Data Protection

Personal data is stored with reputable hosting providers under data processing agreements. Transaction documents are kept separate from marketing tools, so a newsletter list can never quietly accumulate passport copies.

Backups exist so data survives failure, and they are stored separately from the live systems.

Connections to the site are encrypted, and access to personal data follows roles, so colleagues see only what their work needs. Software is kept up to date, and security fixes are applied by severity, not by convenience.

Forms are protected with rate limits and spam controls, sensitive actions require authentication, and account passwords are stored only as one way hashes.

• Encrypted connections to the website
• Role based access to personal data
• Passwords stored as one way hashes
• Rate limits and spam controls on forms
• Security updates applied promptly

Most data incidents anywhere are human, not technical, so our habits are practical: recognising phishing, verifying payment detail changes by phone on a known number, and never moving client documents through private channels. Colleagues who handle client data are bound by confidentiality obligations.

A standing rule protects the riskiest moment in property: bank details are only ever confirmed through a second channel. If you receive an email changing where to send money, apparently from us, your lawyer or anyone else, call the known number before acting. We repeat this to every client, in writing, early.

Data leaves our systems only for the work: to your appointed lawyer, to a seller or developer once you proceed on a property, and to authorities where filings require it. Each transfer carries the minimum the purpose needs, so a viewing request does not transmit your passport, and a permission application does not transmit your browsing history.

Transfers to North Cyprus, which sits outside the EEA, follow the safeguards described in our GDPR commitment: contractual protections where possible, your explicit informed consent where an authority cannot be contractually bound, and a clear statement to you of what is moving and why.

We keep data only as long as its purpose or a legal obligation requires: enquiry data lapses after twenty four months without contact, transaction records are held for their statutory period of typically seven years, and newsletter data for the life of the subscription. When the referral programme launches, its records will follow the same principle.

Deletion means deletion: removal from live systems promptly, and from backup rotations as those cycles expire. On request, we will tell you exactly which of your records fall due for deletion and when.

If a breach ever posed a risk to your rights, we would notify the supervisory authority within seventy two hours and you without undue delay, telling you plainly what happened, what it means for you, and what we are doing.

Questions about anything on this page go to hello@ordently.com. Security researchers who find a vulnerability on our site are asked to use the same address; we respond quickly and we do not shoot messengers.