Privacy Policy

The Sourcing Vault Limited ("TSV", "we", "us", "our") is registered in England and Wales under company number 16443781, with its registered office at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF.

We operate The Sourcing Vault platform, a property deal marketplace connecting property deal sourcers (Vault Members) with property investors. We are the Data Controller for the personal data we collect via our platform and website.

We are registered with the Information Commissioner's Office (ICO) as a data controller. You can contact us regarding any data protection matter at: info@thesourcingvault.co.uk.

We have not formally appointed a Data Protection Officer (DPO) as we are not legally required to do so under Article 37 UK GDPR. Our data protection contact for all enquiries is reachable at the email address above.

We collect the following categories of personal data, depending on how you interact with us:

Identity data — Full name, date of birth, copies of identity documents (passport or driving licence) for AML/KYC verification.

Contact data — Email address, phone number, postal address.

Financial data — Bank account details (for refunds or payments), payment card information (processed by our payment provider), information about your financial position relevant to a property transaction.

Transaction data — Details of property opportunities you have enquired about, reserved, or purchased, including Sourcing Fee payments, Deposit payments, and Memos of Sale.

Platform usage data — Login activity, pages visited, features accessed, and interactions with the platform.

Communications data — Records of correspondence between you and TSV, including emails, messages, and notes from calls.

AML/KYC data — Identity verification records, source of funds information, and records required under the Money Laundering Regulations 2017, where applicable.

Marketing preferences — Whether you have opted in or out of marketing communications.

Technical data — IP address, browser type, device information, cookies and similar technologies.

We collect personal data directly from you (via registration forms, enquiries, and correspondence), from Deal Sourcers and Vendors in connection with a property transaction, and from third parties such as identity verification providers or other third parties in connection with a property transaction.

Under the UK GDPR, we must have a lawful basis for processing your personal data. We process your data for the following purposes:

To provide our services — Processing your registration, managing your account, facilitating property introductions, issuing Memos of Sale, and progressing transactions. Lawful basis: Contract (Article 6(1)(b)).

To comply with legal obligations — Conducting AML/KYC checks, retaining records required by law, and responding to lawful requests from authorities. Lawful basis: Legal obligation (Article 6(1)(c)).

To protect legitimate interests — Preventing fraud, securing our platform, managing complaints, and improving our services. Lawful basis: Legitimate interests (Article 6(1)(f)).

Marketing — Sending you information about new deals, platform updates, or relevant services, where you have consented or where permitted under the soft opt-in rules for existing clients. Lawful basis: Consent or legitimate interests.

Where we rely on legitimate interests as our lawful basis, we have carried out a balancing test and are satisfied that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests — see Section 8 for details.

We do not sell your personal data to any third party. We share your personal data only in the following circumstances:

Deal Sourcers (Vault Members): Where you enquire about or proceed with a property opportunity, we will share your contact and relevant identity data with the Deal Sourcer responsible for that listing, to the extent necessary to facilitate the transaction.

Vendors and their representatives: Where relevant, your contact details may be shared with property vendors or their solicitors to progress a transaction you are involved in.

Platform and technology providers: Our CRM and platform infrastructure provider processes personal data on our behalf as a data processor under a Data Processing Agreement incorporating Standard Contractual Clauses.

AML and identity verification providers: We use approved third-party providers to conduct identity and anti-money laundering checks as required by the Money Laundering Regulations 2017.

Payment processors: Payment data is processed by our payment provider(s) for the purpose of collecting subscription fees and sourcing fee payments.

Professional advisers: We may share data with our solicitors, accountants, or insurers on a confidential basis where necessary.

Third-party service providers we introduce to you: Where you agree to be introduced to a third party (such as a mortgage broker or solicitor), we will share your contact details with them for that introduction. You are under no obligation to proceed.

Regulatory or legal authorities: We may disclose data where required to do so by law, court order, or regulatory authority, including the ICO, HMRC, or law enforcement agencies.

All third-party data processors with whom we share personal data are required to handle it in accordance with applicable UK data protection law and are bound by appropriate contractual safeguards.

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law:

Account and registration data — Duration of account + 6 years after closure (Limitation Act 1980).

AML / KYC verification records — 5 years from end of business relationship (Money Laundering Regulations 2017, Reg. 40).

Transaction and payment records — 6 years from date of transaction (HMRC record-keeping requirements).

Deal enquiry and correspondence records — 6 years from date of last interaction.

Investor property purchase records — 6 years from completion or last activity.

Complaints records — 6 years from resolution.

Marketing consent records — Duration of consent + 3 years after withdrawal.

Platform usage and technical logs — Up to 12 months.

Where data is no longer required, we will securely delete or anonymise it. If there is a specific legal claim or regulatory investigation involving your data, we may retain it for longer than the standard periods above.

The Sourcing Vault Limited is based in England and Wales. Your personal data is processed primarily within the UK. However, we use a number of third-party software platforms to operate our business, some of which are based in the United States or other countries outside the UK.

Where personal data is transferred outside the UK, we ensure that each transfer is protected by at least one of the following lawful safeguards: the UK International Data Transfer Addendum (UK IDTA), the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), or Standard Contractual Clauses with UK Addendum.

All third-party processors are bound by Data Processing Agreements. We take reasonable steps to verify that each processor maintains current certification or contractual commitments. You may request further information about any of our transfer arrangements by contacting us at info@thesourcingvault.co.uk.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

• —Encryption of personal data in transit and at rest
• —Access controls and role-based permissions restricting access to authorised personnel only
• —Secure login and authentication protocols for platform access
• —Regular review of our data protection practices and security procedures
• —Data Processing Agreements with all third-party processors

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with our obligations under Article 34 UK GDPR.

Under the UK GDPR and Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access (Art. 15) — You can request a copy of the personal data we hold about you (a Subject Access Request).

Right to rectification (Art. 16) — You can ask us to correct inaccurate or incomplete personal data.

Right to erasure (Art. 17) — You can ask us to delete your personal data where there is no longer a lawful reason to retain it. This right is not absolute and may be subject to legal retention obligations.

Right to restrict processing (Art. 18) — You can ask us to pause processing of your data in certain circumstances.

Right to data portability (Art. 20) — Where processing is based on consent or contract, you can request your data in a structured, machine-readable format.

Right to object (Art. 21) — You can object to processing based on legitimate interests or for direct marketing purposes. We must stop processing for direct marketing immediately on receipt of an objection.

Right to withdraw consent (Art. 7) — Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of your rights, please contact us in writing at info@thesourcingvault.co.uk. We will respond to all requests within one calendar month.

Our website uses cookies and similar tracking technologies to improve your experience, analyse usage, and support our marketing activities. Cookies are small text files stored on your device when you visit our website.

We use the following types of cookies: Strictly necessary cookies (essential for the website to function), Performance/analytics cookies (to understand how visitors use our site), and Marketing cookies (to deliver relevant advertisements).

You can control your cookie preferences at any time through our cookie consent banner or your browser settings. Disabling certain cookies may affect the functionality of our website.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email.

The date of the most recent update is shown at the top of this policy. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us at:

The Sourcing Vault Limited · 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF · Email: info@thesourcingvault.co.uk

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time: www.ico.org.uk · 0303 123 1113.