Last updated: 15 August 2026
CardiffRooms is operated by Imperial Property Cardiff Limited.
Imperial Property Cardiff Limited
164a Richmond Road
Cardiff
CF24 3BX
United Kingdom
Website: www.cardiffrooms.com
Email: tom@cardiffrooms.com
Telephone: 02920 303040
For the purposes of UK data protection law, Imperial Property Cardiff Limited is the data controller for personal information collected through CardiffRooms and the services described in this privacy policy.
This policy explains how we collect, use, store and share personal information when you use our website, enquire about a property, arrange a viewing, communicate with us, apply for accommodation or otherwise use our services.
The information we collect depends on how you interact with us.
It may include:
Where necessary for a tenancy, application or property-management service, we may collect additional information required to assess an application, administer a tenancy, meet legal requirements or provide property-management services.
When you enquire about a property, we may collect information such as your:
We use this information to respond to your enquiry, recommend suitable properties, arrange viewings and progress an application where requested.
Information may be recorded in our property-management, booking and customer-management systems.
When you arrange a viewing, we may process information including:
We use this information to organise and administer property viewings.
Our booking systems may communicate with our internal diary, property-management systems and staff calendars so that appointments remain synchronised.
We use the WhatsApp Business Platform, provided by Meta, to communicate with customers and prospective tenants.
Where you provide a mobile number or communicate with us through WhatsApp, we may use WhatsApp to send messages such as:
When you communicate with us through WhatsApp, information processed may include:
WhatsApp and Meta also process certain information in accordance with their own privacy policies.
Some CardiffRooms communications may include interactive options allowing you to perform actions such as:
Where you choose one of these options, our systems may automatically update the relevant booking.
For example, if you cancel your attendance, our system may remove you from the viewing. Where you are the only person booked onto that appointment, the appointment itself may also be cancelled.
Automated actions are used to carry out instructions that you have actively selected.
Where an automated action cannot safely be completed, it may instead be referred to a member of staff.
Where a property is currently occupied, we may process the contact details of current tenants in order to provide appropriate notice of access or scheduled viewings.
This may include notification by:
Information used for this purpose may include the property concerned, expected access date and the relevant access time window.
We only use this information where reasonably necessary to arrange property access and manage our obligations to tenants.
We use email to communicate with applicants, tenants, landlords, contractors and other people involved in our services.
Emails may include:
Our email systems may be provided through Google Workspace/Gmail and associated services.
Emails may also be processed by website email-delivery systems used to ensure that messages sent through CardiffRooms are delivered correctly.
We use specialist property-management software, including AgentOS, to manage information relating to properties, enquiries, applicants, tenancies, landlords, tenants and property-management activities.
Information entered through CardiffRooms or provided to our staff may therefore be recorded or synchronised with AgentOS where necessary to deliver our services.
We use Google services for certain operational functions.
These may include:
For example, a property viewing may be synchronised between our booking system, AgentOS and a staff member’s Google Calendar.
Google processes information in accordance with its own privacy terms and contractual arrangements with its customers.
Where you submit information through a form on CardiffRooms, we process the information you enter so that we can respond to or act upon your request.
Our website may use WordPress form technology, including systems such as WPForms, to collect and route these submissions.
Depending on the form, this may include:
CardiffRooms is operated using WordPress and associated website technologies.
When you visit the website, certain technical information may automatically be collected, including:
This information may be used to operate, secure and improve the website.
Our website may use cookies and similar technologies.
Cookies may be used to:
Where required by law, non-essential cookies will only be used after obtaining appropriate consent.
You can also control cookies through your browser settings.
We may use analytics, search-engine, advertising or marketing technologies to understand how people find and use CardiffRooms.
Where these technologies involve cookies or similar identifiers, they will be handled in accordance with applicable cookie and privacy requirements.
Information may be used to understand matters such as:
We do not sell personal information.
We may use artificial intelligence and automated systems to assist with certain business activities.
These may include:
Where AI is used, we aim to limit the personal information supplied to what is reasonably necessary for the relevant task.
Important decisions relating to tenancies or individuals are not intended to be made solely by an AI system where human review is appropriate or required.
As part of running a property and lettings business, we may process personal information relating to:
The information collected will depend on the nature of our relationship with that person.
We use the information where necessary to provide our services, fulfil contractual obligations, manage properties, arrange maintenance, administer tenancies and comply with legal requirements.
Where payments are required, payments may be processed using third-party payment providers, banking providers or accounting systems.
We generally do not need to store full payment-card details ourselves where a specialist payment provider processes the transaction.
Financial records may be retained where required for accounting, taxation, tenancy administration, deposit management or legal purposes.
Where relevant, we may process information relating to tenancy deposits and deposit-return or dispute processes.
This may include:
This information may be shared with tenancy deposit protection or dispute-resolution services where necessary.
Where you report a maintenance issue or where works are required at a property, we may share information with an appropriate contractor.
This may include information such as:
We only provide information reasonably required for the contractor to perform the work.
We may share personal information with organisations that help us provide our services.
Depending on the circumstances, these may include:
We only disclose information where there is an appropriate reason to do so.
Under UK data protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on:
Where processing is necessary to enter into or perform a contract with you.
For example, administering a tenancy or progressing an application.
Where processing is necessary for the legitimate operation of our property and lettings business and those interests are not overridden by your rights.
For example:
Where we are required to process or retain information to comply with a legal obligation.
Where we specifically ask you to consent to a particular use of your information.
Where processing relies on consent, you may withdraw that consent.
We do not intend to keep personal information longer than necessary.
Retention periods depend on the nature of the information and why it was collected.
For example:
Information that is no longer required will be deleted, anonymised or securely disposed of where appropriate.
We take reasonable technical and organisational measures to protect personal information.
These measures may include:
No internet-based system can be guaranteed to be completely secure, but we take reasonable steps to reduce the risk of unauthorised access, loss or misuse.
Some of the technology providers we use operate internationally.
As a result, personal information may sometimes be processed outside the United Kingdom.
Where this happens, we expect appropriate safeguards to be used in accordance with applicable UK data-protection law.
These safeguards may include adequacy regulations, approved contractual protections or other lawful transfer mechanisms.
Depending on the circumstances, UK data-protection law may give you the right to:
These rights are subject to certain legal exceptions.
To exercise a data-protection right, contact:
We may need to verify your identity before acting on a request.
You may ask us to delete personal information that we hold about you where you have a legal right to do so.
To request deletion, email:
Please use the subject:
Data Deletion Request
Include enough information for us to identify the records concerned, such as your name, email address and mobile number.
We may retain information where required for legal, contractual, financial, regulatory or dispute-resolution purposes.
If you have communicated with CardiffRooms through WhatsApp and would like us to delete information associated with those communications, you can make a deletion request using the contact details above.
Where possible and legally permitted, we will remove the relevant information from systems under our control.
Deletion from our systems does not necessarily result in deletion of information independently held by Meta, WhatsApp or another service provider. You should refer to the relevant provider’s privacy policy for information about data held by them.
Our website may contain links to other websites.
We are not responsible for the privacy practices of websites operated by third parties.
You should review the privacy information provided by those organisations before submitting personal information to them.
Our services are not specifically directed at children.
Where information relating to a person under 18 is required in connection with a tenancy or accommodation arrangement, it will be handled only where there is an appropriate lawful reason to do so.
If you have concerns about how we use your personal information, please contact us first so that we can investigate.
You also have the right to complain to the UK’s data-protection regulator:
Information Commissioner’s Office (ICO)
The ICO provides information about making a complaint at ico.org.uk.
We may update this privacy policy where our services, systems or legal obligations change.
The latest version will be published on this website and the date at the top of this page will be updated.
An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service Privacy Policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.