BMDWho we are
This policy explains how BMD Real Estate Group (“BMD”, “we”, “us”) collects and uses personal information when you visit our website, contact us, or use the BMD client portal. We are responsible for your information as its controller.
Questions about this policy or your information: support@bmdrealestategroup.com or +44 787 895 5680.
What we collect
Information you give us
- Account details: your name, email address, phone number and password (stored only in scrambled, hashed form: we can never read it). A profile photo if you add one.
- Identity documents: ID and proof-of-address files you upload so we can verify your account, as property and investment transactions require.
- Enquiries and messages: what you send through the contact form or portal messages, including any files you attach.
- Listings: details, photos and ownership documents for properties you ask us to list for sale, rent or investment.
- Investments and payments: investment requests, the stakes you hold, invoices, and the payment references and proofs of payment you report. Payments are made offline (for example by bank transfer); we don’t collect or store card numbers.
- Preferences: homes you save and how you arrange your portal overview.
Information collected automatically
- Security records: your IP address and the time of sign-in attempts, password-reset requests and form submissions, used to stop abuse and brute-force attacks.
- Cookies: see Cookies below.
From others
If you choose “Continue with Google”, Google shares your name, email address and profile photo with us. We don’t receive your Google password.
How we use it
- To create and run your account and keep it secure, including two-factor sign-in codes and password resets.
- To answer enquiries, arrange viewings and handle the sale, rental or investment you ask us about.
- To verify your identity and meet anti-money-laundering, tax and other legal obligations.
- To issue invoices, record payments and send investor reports and dividend statements.
- To send service emails you need (sign-in codes, receipts, replies to your messages). We’ll only send marketing if you’ve agreed to it, and every marketing email lets you opt out.
- To protect our website, detect fraud and improve our services.
Where the law requires a legal basis, we rely on: performing our contract with you; our legal obligations (for example identity checks); our legitimate interests in running and securing our business; and your consent where we ask for it (you can withdraw it at any time).
International transfers
Some of our providers are based outside your country, including in the United States. Where information is transferred abroad, we use providers that protect it with recognised safeguards such as standard contractual clauses.
How long we keep it
- Account information: while your account is open, and for up to 6 years after it closes, in case of legal claims or regulatory checks.
- Identity documents and transaction, invoice and payment records: as long as anti-money-laundering and tax law requires (usually 5 to 7 years after the transaction).
- Security logs of sign-in attempts: a few months.
- Password-reset links expire after 60 minutes and sign-in codes after 10 minutes.
How we protect it
Passwords are hashed, pages are served over HTTPS, identity documents and private files are kept outside the public part of our website and shown only to you and authorised staff, and sign-in is protected by rate limits and optional two-factor codes. No system is perfectly secure, so please use a strong password you don’t use elsewhere, and turn on two-factor sign-in in your portal settings.
Your rights
Depending on where you live (for example under the UK or EU GDPR), you can ask us to:
- give you a copy of your personal information;
- correct anything that’s wrong (you can update most details yourself in Settings);
- delete your information, unless we must keep it by law;
- restrict or object to how we use it, or give it to you in a portable format;
- withdraw consent you gave us.
Email support@bmdrealestategroup.com and we’ll reply within one month. We may ask you to confirm your identity first. You also have the right to complain to your data protection authority; in the UK that’s the Information Commissioner’s Office (ico.org.uk).
Children
Our services are for adults. We don’t knowingly collect information from anyone under 18; if you believe a child has given us information, contact us and we’ll delete it.
Changes to this policy
We’ll update this page when our practices change and show the new date at the top. If a change is significant, we’ll tell you by email or in the portal.