own business purposes, including order administration, service delivery, fraud prevention, accounting, compliance, complaint handling, legal claims and business record-keeping; which describes the great majority of our processing. We act as a processor only where a written contract expressly designates us as a processor and we process solely on a customer’s documented instructions, without discretion over the purpose or essential means of that specific processing.

Whether we act as controller or processor is determined by the factual circumstances and applicable law, not solely by contractual terminology.

11. Insurance products and CLS Property Insight Limited

Property Information Company Limited (FCA firm reference number 1009795) is an Introducer Appointed Representative of CLS Property Insight Limited, which is authorised and regulated by the Financial Conduct Authority under firm reference number 718255.

Where your professional adviser requests access to an insurance product or related regulated service through PIC Searches, we may disclose relevant personal data to CLS Property Insight Limited, insurers, insurance intermediaries, underwriting or administration providers, claims handlers or loss adjusters, professional advisers and other organisations involved in providing or supporting the relevant product or service.

Those organisations may process personal data as independent controllers for underwriting, regulatory, administration, fraud prevention, claims, record-keeping and related purposes. Their own privacy notices should be read alongside this Privacy Notice where relevant.

Nothing in this Privacy Notice is intended to describe PIC Searches as directly authorised by the FCA where it acts as an Introducer Appointed Representative.

12. Sharing personal data

Where reasonably necessary and lawful, we may disclose personal data to:

• solicitors, licensed conveyancers and other professional customers;
• parties and professional advisers connected with a property transaction;
• property search and report providers;
• HM Land Registry, local authorities and statutory or utility bodies;
• environmental, planning, mining and other specialist data providers;
• CLS Property Insight Limited, insurers, intermediaries and claims-related providers;
• payment processors, banks and financial service providers;
• IT, hosting, portal, communications, cyber-security, software and support providers;
• analytics and website service providers;
• professional advisers, including solicitors, accountants, auditors and insurers;
• fraud prevention, identity verification or credit-related providers where relevant and lawful;
• regulators, ombudsmen, law enforcement agencies, courts, tribunals and public authorities;
• prospective purchasers, investors or counterparties in connection with a proposed corporate transaction; and
• other persons where you request the disclosure or it is otherwise permitted or required by law.

Processors acting on our behalf are subject to appropriate contractual safeguards and instructions.

We do not sell personal data to any third parties for marketing purposes.

13. International transfers

We use third-party service providers to provide our primary IT infrastructure, including email, intranet services, document storage and collaboration tools. Our principal infrastructure for these purposes is hosted within the European Economic Area (EEA). We select service providers that maintain appropriate technical and organisational security measures, which may include independently certified information security management systems and relevant industry-standard security certifications.

Personal data transferred from the United Kingdom to a separate organisation located outside the United Kingdom may constitute a restricted transfer under UK data protection law. The United Kingdom currently recognises all countries within the EEA as providing an adequate level of protection for personal data under UK adequacy regulations. Accordingly, personal data may be transferred to recipients in those countries without the need for additional international transfer safeguards.

Some of our other service providers, sub-processors or members of their corporate groups may process personal data in, or permit access to personal data from, countries outside the United Kingdom. Where this constitutes a restricted transfer, we will ensure that the transfer is permitted under applicable UK data protection law.

Depending on the circumstances, we may rely on UK adequacy regulations, an appropriate safeguard permitted under Article 46 of the UK GDPR, or an applicable statutory exception. Appropriate safeguards may include the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, binding corporate rules, or another safeguard permitted by applicable law.

Where the law requires us to carry out a data protection test or transfer risk assessment in connection with an appropriate safeguard, we will assess whether the protection provided to personal data following the transfer is not materially lower than the protection available under UK data protection law. Where necessary, we will implement supplementary contractual, technical or organisational measures to provide an appropriate level of protection.

You may contact us for further information about the safeguards applying to a particular category of international transfer and, where applicable and subject to any necessary redactions, to request a copy of the relevant safeguard.

14. Direct marketing

We may use business contact information to provide information about PIC Searches products, services, events, developments or offers that we reasonably believe may be relevant to you or your organisation.

Electronic direct marketing will be undertaken in accordance with PECR and applicable data protection law.

Where consent is required, we will seek valid consent unless a lawful exception applies. Where we rely upon legitimate interests, we will consider the nature of the relationship, the reasonable expectations of the recipient and the potential impact upon the individual.

Different PECR rules may apply depending on whether the recipient is a corporate subscriber or an individual subscriber, including a sole trader or certain partnerships.

You may object to direct marketing at any time by using the unsubscribe mechanism in a communication or contacting info@picsearches.com.

Where you opt out, we may retain the minimum information necessary on a suppression list to ensure that your preference is respected.

An objection to marketing will not prevent service, contractual, transactional, administrative, legal, security or regulatory communications that are not direct marketing.

We do not sell personal data to any third parties for marketing purposes.

15. Cookies and other storage and access technologies

Our website and digital services may use cookies, tags, pixels, scripts, local storage and other technologies that store information on, or obtain information from, a user’s device.

We may use such technologies to operate and secure our website and portal, authenticate users, retain preferences, diagnose faults, measure performance, understand service usage, improve functionality and, where permitted, support advertising or marketing measurement.

Where PECR requires consent, we will not use the relevant non-exempt technology until the required consent has been obtained. Where a statutory exception applies, consent may not be required, but we will provide the transparency and controls required by law.

Specific information concerning the technologies in use, their purposes and available choices should be provided through our cookie notice and consent-management platform.

16. Security of personal data

We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.

Measures may include access controls, authentication, encryption, logging and monitoring, backup and resilience arrangements, security testing, vulnerability and patch management, supplier due diligence, contractual safeguards, staff training, confidentiality obligations and incident-response procedures.

Access to personal data is limited to personnel and service providers who require access for legitimate purposes.

17. Retention of personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, tax, accounting, insurance, contractual, fraud-prevention and dispute-resolution purposes.

In determining retention periods, we consider the nature, amount and sensitivity of the personal data, the purposes of processing, applicable legal and regulatory requirements, limitation periods, contractual and insurance obligations, the risk of harm arising from unauthorised use or disclosure, and whether the purpose can be achieved by other means.

Subject to any specific legal, regulatory or contractual requirement that requires a different period in a particular case, our standard retention periods are as follows:

• Customer, contractual, transaction, order, billing and accounting records: 6 years from the end of the calendar or financial year in which the relevant transaction is completed or the customer relationship ends. This reflects the standard six-year limitation period for contract and tort claims under the Limitation Act 1980, and HMRC’s requirement to retain business records for at least six years.
• Complaint and dispute records: 6 years following closure of the complaint or dispute. Where a complaint, claim, insurance matter or regulatory investigation remains open at the end of that period, we will retain the relevant records until it is finally resolved (including any appeal), plus a further 6 years.
• Unsuccessful recruitment information: 12 months from the end of the relevant recruitment exercise, reflecting the time limits (including any extension for ACAS early conciliation) within which an employment-related claim may ordinarily be brought, unless the candidate asks us to retain their details for longer for future opportunities, or a longer period is otherwise justified.
• Marketing information, including preferences and consent records: retained for as long as the marketing relationship remains active, and reviewed at least every 24 months to confirm it remains relevant, accurate and lawful; records are updated or removed as required by any change of preference.
• Suppression records (opt-outs): retained for as long as necessary to ensure the opt-out continues to be respected, even after other marketing information about the individual has been deleted.
• Technical, website and security logs: ordinarily retained for between 6 and 24 months, depending on the type of log and its operational, security, fraud-prevention or evidential purpose, save where a longer period is required to investigate a specific security incident, fraud, dispute or legal claim.

Irreversibly anonymised information may be retained for longer, as it no longer constitutes personal data.

18. Automated processing and artificial intelligence

We may use software and automated tools to assist with routine processing, document handling, data extraction, security, workflow management and the delivery of property-related services.

Where we refer to “AI” or automated extraction in this context, we mean standard rules-based or programmatic tools; for example structured web-scraping tools, or data retrieved through an application programming interface (API); used to retrieve or extract information that is already published or made available by a public or commercial source, such as HM Land Registry, a local authority or another public register.

This does not mean the use of a generative AI system or large language model (“LLM”) to interpret, summarise or generate content, and we do not currently use generative AI or an LLM to produce the content of a search or property report.

Information obtained through automated extraction of this kind is not inserted directly into a search or property report without being processed through, and validated by, our standard production systems and controls, and it is not used to make, or fed directly into, a decision about an individual or a transaction on an unsupervised basis.

We do not currently make decisions based solely on automated processing which produce legal effects concerning an individual or similarly significantly affect an individual.

If we introduce automated decision-making of that kind, or generative AI or LLM-based processing that involves personal data, we will comply with the applicable requirements of UK data protection law, provide the information and safeguards required by law, and update this Notice accordingly.

19. Your data protection rights

Subject to applicable statutory conditions, restrictions and exemptions, you may have rights to:

• access your personal data and associated information;
• rectify inaccurate or incomplete personal data;
• erase personal data in circumstances prescribed by law;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• object absolutely to direct marketing;
• data portability, where the statutory conditions apply;
• applicable safeguards concerning significant automated decisions; and
• withdraw consent where processing is based on consent.

To exercise a right, contact info@picsearches.com

We may request information reasonably necessary to verify identity, clarify the scope of a request and locate relevant records.

There is ordinarily no fee for exercising a data protection right. A reasonable fee may be charged, or a request refused, only where permitted by law.

20. Data protection complaints

You have the right to raise a complaint with us concerning our processing of your personal data.

Complaints may be submitted by email to info@picsearches.com or by post to:

Compliance Officer – Data Protection Complaint

Property Information Company Limited

Langley House

53 Theobald Street

Borehamwood

England

WD6 4RT

Telephone: 0203 637 3383

Website: www.picsearches.com

We will handle data protection complaints in accordance with applicable law. In particular, we will take appropriate steps to facilitate complaints, acknowledge receipt within 30 days, investigate appropriately, keep the complainant informed where appropriate, and communicate the outcome without undue delay.

We encourage you to contact us in the first instance so that we have an opportunity to investigate and resolve your concerns.

You also have the right to complain to the Information Commissioner’s Office (“ICO“).

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk

A complaint concerning an insurance product or other regulated service may also be subject to a separate regulatory or contractual complaints procedure.

21. Children

Our services are directed exclusively to businesses, professional users and adults engaged in property transactions. We do not knowingly seek to collect personal data directly from children through our website or services.

We may, however, receive personal data relating to children incidentally in the ordinary course of business, including through correspondence, emails, telephone conversations or via other information supplied by customers, employees, professional advisers or other third parties.

Where this occurs, we will take reasonable steps to ensure that such information is limited to what is necessary for the relevant purpose, is not retained for longer than required, and is not disclosed more widely than is reasonably necessary. Where practicable, we will also seek to remove, redact or otherwise minimise identifying information.

22. Third-party websites and independent services

Our website or services may contain links to websites, systems or services operated by third parties.

Where a third party acts as an independent controller, its own privacy notice governs its processing. We are not responsible for the privacy practices of independent third-party controllers merely because our website links to their services.

23. Data protection contact

PIC Searches is not currently required to appoint a statutory Data Protection Officer under applicable data protection legislation. We do not have a dedicated, named Data Protection Officer. Instead, responsibility for data protection compliance is carried out internally by our Compliance Officer or by another appropriately experienced member of staff, according to their relevant area of competence and expertise for the matter concerned, and supported where necessary by external professional advisers.

Questions concerning this Privacy Notice, the exercise of data protection rights, or our processing of personal data should be directed to:

If circumstances change such that the appointment of a statutory Data Protection Officer becomes mandatory, we will make that appointment and publish the relevant contact details in this Privacy Notice, in accordance with applicable law.

24. Changes to this Privacy Notice

We will review this Privacy Notice periodically and update it where necessary to reflect changes in law or regulatory guidance, our services, our use of personal data, our suppliers or technology, our regulatory status or our organisational arrangements.

The current version will be published on our website with an updated review or effective date.

Where we propose a materially different use of personal data, we will provide appropriate additional privacy information before commencing that processing where required by law.

25. Contact and corporate information

Company number: 09778810

Property Information Company Limited (FCA firm reference number 1009795) is an Introducer Appointed Representative of CLS Property Insight Limited, which is authorised and regulated by the Financial Conduct Authority under firm reference number 718255. https://www.clsq.com/privacy-policy