Legal
Privacy policy
What we collect, why, how long we keep it, and how to make us delete it. Written to be read, not to be survived.
Last updated 27 Jul 2026
What we collect
We collect only what an advisory conversation actually needs, and we tell you why at the point we ask for it.
- Contact details you give us: name, mobile number, email address.
- Enquiry context: the project or locality you asked about, your budget band, timeline and whether you are buying to live in or to let.
- Technical and campaign data: IP address, device and browser, referring page, and UTM or click identifiers from the ad or link that brought you here.
- Interaction data: pages viewed, filters used, calculators run and documents requested — used to give an advisor context before they call you.
- Consent records: the exact wording you agreed to, its version, and the timestamp.
Why we process it
To respond to your enquiry, arrange site visits, share project documentation, and introduce you to the developer whose project you are considering. To meet our obligations as a RERA-registered agent. To improve the site — which pages and filters help people decide, and which do not.
We do not sell your personal data. We do not share your number with developers you have not asked about.
Consent, and withdrawing it
Every enquiry form carries an explicit consent checkbox — never pre-ticked. Analytics and marketing cookies are off until you switch them on in the cookie banner.
You can withdraw consent at any time by emailing hello@crestwoodsestates.com. Withdrawal stops future processing; it does not undo processing already carried out lawfully.
Who we share it with
Developers, but only for the specific project you enquired about, and only so they can register your visit or booking. Service providers who operate parts of this platform under contract: cloud hosting, SMS and WhatsApp delivery, email delivery, analytics and error monitoring. Regulators or courts where the law requires it.
Every processor is bound by contract to use your data only for the purpose we engaged them for.
How long we keep it
Retention is purpose-bound, not indefinite.
- Enquiry and lead records: 5 years from last contact, then anonymised.
- Audit logs: 3 years.
- Application and access logs: 90 days.
- Analytics events: 26 months.
- One-time codes and session tokens: purged nightly once expired.
Your rights
Under the Digital Personal Data Protection Act 2023 you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, and nominate someone to exercise these rights on your behalf.
Write to hello@crestwoodsestates.com with the subject "DPDP request". We verify identity before acting — otherwise the request itself becomes a way to extract someone else's data — and respond within 30 days.
Security
Data is encrypted in transit with TLS 1.3 and at rest. Access is role-based and least-privilege, every administrative action is written to an immutable audit log, and exports of personal data are permission-gated and logged. The platform is penetration-tested annually.
If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board as required.
Calls, SMS and WhatsApp
When you submit an enquiry you authorise us to contact you about it by phone, SMS, WhatsApp and email. This authorisation overrides your DNC/NDNC registration for that enquiry only, which is what the consent text on the form says. Tell any advisor to stop and they will.
Children
This site is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
Changes to this policy
We version this policy. If we change it materially, we ask for consent again against the new version rather than assuming the old consent carries over.