External Privacy Notice

Last updated: 18 September 2026

Corelain Ltd respects your privacy and is committed to protecting personal information. This notice explains how we collect, use, disclose and protect personal information, the lawful bases on which we rely, and the rights available to you.

1. Who we are

Corelain Ltd is a company registered in England and Wales under company number 14451716. Our registered office is 3rd Floor, Cardinal House, 20 St Mary’s Parsonage, Manchester, M3 2LY.

For the purposes of UK data protection law, Corelain Ltd is the controller of the personal information described in this notice unless we tell you otherwise.

Questions, rights requests and complaints about personal information should be sent to our Data Protection Lead:

• Email: dataprotection@corelain.com

• Telephone: 0161 820 1121

• Post: Data Protection Lead, Corelain Ltd, 3rd Floor, Cardinal House, 20 St Mary’s Parsonage, Manchester, M3 2LY

2. Who this notice applies to

This notice applies to personal information relating to:

• people who visit or use our website, contact us, request information or submit an enquiry;

• clients, prospective clients and their directors, employees, representatives and professional advisers;

• suppliers, consultants, contractors, agents, business partners and their representatives;

• owners, occupiers, tenants, residents, claimants, witnesses and other people whose information is included in an instruction, property file, inspection record, report, complaint or claim;

• people who attend our events, receive our communications or interact with us through professional networks or social media; and

• people who exercise information rights or make a complaint about our handling of personal information.

Separate privacy information may apply to employees, workers, job applicants and particular projects or services. Where a more specific notice is provided, that notice should be read together with this one.

3. Our role as controller or processor

Corelain will usually act as a controller where we decide why and how personal information is used, including when managing client relationships, exercising professional judgement, maintaining business records, complying with professional or legal duties, and handling complaints or claims.

For some services, we may process personal information only on the documented instructions of a client or another organisation. In those circumstances, that organisation may be the controller and Corelain may act as its processor. The controller’s privacy notice will explain how it uses the information, and Corelain will process it in accordance with the relevant contract and data protection law.

4. Personal information we may collect

Depending on the nature of our relationship and the service concerned, we may collect and use the following categories of personal information:

Identity and contact information. Names, titles, postal addresses, email addresses, telephone numbers, signatures and identifiers.

Business and professional information. Job titles, employers, professional qualifications, roles, business contact details and information about professional or commercial relationships.

Client and instruction information. Information required to prepare proposals, enter into contracts, manage instructions, provide consultancy or surveying services, communicate with relevant parties and maintain a professional file.

Property, inspection and case information. Addresses, ownership or occupation information, photographs, video, plans, measurements, survey observations, defect information, correspondence, witness accounts, allegations, expert material and other information relating to a property, project, dispute, complaint or claim.

Financial and transaction information. Billing details, purchase orders, payment records, bank details where required, tax information and information needed for credit control or fraud prevention.

Communications and records. Emails, letters, meeting notes, telephone notes, file notes, recordings where notified, feedback and complaint records.

Website and technical information. Internet protocol address, browser and device information, pages viewed, referral information, cookie identifiers, security logs and information generated through use of our website or systems.

Marketing preferences. Your preferences about receiving updates, invitations and other communications from us.

Special category information. Where relevant to an instruction, complaint or claim, this may include information about health, disability, vulnerability, race or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.

Criminal offence information. Where relevant and lawful, this may include information about alleged or proven offences, investigations, convictions, sanctions or related proceedings.

We seek to collect only the information reasonably necessary for the relevant purpose. Please avoid sending unnecessary sensitive or confidential information through general website forms or ordinary email. Contact us first if secure transmission arrangements may be required.

5. How we obtain personal information

We may obtain personal information:

• directly from you, including through our website, email, telephone, meetings, inspections, forms and contracts;

• from a client, prospective client, employer, landlord, managing agent, insurer, solicitor, consultant, contractor or other person involved in an instruction;

• from public authorities, regulators, courts, tribunals, professional bodies and publicly accessible registers or records;

• from property, planning, land, corporate and other information services;

• from our website, communications systems, security systems and service providers; and

• from professional networks, events, referrals and publicly available sources, where lawful and appropriate.

Where we receive your information from another person, we may provide privacy information directly to you unless the law permits an exception, it would involve disproportionate effort, or you already have the relevant information.

6. How and why we use personal information

Enquiries, proposals and onboarding

We use personal information to respond to enquiries, understand requirements, prepare proposals, carry out conflict and risk checks, agree terms and take steps requested before a contract is entered into. We rely on steps necessary before entering into a contract, performance of a contract and our legitimate interests in developing and administering our business.

Providing professional and consultancy services

We use personal information to manage instructions, communicate with relevant parties, arrange and carry out inspections, review documents, undertake analysis, prepare reports, give advice, manage projects and deliver agreed services. We rely on performance of a contract, compliance with legal and professional obligations, and our legitimate interests in providing, documenting and improving professional services.

Property, dispute, complaint and claim-related work

We may use information about owners, occupiers, tenants, residents, witnesses, claimants and other third parties where this is necessary to investigate facts, inspect property, assess evidence, prepare professional opinions, manage disputes, respond to complaints, cooperate with insurers or advisers, and establish, exercise or defend legal claims. We rely on contractual necessity where applicable, legal obligations and our legitimate interests in carrying out properly instructed work and protecting legal and professional interests.

Business administration and finance

We use personal information to manage client and supplier relationships, maintain records, issue and pay invoices, recover debts, administer insurance, obtain professional advice, carry out audits and manage business continuity. We rely on contractual necessity, legal obligations and our legitimate interests in operating and protecting our business.

Legal, regulatory and professional compliance

We use personal information to comply with law, court orders, regulatory and professional requirements, anti-fraud and anti-money-laundering controls where applicable, sanctions checks, tax obligations, record-keeping duties, information rights and cooperation with regulators or law enforcement. We rely on legal obligations and, where appropriate, our legitimate interests in protecting Corelain, our clients and others from unlawful or improper conduct.

Security and service improvement

We use personal information to protect our premises, people, systems and information; detect or investigate misuse or security incidents; test and maintain systems; monitor quality; and improve our services and procedures. We rely on legal obligations where applicable and our legitimate interests in maintaining secure, effective and reliable operations.

Marketing and professional relationships

We may use business contact information to send relevant updates, event invitations or information about our services. We rely on consent where required and otherwise on our legitimate interests in maintaining professional relationships and promoting relevant services. Electronic marketing is also carried out in accordance with the Privacy and Electronic Communications Regulations. You may opt out at any time by using the unsubscribe method provided or contacting dataprotection@corelain.com.

Website operation and analytics

We use technical information to operate, secure, troubleshoot and improve our website, understand how it is used and measure the effectiveness of our communications. We rely on our legitimate interests for essential security and administration, and on consent where the law requires consent for cookies or similar technologies. Further information is set out in our Cookie Policy.

7. Artificial intelligence and automated tools

Corelain may use approved artificial-intelligence-enabled systems and other automated tools to support defined administrative, research, document-review, summarisation, analytical, quality-assurance and drafting activities. We apply the same data protection principles and lawful bases to information processed through those systems as we do to other processing.

AI-generated material is not treated as a substitute for professional judgement. Where an AI output has a material impact on the delivery of a surveying service, it will be subject to appropriate human review and responsibility by, or under the supervision of, an appropriately qualified and named professional.

Where the use of AI will have a material impact on the delivery of a surveying service, Corelain will provide the client with written information in advance through the terms of engagement, service agreement or other relevant documentation. That information will explain, as applicable:

• when and for what purpose AI will be used;

• the parts of the service-delivery process in which AI will be involved;

• the extent of relevant professional indemnity cover, where that information is available;

• how the client can question or contest the proposed use;

• how the client may seek redress if negatively affected; and

• whether, and how, the client may opt out of that use.

Corelain will not upload private or confidential information to an AI system unless it has obtained express written consent in advance from the affected stakeholders and has taken reasonable steps to satisfy itself that the proposed upload does not present an unacceptable risk. Where appropriate, we will minimise, redact, pseudonymise or anonymise information before use.

This general privacy notice does not itself constitute consent to a particular use of AI. Where consent, acknowledgement or agreement is required, Corelain will obtain it separately in writing before the relevant use or disclosure. The data protection lawful basis for the underlying processing will also be identified and documented separately.

Where a client or affected person requests further information about a material use of AI, Corelain will provide appropriate information about the type of system, its basic operation and limitations, relevant due diligence and risk controls, and the assessment of the reliability of the output, subject to legal, confidentiality, security and intellectual-property restrictions.

Further information is available in Corelain’s Responsible Use of Artificial Intelligence Statement.

8. Special category and criminal offence information

We process special category information or criminal offence information only where it is necessary, proportionate and lawful. In addition to an Article 6 lawful basis, we identify an applicable condition under Article 9 or Article 10 of the UK GDPR and the Data Protection Act 2018 where required.

Depending on the circumstances, this may include explicit consent, processing necessary for the establishment, exercise or defence of legal claims, or a substantial-public-interest condition supported by law. We apply enhanced access, confidentiality and retention controls to this information.

9. When providing information is necessary

Some personal information is required so that we can respond to an enquiry, enter into or perform a contract, comply with law or professional requirements, verify identity, manage risk, or provide a requested service. Where required information is not provided, we may be unable to accept or continue an instruction, process a request or provide part of a service. We will explain this where relevant.

10. Who we may share personal information with

Where necessary for the purposes described in this notice, we may share personal information with:

• clients, instructing parties and other authorised participants in a project or instruction;

• surveyors, consultants, contractors, experts, agents and other service providers involved in delivering the relevant service;

• IT, website, cloud-hosting, communications, document-management, data-storage, cyber-security and business-support providers;

• banks, payment providers, accountants, auditors, insurers, insurance brokers, solicitors and other professional advisers;

• courts, tribunals, regulators, professional bodies, government departments, local authorities, law-enforcement bodies and other public authorities where disclosure is lawful or required;

• a prospective purchaser, investor or successor in connection with a genuine corporate transaction, reorganisation or transfer of business, subject to appropriate confidentiality protections; and

• other persons where you have authorised the disclosure or where disclosure is otherwise permitted or required by law.

We require service providers that process personal information on our behalf to protect it, act only on authorised instructions and comply with applicable data protection obligations.

11. International transfers

Some service providers may store or access personal information outside the United Kingdom. Where personal information is transferred internationally, we use a lawful transfer mechanism and appropriate safeguards. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another legally recognised safeguard. Further information about relevant safeguards may be requested from dataprotection@corelain.com.

12. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, contractual, professional, insurance, accounting and regulatory requirements.

Retention periods are determined by reference to the nature of the information and instruction, applicable limitation periods, professional indemnity requirements, legal or regulatory duties, the likelihood of a complaint or claim, security needs and whether the information is required to establish, exercise or defend legal rights. Financial and accounting records are generally retained for the applicable statutory period. Marketing information is retained until you opt out or it is no longer reasonably required, although we may keep a limited suppression record to respect an opt-out.

At the end of the relevant retention period, personal information is securely deleted, destroyed or anonymised unless a lawful reason requires further retention.

13. Information security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful access, use, alteration, disclosure, loss or destruction. Measures may include access controls, multifactor authentication, encryption, secure storage, backups, staff training, supplier due diligence, incident-management procedures and periodic review of risks and controls.

No method of internet transmission or electronic storage can be guaranteed to be completely secure. Please contact us before sending particularly sensitive or confidential information if alternative secure arrangements may be appropriate.

14. Cookies and third-party websites

Our website uses cookies and similar technologies. Some are necessary for the website to operate; others may support analytics, functionality or communications. Where consent is required, we will seek it through the website’s consent controls. Further information, including how to change preferences, is available in our Cookie Policy.

Our website may contain links to websites operated by other organisations. Those organisations are responsible for their own privacy practices, and their privacy notices should be reviewed separately.

15. Your data protection rights

Depending on the circumstances, you may have the right to:

• request access to personal information held about you;

• ask us to correct inaccurate or incomplete information;

• ask us to erase information where there is no lawful reason to retain it;

• ask us to restrict how information is used;

• object to processing based on legitimate interests or to direct marketing;

• receive information you provided in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller, where the right to data portability applies;

• withdraw consent at any time where processing is based on consent, without affecting processing already carried out lawfully; and

• seek safeguards and human intervention in relation to any solely automated decision that produces legal or similarly significant effects, where applicable.

These rights are not absolute and may be subject to legal exemptions. We may ask for information to verify identity and clarify a request. We will normally respond within one month, although the law permits an extension for complex or multiple requests. A fee is not normally charged, but the law allows a reasonable fee or refusal in limited circumstances, including where a request is manifestly unfounded or excessive.

To exercise a right, contact dataprotection@corelain.com.

16. Data protection complaints

You may complain to Corelain if you are concerned about how we have used personal information or handled an information-rights request. Please email dataprotection@corelain.com with the subject line “Data Protection Complaint”, or write to the Data Protection Lead at our registered office.

We will take reasonable steps to help you make a complaint, acknowledge a data protection complaint within 30 days and respond without undue delay. We may contact you for further information where this is reasonably required to investigate the matter.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data protection regulator. Information about making a complaint is available at ico.org.uk/make-a-complaint. You are not required to complain to Corelain before contacting the Information Commissioner’s Office, although raising the matter with us first may allow it to be resolved more quickly.

17. Changes to this notice

We may update this notice to reflect changes in our services, systems, suppliers, professional requirements or the law. The latest version will be published on our website with its effective date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people where appropriate.

18. Contact details

Data Protection Lead

Corelain Ltd

3rd Floor, Cardinal House

20 St Mary’s Parsonage

Manchester

M3 2LY

Email: dataprotection@corelain.com

Telephone: 0161 820 1121

‍