Zoopla - Privacy Notice

We take your privacy seriously. Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also contains details about your data protection rights.

About Us

Zoopla Limited is part of Houseful Limited, a subsidiary of ZPG Limited. Zoopla Limited (Zoopla) a company incorporated and registered in England and Wales. Registered office: The Cooperage, 5 Copper Row, London, England, SE1 2LH (Company Number 06074771). Our Information Commissioner's Office (ICO) registration number is Z9972266. Any reference to Group Companies within this privacy notice includes all or any of the direct or indirect subsidiary undertakings of ZPG Limited.

Part A of this Privacy Notice contains information which applies generally to the Zoopla website, and the products and services offered by Zoopla.

Part B of this Privacy Notice provides more privacy information relating to our products and service-specific offerings, which supplements the information in Part A.

Part A: Framework Privacy Notice

We collect, store, use and share personal data, and are responsible for the personal data we process about you. When we do so, we are subject to UK data protection laws and regulations including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“data protection laws”).

For the purposes of data protection laws and regulations, in most circumstances when you create an account, and submit to, or share, your personal data with us on our websites, applications, platforms and systems, we are the ‘data controller’ of the information provided. This means we decide how and why your personal data is processed.

This privacy notice covers our data processing activity as a ‘data controller’. Where a third party such as an estate agent, lettings agent, new home builder, or other similar Zoopla business customer (Zoopla customer) is instructed or engaged by you, that Zoopla customer will become a ‘data controller’ of your personal data that we may provide to that Zoopla customer or that they provide to us (either directly or via a third party).

Zoopla may act as a ‘data processor’ of any personal data hosted on our websites, applications, platform and systems that is in the control of a Zoopla customer, such as where that Zoopla customer may provide us with processing instructions once you have entered or intend to enter into terms or any agreement with them, so we can assist them in fulfilling the terms of that agreement.

Where Zoopla processes any personal data on the instructions of a Zoopla customer, any queries you may have about that processing, including exercising your data subject rights must be directed to the relevant Zoopla customer. Where we act in response to instructions from a Zoopla customer, their privacy policy and notices will apply.

We may be a ‘joint data controller’ (where we jointly participate in determining the purposes and manner in which your personal data is processed) together with a Zoopla customer or other third party. We may introduce you or be required to share your personal data with another ‘data controller’ for the purpose of providing our products and services, third party products and services you have chosen to use, or to promote offerings to you, where permitted under data protection laws.

When you engage with any other ‘data controller’ introduced or made available to you through use of our or their products or services, you must further read, and where required, agree to their terms and privacy notice. This privacy notice details our responsibilities for when we are a ‘data controller’ or ‘joint data controller’ of your personal data. We also may include details of processing and personal data sharing where we act as a ‘data processor’ to help provide you with transparency on how your data is processed.

This privacy notice applies to personal data that relates to you as an individual, it does not apply to information about or related to properties where the information is about the property itself, nor information about the occupants, owners or other interested parties of that property.

If you have any questions about the property information we display, please contact our customer help team at [email protected]. If you’re selling or letting a property that’s being advertised on our websites or applications, please direct any questions to your agent.

Questions, comments and requests regarding this privacy notice are welcome and should be addressed to [email protected] or via our postal address above. Please mark your letter: 'Houseful Ltd: Data Protection Officer'.

Key Terms

It would be helpful to start by explaining some key terms used in this Privacy Notice.

Personal data we collect about you

The personal data we collect about you depends on how you interact with our websites, apps and different products and services. To use your personal data, we must have a valid reason (a "lawful basis"). For example, sometimes we ask for your consent (for example to use certain cookies) and in other cases where you would expect us to use your personal data (for example to provide the product or service you choose to use), then we do not need to ask for consent, and can rely on another lawful reason. Data protection law provides other bases and exemptions for the processing of personal data, and requires us to have an additional reason to process data which is given special protection under data protection laws, such as special category and criminal conviction data, where relevant. For example we will usually ask for explicit consent when processing health data or biometric data. We will only ever process your personal data where we have a lawful reason to do so. Our reason for using your personal data is usually one of the following:

Contract

This is where we need to use your personal data to carry out a contract you are party to or take steps before you enter a contract. When you choose to use a product or service you will need to agree to terms of use which constitutes a contract. We need to process your personal data to provide you with this product or service.

Consent

You have given us, or a party we act jointly with, your consent to use your personal data for a certain reason. We may rely on your consent to send you certain types of electronic mail marketing. See Right to withdraw consent for more information about how you can exercise your data subject rights.

Legal Obligation

We must use your personal data to comply with laws or regulations to which we or a party we act jointly with are subject to.

Legitimate Interests

We may have a legitimate interest in using your personal data. Usually this is to help us run, improve, promote, monetise or protect our products, services and business. You may be able to object to the processing of your personal data when processed for legitimate interests. See Right to object. You are in control of your marketing preferences. If you would like to opt out of electronic mail marketing, you can do so at any time. See Direct Marketing below for more information on the lawful bases we may use to direct market to you.

Examples of legitimate interests, where relevant, may include but are not limited to:

• Sharing data with agents, new home builders or other third parties (“third parties”), so we can help progress an application, lead, quote or other such request.

• Sharing data with third parties, so you do not need to re-enter it.

• Sharing data with third parties to make available to you third party products or services to enhance our, or a third party product or service, or your customer experience in general.

• Third parties sharing your personal information with us, so we can combine personal data we hold on you to produce data insights or information/outcomes/behaviours about you, to help them improve or personalise their products and services they provide to you.

• Sharing and receiving data from third parties to offer and provide you with benefits for choosing to use our or a third party product or service.

• Providing emails concerning status, reminders and outcomes on your use of our, or a third party product or service.

• Collecting personal data from third parties, such as to obtain a status of any payment transaction.

• Receiving data from third parties to speed up and improve the efficiency of a property transaction and to keep all parties, where required, informed.

• Providing emails concerning quote results or confirmation of your use of our or a third party product or services.

• Receiving data from third parties to allow us to understand your engagement with them, and for them to share with us the status of a property transaction to facilitate the accurate receipt of referral or other monies payable to us by third parties, or the payment of monies by us to others, or payment of third parties to other third parties, for products and or services you may have chosen to use or are provided to you as a benefit.

• To allow us to understand your user journey and for us to know where you have taken an action such as making a payment or moving to a different website.

• To allow us to understand more about what is relevant and helpful to you such as when you like or dislike content on our websites, applications, emails and social/digital media platforms.

• Auditing and monitoring our processes, your engagement and feedback to help keep our high standards.

• Market research, statistical analysis, management information, data aggregation and product development for our own purposes, third party purposes or to assist the wider property management industry.

• Using a third party to allow for communication with you such as video conferencing. Training, communications and awareness.

• Securing our services, ensuring personal data is up to date and accurate, and keeping our services online.

• Preventing or prosecuting fraud and other criminal behaviour or activity.

• Transferring personal data for the purposes of developing, migrating and maintaining IT infrastructure and services.

• For direct marketing, personalisation, targeting and data shares for the purposes of marketing, monetisation or promotional activities.

• Showing you personalised content such as properties of interest on our websites, applications, platforms and systems.

• Non targeted marketing on our websites, applications, platforms and systems of either our products or services or products and services of third parties.

• For data insights, services and products improvements and developments based on your use of our or third party offerings on our websites, applications, platforms and systems.

• Recording where applicable of telephone calls and related services.

• For relevant processing by another company, such as by Group Companies.

• We may also process data in aggregated and anonymised form for statistical purposes to improve products and services, including our customer service.

Personal data processes

We have broken down our main offerings below providing you with a useful guide to what personal data we collect, how we collect it, who we share it with and what lawful basis we rely upon to process your personal data. See Direct Marketing for privacy information related to the collection and processing of your personal data for direct marketing purposes. Also see Part B for supplementary privacy notices for specific products and services.

We collect and process personal data related to you and associated with your property or a property transaction for the following beneficial purposes:

• To help provide you with the ability to rent, let, purchase, or sell a property.

• To help speed up the property transaction and help the property industry improve.

• To improve the communication between all parties, such as any developer, any agents, the buyer, the seller, the landlord, the tenant, the developer’s conveyancer, the buyer’s conveyancer, mortgage advisors, lenders and surveyors.

• To advertise to you relevant products and services online.

Artificial Intelligence (AI) 

Where we or a third party acting on our behalf may use artificial intelligence in any processing of personal data we will always assess the risk to your personal data and will ask for your consent where possible. We will inform you where applicable of any use of AI or similar technology.  

We may use AI for the following purpose (not limited to):

• Performance improvement of products and services

• Helping us communicate with you and others more quickly and accurately

• For research and data insights

• To assist in us completing tasks more efficiently such as summarising

• To help us target marketing and personalisation.

Who we share your personal data with

We use third parties to help provide our products and services. These companies may collect, store or otherwise process your personal data on our behalf. Where relevant we share your personal data with third parties such as buyers, sellers, developers, agents, conveyancers, surveyors, lenders, mortgage brokers and other third parties related to the property industry and or a home move journey.

We routinely share personal data with:

• our Group Companies. See Group Companies below;

• third parties who we partner with to bring you relevant products and services. See Personal data processes and Part B for specific products and services additional privacy information which includes details of other third party data shares;

• third parties together with whom we deliver our products and services to you including but not limited to estate agents, letting agents, conveyancers, and new home builders;

• with third parties to service the terms you have agreed and or our contract with you, these third parties may act as a ‘data processor’, a ‘sub-processor’ and or a ‘data controller’ throughout the lifecycle of the services or delivery of the product. The names of the companies we use for these purposes may change frequently and where possible will be communicated to you where required. Where you agree to terms directly with third parties, their terms and privacy information will apply to such processing. Such third parties we use to help us run and improve our business include but are not limited to, marketing agencies, information technology providers, cloud hosting or physical server providers, information security providers, identification or verification providers, payment processors, and any other third party acting on our behalf or as a partner.

• third parties approved by you, for example social media sites you choose to link your account to or third party payment providers you chose to us;

• credit and other vetting and referencing agencies; and

• our insurers and brokers.

We only allow organisations acting as our ‘data processors’ to process your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you, for the purposes we have asked them to undertake on our behalf.

We or the third parties mentioned above occasionally also share personal data with:

• our and their external auditors for example in relation to the audit of our or their accounts or compliance with data protection laws, in which case the recipient of the information will be bound by confidentiality obligations;

• our and their professional advisors (such as solicitors and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;

• a financial services firm where we act as introducer appointed representative for a financial services product;

• law enforcement agencies, courts, tribunals, authorities, emergency services and regulatory bodies and other parties to comply with our legal and regulatory obligations, for a task carried out in the public interest, to protect the rights, property and safety of Group Companies, our customers or others. This includes exchanging data with third parties for the purposes of fraud and other criminal protection, and where needed to protect the vital interests of an individual. Where we are required to disclose your personal data to to the court services, regulators, law enforcement agencies or other such authorities in connection for example with proceedings or investigations anywhere in the world where compelled to do so, where permitted, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime; and

• other parties if we refinance, or that have or may acquire control or ownership of our business, shares in any Group Company or assets (and our or their professional advisers) in connection with a corporate transaction or restructuring, including but not limited to a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. Usually information will be anonymised but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

Group Companies

We share some IT infrastructure, and other facilities and support services with Group Companies, and so we may share your personal data with Group Companies business units to help, collect, process, transfer and store your data efficiently and securely. Group Companies may use your personal data to help provide you with products and services that you request from those Group Companies (for example, to help you manage your home or mortgage) and to provide you with relevant recommendations of other Group Companies products and services.

These recommendations may use inferences about your interests based on your activity on our websites and apps, and on other websites, apps, platforms and systems operated by other Group Companies. Personal data used for Group Companies data insights is mostly anonymised or pseudonymised wherever possible to protect your privacy. Group Companies may also use your personal data which we capture when you use the Zoopla websites, apps, platforms and systems for other purposes which are described in this or other Group Companies Privacy Notices. We will only ever share your personal data with Group Companies where lawful to do so.

Direct Marketing

This section details how we process your personal data and how you can manage your preferences for the purposes of direct marketing, including but not limited to electronically stored marketing communication sent by us to you via email, SMS, direct message, push notifications or similar, sent over a public electronic communications network.

Direct marketing is any type of advertising or promotional material aimed at a particular person. Marketing that is not aimed at anyone in particular is not direct marketing.

We use this information so we can remind you of all the ways we can help and hopefully encourage you to use Zoopla more often. We also may get paid by selected third parties, such as new home builders, estate agents, lettings agents and Group Companies, to send you electronic mail marketing about their products and services. We only share your personal data where lawful to do so, such as with those third parties who provide services to us (‘data processors’) and are subject to our contractual terms which require them to keep your personal data safe and not to use it for any other purpose.

Via our direct marketing channels you are able to get information about the latest properties that match your search criteria; information on your property and surrounding area; mortgage reminders; Zoopla news and offers; and promotions and offers from new home builders, Group Companies and other third parties.

We may ask you to confirm or update your marketing preferences if you ask us to provide further products and services in the future, or if there are changes in the law, regulation, or the structure or strategy of our business.

We will always treat your personal data with the utmost respect and will only send you electronic mail marketing (email and similar) we believe would be of interest to you.

Electronic mail marketing from Zoopla about Zoopla’s products and services:

When you create an account with us you agree to our terms and conditions for our products and services you choose to use, in creating an account you have expressed an interest in our products and services. At registration you are informed we will send you electronic mail marketing to include property news and offers about Zoopla’s products and services, and you are given the opportunity to object to this processing (opt-out) before the processing takes place.

Under the Privacy and Electronic Communications Regulations (PECR) this is known as “soft opt-in”, and the lawful basis we rely upon to send your electronic mail marketing about Zoopla’s products and services under the UK General Data Protection Regulation (GDPR) is legitimate interests. We’re allowed to use your personal data if it’s necessary for our (or someone else’s) legitimate interests, provided those interests are not outweighed by your rights nor have any negative impact on you. We are not lawfully required to gain your consent where we comply with the requirements of legitimate interests. If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.

You have the absolute right to object to direct marketing, and can unsubscribe in one click from all electronic mail marketing communications. You can also manage your marketing preferences, by opting out, or opting back in, to electronic mail marketing via “Settings” in “Electronic mail preferences”.

We will always act promptly on a request to opt-out or unsubscribe from electronic mail marketing communications, it may however take us a few days to process your request across our marketing activities and we may not be able to stop an email reaching you that is already part of a live or scheduled campaign. You may still receive non-marketing related messages and other important service information even if you have opted-out or unsubscribed from electronic marketing communications (see Service messages for more information). We may also ask you to confirm or update your marketing preferences if there are changes in law, regulation, or business strategy or structure where lawful to do so.

Objecting to one type or means of marketing may not automatically opt you out of other marketing processes, to check you are opted-out of all types and means of marketing you can email [email protected].

Electronic mail marketing from Zoopla about New home builders and Partner products and services:

During your account creation we further offer you the opportunity to consent to receive updates on new home properties in your search area, from new home builders, and separately the latest money-saving offers from Zoopla’s partners which are listed (or otherwise made available to you) at the time you provide your consent. Emails we send you about new build builders, developments and properties; and our third party partners, are always only sent with your consent. We send you content that we believe is relevant to you. You can withdraw your consent at any time via a one click unsubscribe from all electronic mail marketing communications. You can also ” manage your marketing preferences, by opting out, or opting back into electronic mail marketing within your Zoopla account via your account “Settings” in “Electronic mail preferences.

Electronic mail marketing from Zoopla about Group Companies

We will obtain your consent to send you electronic mail marketing about Group Companies products and services. You will always be provided with a means to unsubscribe in electronic mail marketing communications and opt-out or opt back in within your account. We may share your personal data with our Group companies for marketing purposes. See: Who we share your personal data with.

Telephone and direct mail marketing:

We will rely upon our legitimate interests to market Zoopla products and services via:

• Live telephone calls to numbers not listed as ‘do not contact’ on the Telephone Preference Service

• Direct mail marketing to individuals not listed on the Mail Preference Service.

We will rely on consent to market Zoopla products and services via:

• Live marketing calls to numbers listed as ‘do not contact’ on the Telephone Preference Service

• Direct mail marketing to individuals listed on the Mail Preference Service

• Automated phone calls.

We will always provide you with a means to opt-out of marketing. If we undertake any telephone or direct mail marketing we will provide you with details on how to opt-out.

Push notifications:

Push notifications are sent only with your consent. You can choose to consent to receive or not receive push notifications within your device and app settings.

Marketing cookies:

Consent is obtained, where required, to utilise cookies for marketing such as for targeting and social media purposes. For changes to your cookie preferences see Cookies below and our Cookie Policy.

Property Insights

When you ask us for a property valuation, set an alert, or to track a property, we will send you solicited emails and communications specific to the property you have queried. This may include providing you with monthly valuation updates, news relevant to the property and local area or market assistance with checking equity in the property, and obtaining mortgage reminders and advice from Group Companies. For more on mortgages see: Who we share your personal data with.

You may also receive these communications via push notification where you have consented to receive push notifications from our app.

You can update solicited marketing preferences within your account and by unsubscribing. As property insights are solicited communications about specific properties you have chosen to receive communications on, you may need to change your preference per property from within your account, and also from within our app if you are an app user. You can use the links provided below to sign into your account and take the following actions:

• Tracked Properties - edit or unsubscribe from alerts about your tracked properties

• Alerts and Searches - edit or unsubscribe from property listing alerts

• Email Preferences - edit or unsubscribe from all emails

Service messages

Not all electronic communications are marketing. Communications confirming you have registered an account or other actions you have taken when using our products and services are service messages, and are sent under performance of contract and not consent. Service messages may also be sent for legitimate interests such as to safeguard your personal data or to meet our, or a third party's legal obligation such as informing you when we have updated terms or a privacy notice. Our logo or branding on a message or non intrusive publicity is unlikely to be considered direct marketing on its own.

Social media, digital platforms and collaboration partners

We may share your personal data such as hashed email addresses, mobile numbers, user data and IP addresses, with certain social media, digital and agency platforms, such as Meta (Facebook), Google, Permutive, and the Trade Desk to allow us to build our campaigns through ours, their and third party platforms. Also see Cookies and Our role in advertising technology (adtech) below. Personal data may be processed for the purposes of:

• Identifying you on a social media or digital platform so that we can advertise products we think would be of interest to you, based on the information we hold about you and your social media profile;

• Understanding the performance and return of our marketing activities on a social media platform, and to optimise the efficiency of our marketing activities;

• Helping a social media platform serve non-Zoopla users, targeted marketing about our products and services or that of our Group Companies on the social media platform, based on whether their profile matches those of our users; and

• To try and prevent you being targeted with Zoopla marketing if you have opted out of social media data shares.

We also process personal data for the purposes of collaboration partnerships. We aim to utilise agencies' platforms “clean data rooms” to ensure collaborative partners never have access to your personal identifiable information. We and such social media, digital platform or collaboration partners are most often joint data controllers of this processing protected by contractual terms. The Social media and digital platforms are responsible for responding directly to data subject rights where they process your personal data as a data controller.

We share certain personal data via our email platform Iterable, to create audiences and target users on social media platforms via Facebook Ads Manager and Smartly. You have the right to opt-out of such data sharing. You can do so by emailing [email protected] and we will remove you from our audiences.

Some of our marketing activities are not targeted so we are unable to guarantee that you won't see the promotion of Zoopla products and services on social media or digital platforms, however where you have opted-out to such data shares we will suppress you from our targeted campaigns.

For further information about how a social media or digital platform processes your personal data, and how you can exercise your data subjects rights over the data they hold on you visit their privacy notice that can be found on their website/s or within their application/s.

We work with third party partners who help us to identify any social media posts in which we have been tagged. If your tagged post includes an image we would like to reuse then we may post a comment asking if you would be happy to give your consent for us to potentially reuse it, we will only ever reuse or retweet content you have posted about us on social media if we have both asked for, and received your consent. You can withdraw your consent any time via the same means you gave it.

If you make a comment about us on one of our social media posts then we may add our own comments in response. If you have provided negative feedback then we may post a comment encouraging you to message us directly to discuss further.

Third party websites 

Please note that where we make third party products and services available and include links to their website/s, you should read the applicable third party’s privacy notice if you would like to understand how they collect, store and use your personal data. This privacy notice does not apply to third party websites. 

Cookies and similar technologies 

Cookies are small text files widely used and placed on your device when you visit websites and applications. We use cookies (and similar technologies such as SDKs and local storage) to distinguish you from other users. This allows you to use our products and services, and helps us provide you with a good experience when you use our website (including related applications, platforms and systems). 

There are two main categories of cookies: essential and non-essential.

Essential cookies let you log in, use products, services and help us understand and improve your user experience.  They include essential functional and performance cookies that cannot be disabled as they are strictly necessary for the functioning, acceptable user performance and improvement of our website, and for other necessary processing such as data security and remembering your cookie settings. 

 You can set your browser to block or alert you about such cookies, however this is likely to affect your user experience as the website in full or parts will not be able to function. 

We will always ask for your consent to use non-essential cookies which includes cookies used for additional functionality and performance of our website, We also use non essential cookies to help us with targeting, and marketing (including social media marketing).

We use a Consent Management Platform (“CMP”) when you first visit our website, where you have control over our use of cookies. You are able to reject non-essential cookies and also personalise your experience based on your privacy preferences.

We will always inform you if we use targeting, marketing or social media cookies to show you personalised advertising on our websites, applications, platforms, systems, and that of others.

Some targeting cookies include having to process offline or account information to fulfil the purpose of the cookie, meaning in order to provide you with ads relevant to you, personal data we hold about you may need to be processed so we can best understand your interests and what ads would be the most relevant for you to see. If you do not consent to targeting cookies, you will still see ads, however, these will not be targeted and so may not be of interest to you.

You can disable cookies being stored on your computer by changing your browser settings. You can also control your privacy settings on your mobile device. 

We use Google Analytics and similar to provide us with statistics on website usage. Analytics cookies are non-intrusive cookies and we may consider them essential in providing and improving our products and services. The only non-anonymised personal data divulged to Google is your IP address. You can opt-out of Google Analytics following the advice here – https://tools.google.com/dlpage/gaoptout. 

Cookies help you move from one website (or page) to another. By counting redirects and engagements on our website, Group Companies websites or others,  for example that of estate agents and new home builders, we track how effective ads are for analytical and data insights purposes. We also need to monitor the performance of ads (ours or others) so as to make accurate payments (by us or others) of referral or conversion monies, and comply with contractual obligations. Data provided by cookies for analytics purposes is anonymised and aggregated. 

We may share your personal data, such as an email address and related events, with Google or other vendors to assist with advanced user matching. Personal data is shared with these third parties only if you have consented to third-party marketing or tracking cookies. Any personal data used for matching, such as an email address, will always be cryptographically hashed for security.

We allow some third parties, such as Meta, Pinterest, Tiktok, Bing, and Google to use cookies to collect information from our websites, applications, platforms and systems. They use this information to help us advertise Zoopla and other Group Companies products and services on other websites and social media platforms, and also to help us find others who might be interested in our products and services.

For example, Meta uses a custom audience pixel, which is why you might see Zoopla ads on Facebook after you have been on our website. We use the Facebook pixel to display our ads to Facebook users who’ve previously shown an interest in our website, and the products and services advertised on it. We also display our ads for example to those who’ve shown an interest in certain locations or properties within a particular price range, or those who’ve shown intent to purchase, sell, let or rent a property.

Facebook ‘lookalike’ audiences allow us to show ads on Facebook to people who show similar characteristics to those who use our website. ‘Lookalike’ audiences are created using data collected by the Facebook pixel, or in some cases, email address matching, but only on an anonymised and aggregated or hashed basis. We do this to make sure we show ads to people who are likely to be interested in them.

You can find out more about what cookies we use, how we categorise our cookies, a description of the categories, who we share data with and which components require consent within our Consent Management Platform, or by emailing us at [email protected] .

Within the Consent Management Platform you can opt-in or opt-out of data shares with third parties on an individual basis; or you can reject certain processing; or you can reject all non-essential cookies in one click. 

You can change your cookie preferences at any time by visiting our Consent Management Platform.  You may need to ensure your preferences are selected for each device and/or website or application you visit.

App (SDKs)

We use technology similar to cookies on our applications (apps). These “cookies” are called software development kits (SDKs) and perform various activities such as facilitating your use of our apps and allowing us to understand your user behaviour to improve the performance of our apps, products and services. SDKs may also be used to personalise experiences and deliver more targeted marketing. SDKs can process personal identifiers like device ID and location. Some SDKs may be able to track other personal data such as usernames and email addresses. We would always ask for your consent to use SDK’s for targeting and marketing (including social media) purposes. 

Our role in advertising technology (adtech)

Adtech describes a set of technologies and practices which enables advertisers to compete for available digital advertising space in real time.

Zoopla’s websites feature ads from third parties. We sometimes select these ads through a bidding process, which enables us to automatically analyse and manage information. We can then instantly sell the advertising space to advertisers during the time it takes for a web page to load on your browser.

Advertisers bid for a specific space on our website if they think a particular user is someone they’d like to reach. We lawfully process your personal data to help create audience segments. We share our audience segments (anonymised data) with advertisers so they can target their ads more effectively. For example, new home builders may want to display their ads to someone we’ve defined as a first-time buyer. To ensure that we display relevant content in the ads we display, we only allow certain companies to bid for ad space on our websites. 

“Checkatrade” is an example of an advertiser of a display campaign we may show you, and we may get paid on a cost per click basis. Our display campaign advertisers change frequently. Your personal identifiable data is not shared with advertisers.   

We also use personal data to create different audience categories for those who share interests relating to the property market. First-time buyers is one example of a category. We assign you an audience category based on your browsing behaviour on our website, and any data you give us during your account creation or when you send a lead to an agent, new home builder or similar. We include information about the areas and property features you’re interested in.

When you enter your email address on our website we may share personal or other information that we collect from you, such as your email (in hashed and/or pseudonymised form), IP address, or information about your browser or operating system, with our adtech partners (third parties) which may include but is not limited to:

• ID5

• LiveRamp ATS/Ramp ID (Authenticated Traffic Solution)

• Permutive

• Epsilon Core/Shared ID

• Anonymised

• TTD (The Trade Desk) Unified ID

Our adtech partners (third parties) may use this information to create an online identification code for the purpose of recognising you on your devices. This code does not contain any of your identifiable personal data and will not be used by the third party to re-identify you. We place this code in our cookie or use a third party cookie and allow it to be used for online and for cross-channel advertising. It may be shared with our advertising partners and other third party advertising companies globally for the purpose of enabling interest-based content or targeted advertising throughout your online experience from us or third party (vendors) (e.g. web, email, connected devices, and in-app, etc). These third parties may in turn use this code to link demographic or interest-based information you have provided in your interactions with them. You have the right to express a choice regarding our use of these cookies and our sharing of this data with third parties, for the above purposes and can do so within our Consent Management Platform (CMP) at any time or through means provided to you directly by the third parties. 

You can view within the CMP a list of vendors we may engage with and you can opt-out and opt-in to vendors on an individual basis. You can reject certain processing, or all vendor data shares with one click.

We take our privacy compliance within our adtech activities seriously and demonstrate this by maintaining compliance with the Transparency & Consent Framework (TCF) v2.2. 

The Interactive Advertising Bureau (IAB) Europe launched the TCF to provide a standardised approach for obtaining and managing user consent for the processing of personal data in online advertising. Complying with TCF helps advertisers and publishers comply with the requirements of the GDPR. For more information on our compliance with the TCF v2.2 see visit our Consent Management Platform.

Where your personal data Is held

Personal data may be held at our offices and those of our Group Companies, third party agencies, service providers, ‘data processors’, representatives and agents as described above. See Who we share your personal data with.

Some of these third parties may be based outside the United Kingdom (UK) or European Economic Area (EEA). For more information, including on how we safeguard your personal data when this happens, see Transferring your personal data out of the UK and EEA.

Transferring your personal data out of the UK and EEA

It is sometimes necessary for us to transfer your personal data to countries outside the UK and EEA. In those cases, we will comply with data protection laws designed to ensure the privacy and appropriate protection of your personal data. Where personal data is transferred outside of the UK, your personal data is protected by: 

1. the relevant receiving party being located in an ‘adequate’ territory, which means it is deemed to have an equivalent standard of protection to that offered to you under UK laws; or 

2. a written agreement which adds appropriate protections approved by the UK government and ICO to safeguard that personal data.

An exemption may exist for the transfer of personal data outside of the UK and adequate territories, such as when:

• you explicitly consent to the transfer being  aware of the risks;

• we have a contract with you, the transfer is needed for the performance of that contract and the contract benefits another individual whose data is being transferred;

• the transfer is deemed necessary for reasons of public interest;

• the transfer is necessary in relation to a legal claim;

• the transfer is necessary to protect your or another individual’s vital interests, such as their life; and

• the transfer is a one-off and necessary for our legitimate interests.

How long your personal data will be kept

We only keep your personal data long enough to carry out tasks we collected it for. Different retention periods will apply depending on the type of personal data and which of our products or services you are using. After that time, we securely erase your personal data. Erasure may include anonymising data or where required, putting data beyond use. 

For most personal data we collect to provide our products and services to you, this will be for the duration you use our products and services plus a 6-7 year period, in line with statutory limitation  periods. Personal data held for business reasons that don't outweigh your privacy rights is stored under legitimate interests. We also retain personal data where required to meet contractual, legal and regulatory obligations. Where personal data is held within a valid retention we may be unable to meet a data subject right to erasure, and your personal data will be erased in line with our data housekeeping practices. See Your privacy rights. For more information on retention you can email [email protected].  

Your privacy rights

You have data subject rights which are granted to you under data protection law, which you can exercise at any time. We manage all rights requests raised to us as the law requires. This means there may be legal reasons why we cannot complete all requests.

The UK GDPR defines personal data as any information relating to an identified or identifiable natural person (‘data subject’). Data is only your personal data where you are identifiable and the data relates to you. Data that does not relate to you, such as data about a property or a business transaction is not personal data, and is not subject to the requirements of data protection law and regulation. 

To exercise your privacy rights concerning personal data in the control of your agent, new home builder or similar (‘data controller’), you should contact them directly. Where we are not the sole ‘data controller’ of your personal data, we will only be able to assist with the meeting of any data subject rights request on the direct instruction or agreement of the ‘data controller’. Where we are not the ‘data controller’ or the sole ‘data controller’ of your personal data, we will likely have an obligation to either direct your data subject rights request to the ‘data controller’, or send them your request to handle.

You have the following data subject rights concerning your personal data we control, which you can generally exercise free of charge (subject to certain limitations detailed below):

For more information on each of those rights, including the circumstances in which they apply, please contact us. See How to contact us below or see guidance from the UK Information Commissioner’s Office (ICO).

We will not ordinarily charge you in respect of any requests we receive to exercise any of your rights detailed above. However, if you make excessive, vexatious, repetitive or manifestly unfounded requests, we may charge you an administration fee in order to process such requests or refuse to act on such requests in line with what is acceptable under data protection law. Where we are required to provide a copy of personal data this will usually be free of charge. However, any further copies requested may be subject to reasonable fees based on administrative costs.

Where you request us to rectify, erase or restrict the processing of your personal data, we may where possible notify third parties to whom such personal data has been shared of such request. However, such third parties may have the right to retain and continue to process such personal data in its own right.

We or third parties acting on our behalf may need to request proof of identity or ask you to prove your identity via automated means before we can process your personal data for the purposes of a data subject rights request. Where we utilise automated decision making for this or any other personal data process, we will where possible offer human intervention.  

We are unable to process a data subject right request made through or via a third party provider without having adequate evidence of your identification and your instruction for the third party provider to act on your behalf. This is to protect your personal data. We may ask the third party provider to have you make direct contact with us. 

Where you would like to make a data subject rights request on behalf of another individual, please ensure you are able to provide us with evidence of their consent for you to act on their behalf, and for the request to pass identification checks.    

If you would like to exercise your data subject rights, please:

• email, call or write to us. See How to contact us below;

• provide enough information to identify yourself for example your full name and email address, and any additional identity information we may reasonably request from you; and

• let us know what right you want to exercise and the information to which your request relates.

Property information 

We may collect, process or share property information, such as a property’s address and attributes about the property or a property transaction. Where data relates to a property or property transaction, and not an individual it is property information, and the requirements of or rights provided by data protection law and regulation do not apply. Property information is not personal data.

Keeping your personal data secure

Information security 

Our websites generally use encryption technology to protect the transfer of your information to and from our websites and applications. We maintain and enforce physical, electronic, and procedural safeguards in connection with the collection, transfer and storage of your personal data. However, whilst we take these appropriate technical and organisational measures to ensure the security of your personal data, we cannot guarantee the security of all personal data that you transfer over the internet in every circumstance. 

Password strength 

It is important to keep any account password secure to prevent fraudulent use. Never disclose your password to anyone else, and especially to anyone who requests it from you by telephone or email. We will never request your password. You should avoid using the same password for multiple websites and avoid using common terms for your password such as "password" or "123456". Instead, try using three or four words linked together combined with numbers, capitals and special characters, something easy to remember but difficult to guess. Take care when using public WiFi networks and ensure all email accounts you use are secure. If you use a shared computer, make sure that you log out once you have finished using a website or application. 

Phishing 

Threat actors may try to steal your personal data using a technique known as 'phishing'. This is where threat actors send emails that appear to be from someone or a company you know, but are actually the threat actor attempting to make you provide them with your personal data or even transfer money to them (known as redirection fraud). If you receive an email that claims to be from us and contains a link to an external website, or a request for you to enter any personal data or transfer money, treat it as suspicious and do not enter any personal data, even if the email appears legitimate. If you suspect your account details are subject to any fraudulent activity, please contact us immediately. We are unable to take responsibility for any loss you may suffer either directly or indirectly as a result of any fraud, security incident or success of any threat actor outside of our secure environments, or where we have taken all reasonable measures to protect your personal data.  

Payment card details and subscriptions 

We are committed to ensuring the protection of your payment card details and comply where required with the Payment Card Industry's Data Security Standard (PCI-DSS). Payments whether once-off or subscriptions made via our websites, applications, platforms and systems are processed and managed by specialist payment card providers. The full payment card number is never stored by us and is only stored and processed by the specialist payment card provider approved by us. We may keep an encrypted authentication token to represent your card and this token is transmitted to the specialist payment card provider during the order or refund processing. 

We may retain some information to allow us to link the transaction to you, this information will never be your full account or card details. We will retain your consent to our privacy notices and practices where needed to evidence you have agreed for a payment to be made or to be entered into a subscription agreement for the purposes of processing of personal data for auto-renewals. Your financial information will also be processed by our payment provider in order to generate any valid requested refund. Subscriptions and payments may be stopped or paused at our or our payment provider’s discretion, to comply with legal and regulatory obligations, or to prevent fraud.    

Vulnerability disclosure policy 

When it comes to our products and marketing we don't compromise on security. If you've noticed something that doesn't seem quite right with any of our platforms please let us know. Drop us an email on [email protected] including your name, details of the vulnerability and how to reproduce it.

Although we welcome all reports of suspected vulnerabilities, we aren't able to respond to every email, and aren't offering rewards or bounties for any finding forwarded to us.

We expect professionalism from any security researchers and for them to avoid privacy or legal violations; these violations include (amongst others) not destroying or corrupting our data, not interrupting our operations, not targeting our staff, not performing any scans on our systems and not trying to access the account details of any other user.

If you have disclosed a valid unique bug, we will of course pass this on to our teams internally to resolve, but will not be able to keep you updated on the progress of the report. Regardless of the outcome of your finding we would ask that disclosures are made directly to us, and that no public disclosure is made without our prior explicit consent.

Only reports that have been encrypted will be read, so in order to do that make sure you download the PGP key here.

Making personal data public 

If you post, comment, indicate interest, or share personal data, including photographs, to any third party public forum, social network, blog, or any other publically accessible online location, you must note that any personal data you submit can be read, viewed, collected, or used by other users, and could be used to contact you, send you unsolicited messages, or for purposes that neither you or we can control. We are not responsible for the personal data you choose to disclose publicly on websites, applications, platforms, systems, forums or similar. Please refer to the relevant third party privacy notice for how they may process your personal data.

Children under the age of 13

Neither our websites, applications, platforms, systems, products or services are aimed at children under 13 years of age. You must be 18 years old or over to create an account on our websites, applications, platforms or systems, or to contact us or third parties through using our products and services. Minors are not permitted to use our websites, applications, platforms and systems. No content is intended for children 

We do not knowingly collect personal data from children under 13. If you are under 13, please do not use our products or services and do not provide any personal data to us via any means. If we learn we have collected or received personal data from a child under 13 without verification of parental consent, we will delete that personal data. If you believe we might have any personal data from or about a child under 13, please contact us at [email protected]. 

How to contact us 

We hope all of the above makes sense and you’re happy with how we use your personal data. If not, please contact us at [email protected], or you can contact our Data Protection Officer via post to The Cooperage, 5 Copper Row, London, SE1 2LH. Please mark the envelope ‘Data Protection Officer’.  

You may also lodge a complaint with the Information Commissioner’s Office (ICO), if you think your data protection rights have been breached in any way by us and you have already made a complaint to us in the first instance and you remain unsatisfied with the complaint outcome. You may contact the ICO at: 

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or at www.ico.org.uk. See Right to Complain. 

Changes to this privacy notice

From time to time, we change this privacy notice. We will post any changes to this page, so please check it often. Where appropriate, we will notify you of the change, for example by email or by means of a notice on our websites, applications, systems or platforms. Your continued use of our relevant products and services, including use after the posting of any changes, will be deemed acceptance and acknowledgement by you of the information found within privacy notice. You are responsible for ensuring we have an up-to-date active and deliverable email address for you and that you regularly visit this privacy notice to check for any changes.

This privacy notice was last updated in October 2024.

Do you need extra help?

If you would like this notice in another format (for example audio, large print, braille) please contact us. See How to contact us above.

Part B – Product Specific Offerings

Zoopla offers a range of products and services which can help you with decisions and actions such as a property search, property transaction or moving journey. 

Where you use certain specific products and services, we may also collect or process additional personal data from you to provide that product or service. For ease we have set out more detail below. 

Zoopla Plus 

Zoopla Plus provides a means to access property information in relation to a property and the local area (Home Report). We collect and process personal data as a ‘data controller’ to provide you with our Zoopla Plus offering, which includes processing in addition to that listed in part A (as applicable). Below is further privacy information concerning this offering:

If you are using Zoopla Plus, we may also share your personal data for the purposes of providing you our products and services with: 

• Group Companies; and

• Stripe or other payment processors.

We will always ask for an affirmed action to allow us or our payment provider to process a payment, or to evidence your agreement for us or our payment provider to process your personal data, including financial information, for the purposes of a subscription service. See Right to Withdraw Consent. 

We will retain your consent to our relevant privacy notice and practices where needed to evidence you have agreed for a payment to be made or to be entered into a subscription agreement for the purposes of processing of personal data for auto-renewals. Your financial information will also be processed by our payment provider in order to generate any valid requested refund. Subscriptions and payments may be stopped or paused at our or our payment provider’s discretion, to comply with legal and regulatory obligations, or to prevent fraud.

Movemnt

Movemnt allows you to obtain quotes from conveyancers. In doing this, we collect and process certain personal data from you and via third parties as a ‘data controller’ which is in addition to that listed in part A (as applicable). We may process your personal data on the instruction of your agent or new home builder (or similar), in such an instance, we may be acting as a ‘data processor’ and your agent or new home builder will be the ‘data controller’. 

Below is some further privacy information concerning this offering:

If you are using Movemnt, we may also share your personal data for the purposes of providing you this offering with: 

• Legal Marketing Services Ltd (https://www.lms.com/privacy.html)

• Conveyancers approved by the SRA (https://www.sra.org.uk)

• Conveyancers approved by the CLC (https://www.clc-uk.org)

• Stripe Inc or other payment processors (https://stripe.com/en-gb)

• oPayo (https://www.elavon.co.uk/privacy-policy.html)

We are the policyholder of an insurance back guarantee policy (“IBG”). This IBG has been arranged by Rhino Protect Limited (“Rhino”) administered by ARAG plc, who is the coverholder of the Insurer, SCOR UK Company Limited. Refer to our Movemnt terms and conditions for more information. Where eligible for the guarantee, we may share your personal data with Rhino to provide you with this benefit. 

If you engage with Rhino for the purposes of making a claim or lodging a complaint about their service, Rhino will be the data controller and you must agree to their privacy notice and terms that can be found on their website Rhino Home Protect (https://www.rhinohomeprotect.com/). 

For any complaint concerning our offer of the guarantee, where eligible, or the use of our product or service, you can contact [email protected] 

We also share your data withSearch providers used to initiate property searches, for example we use:

• Move Reports (https://www.movereportsuk.com)

Letting Progression 

Our lettings progression product is provided by our Group Company, Vebra Solutions Limited (“Alto”) a company incorporated and registered in England and Wales. Registered office: The Cooperage, 5 Copper Row, London, England, SE1 2LH (04529917). Our Information Commissioner's Office (ICO) registration number is Z7426718. ALTO is part of our Property Software Group. This offering is co-branded with Zoopla.

If you are using our Lettings Progression service, we may act on behalf of the relevant agent in facilitating the technology to process your personal data to do things like process your ID documents or have you sign a tenancy agreement (as a tenant, landlord or guarantor). Note that where you are signed up with an agent, that agent may require further personal data from you. They are the ‘data controller’ in this instance and you should review their privacy notice for details about their processing activities which we may help to facilitate as ‘a data processor’.

Through this offering we also collect and process your personal data from you and via third parties as a ‘data controller’ which is in addition to that listed in part A (as applicable). Below is some further privacy information concerning this offering:

If you are using our Lettings Progression offering, we may also share your personal data for the purposes of providing you this offering with: 

• Letting agents and partners of letting agents for the purposes of your applications and for further processing where your application has been successful. Where the agent is the ‘data controller’ of your personal data, you may need to contact them directly to exercise your data subject rights for personal data in their control; and 

• Any joint applicant (or other interested party) and vice versa, with who we may share the status of your application and any other personal data where required by law or where instructed by an agent, to allow for the lettings progression, Similarly we may need to share your personal data with a landlord or guarantor on the instructions of the agent.