Privacy Notice

Version 2.0. Effective 27/07/2026 . We review this notice at least once a year. This version replaces all previous versions.

This notice explains, in plain English, how Knight Knox Ltd (“Knight Knox”, “we”, “us”) collects, uses, shares and protects your personal data when you visit knightknox.com or our landing pages, make an enquiry, come to an event or webinar, or deal with us in any other way. In legal terms we are the data controller for the processing described here.

Knight Knox sells UK property investments to buyers in the UK and around the world. Wherever you are, we are governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for our electronic marketing, the Privacy and Electronic Communications Regulations 2003 (PECR). If you are in the European Economic Area (EEA) or a resident of certain US states, some additional rights may apply, and we explain these in sections 10 and 12.

1. Who we are and how to reach us

2. The information we collect about you

What we hold depends on how you deal with us. It may include:

• Who you are and how to contact you: name, email address, phone number, postal address, and country or region.
• What you are looking for: your investment preferences, such as property type, location and budget, and what you tell us in your enquiries.
• Our conversations and dealings: emails, calls, SMS and WhatsApp messages, live chat transcripts, event and webinar sign-ups, your marketing preferences, and the campaign or website that brought you to us.
• Purchase and identity checks: if you go ahead with a purchase, this covers contract records, limited billing details (payments are handled by PCI-compliant processors, and we never store your full card number) and the identity and anti-money-laundering checks the law requires us to run.
• How you use our website: your IP address, device and browser type, the pages you visit and when, and your approximate location, collected through cookies and similar technologies (see section 6).

We do not set out to collect sensitive information such as health or ethnicity details, so please avoid putting it in free-text boxes.

Most of this comes straight from you or from your use of our websites. Sometimes it reaches us through property portals and partners, for example if you enquire about one of our developments on a portal such as Rightmove, and occasionally from publicly available sources. If your details reach us through someone else, our first message will tell you where we got them from. We contact you on our own lawful basis, not on the back of any consent you gave the portal.

3. How we use your information, and why we are allowed to

Where we rely on legitimate interests, we weigh our interests against your rights, and you can object at any time (see section 10). Just ask if you would like a summary of any of those assessments. We may also fully anonymise data so it can no longer identify you, and use that information freely.

4. Marketing and your choices

We would love to keep you posted about property launches, news and events, but only in the ways you choose. This is separate from replying to your enquiries.

• Separate choice per channel. When you fill in one of our forms you can say yes to email, SMS, WhatsApp and phone contact separately. Sending us an enquiry is not agreement to marketing, and we will not add you to our newsletter unless you ask us to.
• Existing customers (“soft opt-in”). If you have bought a property through us, or been in negotiations to do so, the law (regulation 22(3) PECR) lets us contact you by email, SMS or WhatsApp about similar opportunities. You will always get a clear chance to say no, both when we first collect your details and in every message we send.
• Opting out of marketing. Every marketing email has an unsubscribe link, and every SMS or WhatsApp message tells you how to stop (for example by replying STOP). Opting out of marketing stops the promotional messages. It does not stop us replying to an enquiry you have made, or contacting you about a purchase in progress.
• Asking us not to contact you at all. If you would prefer we did not contact you for any reason, just tell us using the details in section 1 and we will honour that.
• Our records. We keep a record of when, how and on what wording you said yes or no, so we can respect your choice and show that we have.

5. Who we share your information with

• Companies that provide services to us: hosting, CRM and marketing platforms, analytics, communications, payment processing, identity verification and professional advisers. They only act on our instructions, under written contracts that meet Article 28 UK GDPR. Our current providers include: 3CX, Adobe, Amazon Web Services, Barracuda, Cloudflare, DocuSign, Exclaimer, FreshService, Global Relay, Google, HotJar, Meta, Microsoft, Salesforce (including Pardot), SendGrid, SmartSearch, Tawk.to, TextMagic, Trustpilot, WordPress and Zapier.
• Developers, sales agents and solicitors involved in a specific opportunity or purchase you pursue. We will make this clear at the point your details are passed on.
• Regulators, law enforcement and courts where the law requires it, or to protect rights, property or safety.
• A buyer of our business if we are ever reorganised, merged or sold, under appropriate confidentiality protections.

One thing we never do is sell your personal data for money. Please note that some US state laws treat the use of advertising cookies as a “sale” or “share”; section 6 and section 12 explain how you can opt out of those.

6. Cookies

Our websites use strictly necessary cookies, which are always active, plus preference, analytics and advertising cookies that only run with your consent. You can accept, reject or customise the optional ones through the banner when you first visit, and change your mind at any time via the Cookie Settings link in the site footer, where the cookies we use and their lifetimes are listed (typically between 1 day and 24 months). Full details are in our separate Cookie Policy.

7. When your information leaves the UK

We are a UK business and keep data mainly in the UK and Europe. Some of the providers in section 5 process data elsewhere, including the United States. Whenever your data leaves the UK, we make sure one of the legally recognised safeguards is in place: an adequacy decision by the UK Government; the UK-US Data Bridge for certified US recipients; or the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, backed where appropriate by a transfer risk assessment. You can ask us for a copy of the relevant safeguard using the details in section 1. The Dubai website at knightknox.ae is operated separately, and we do not share your personal data with it.

8. How long we keep your information

We keep your information only as long as we genuinely need it, then delete or anonymise it. Archiving data still counts as keeping it, so archived data is deleted on the same timescales. Our standard periods are:

9. Keeping your information safe

We protect your information with appropriate technical and organisational measures, including access controls, encryption in transit, staff training and checks on our suppliers. If a data breach ever puts your rights and freedoms at risk, we will notify the ICO within 72 hours and, if the risk to you is high, tell you directly.

10. Your rights

The UK GDPR gives you real control over your information. You have the right to:

• ask for a copy of the personal data we hold about you (a subject access request);
• have inaccurate data corrected and incomplete data completed;
• have your data erased in certain circumstances;
• restrict our processing in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing. If you object to marketing, that is absolute and we will always stop;
• take the information you gave us to another provider (data portability), where we process it by automated means based on consent or contract;
• change your mind and withdraw consent at any time, without affecting anything already done;
• not be subject to purely automated decisions with legal or similarly significant effects. For the record, we do not make decisions like that.

To use any of these rights, just contact us using the details in section 1. It is free. We may need to check your identity first, and you can authorise someone else to act for you. We will respond within one month; for complex requests we can take up to two further months, and we will tell you if we need to.

11. If something goes wrong: complaints

If you are unhappy with how we have handled your personal data, please tell us first. You have a legal right to complain directly to us under section 164A of the Data Protection Act 2018, and we take every complaint seriously.

• How: email [email protected], call +44 161 772 1370, or write to the Data Protection Lead at the address in section 1. You do not need any special form or wording; just tell us what has gone wrong.
• What happens: we will acknowledge your complaint within 30 days, look into it without undue delay, keep you posted, and tell you the outcome. We keep records of complaints and how we handled them.

You can also go to the UK regulator at any time, whether or not you have raised it with us first:

Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. ico.org.uk/make-a-complaint

12. If you are in the EEA or the United States

Individuals in the EEA

Because we sell to buyers in the EEA, the EU GDPR may apply to that processing. If so, you have rights equivalent to those in section 10 and can complain to your local supervisory authority.

US state residents

Where US state privacy laws apply to our processing (for example in California, Colorado, Connecticut, Virginia, Utah or Texas), you may have the right to know about, access, delete and correct your personal information, and to opt out of “sale”, “sharing” or targeted advertising. Where a law gives a right to appeal a refused request, we will explain how in our response. We will not treat you differently for exercising your rights.

To exercise any of these rights, or to opt out of “sale” or “share” for targeted advertising, contact us at [email protected] or turn off Advertising cookies in Cookie Settings. Where the law requires it, we also treat a valid Global Privacy Control (GPC) browser signal as an opt-out.

13. When we update this notice

We review this notice at least once a year, and whenever the way we use data changes. The version number and effective date at the top are the single record of which version is current. If we make significant changes we will post the updated notice here and, where it matters, tell you directly.