Privacy Notice
Last updated: 15 September 2026
This Privacy Notice explains how Eden Property (Cheltenham) Ltd (“Eden Property”, “we”, “us” or “our”) collects, uses, stores and shares personal data when you visit this website, contact us, enquire about a property, subscribe to updates, apply to rent a property or use services connected with your enquiry or tenancy.
The Cookie and Similar Technologies Notice below explains how this website uses cookies, analytics and connected services.
Who we are
Eden Property (Cheltenham) Ltd is the controller responsible for personal data used for our property services, enquiries, applications and customer-management activities.
Registered address: 2 Chesterfield Buildings, Westbourne Place, Bristol, BS8 1RU
Company number: 07801091
You can contact us using these details about this notice or to exercise your data protection rights.
HOMESTEAD’s role
This website is powered by HOMESTEAD, which provides website, form-handling and related customer-management services. HOMESTEAD generally processes personal data on our behalf as a service provider and processor.
HOMESTEAD also acts as a controller for its own general analytics of websites using its platform. Its handling of personal data for its own purposes, including relevant account and direct technical-support services, is explained in HOMESTEAD’s Privacy Policy.
Where this website connects you to a HOMESTEAD Portal account, the privacy information provided by HOMESTEAD also applies to its account and platform services.
Personal data we collect
Depending on the services you use and the information you provide, we may collect:
Identity and contact information, including your name, email address, telephone number and correspondence address.
Enquiry and application information, including the property or room you are interested in, preferred move dates, household or group details, student status, guarantor information and answers submitted through forms.
Property-search preferences, including budget, area, property type, bedrooms, furnishing and other requirements.
Communications, including messages, correspondence, relevant notes and attachments such as photographs, PDFs and videos.
Viewing information, including appointments and, where relevant, occupancy, access authority, notices and permission evidence.
Tenancy-related information, including relevant agreements, documents, payment and deposit records, and identity, referencing or compliance information.
Inventory and inspection information, including condition records, photographs, video, meter and key details, comments and acknowledgements.
Marketing preferences and records of consent, withdrawal, delivery and engagement.
Technical, security and usage information, as explained in the website analytics and cookie sections below.
Browser-notification preferences and delivery information, if you enable notifications.
Other information you choose to provide.
Please avoid including sensitive information in general enquiries, messages or search fields unless it is necessary for the service you are requesting.
How we collect personal data
We collect information directly from you when you use this website, complete a form, contact us, manage preferences or use connected enquiry or tenancy services.
Where relevant, we may also receive information from:
Other members of your household or application group.
Guarantors, referees, landlords or authorised representatives.
Identity, referencing, compliance or fraud-prevention providers.
Service providers supporting our communications and property administration.
A property-management service from which we lawfully transfer relevant records.
Publicly available sources where necessary for a stated verification or compliance purpose.
If you provide another person’s details, please make sure you have an appropriate reason to do so and direct them to this notice.
Where particular information is required by law or is necessary to enter into or perform a contract, we will explain this at the relevant stage, including the consequences of not providing it.
How we use personal data and our lawful bases
We use personal data for the following purposes.
Enquiries and viewings
To answer questions, provide requested property information and arrange viewings. We rely on our legitimate interests in responding to prospective customers and, where applicable, taking steps at your request before entering into a contract.
Applications and tenancies
To assess and progress applications, communicate with applicants and guarantors, and administer relevant tenancy services. Depending on the activity and whose information is involved, we rely on steps requested before a contract, performance of a contract, legal obligations or legitimate interests in administering the application or tenancy.
Verification, access and fraud prevention
To carry out relevant checks, verify access authority, preserve permission evidence and protect our business, properties and customers. We rely on applicable legal obligations and legitimate interests in preventing fraud, managing access and maintaining reliable records.
Service communications
To send messages about enquiries, appointments, applications, tenancies and requested services. We rely on the relevant contract, legal obligation or legitimate interests in providing and administering those services.
Website operation and analytics
To operate and secure this website, resolve problems, understand property demand and improve our services. We rely on legitimate interests for necessary security and permitted limited statistics, and consent for analytics or marketing technologies where required. Our interests include maintaining a reliable website and understanding how its content and services are used.
Marketing
To send property or business updates in accordance with your choices and applicable law. We rely on consent where required. Any reliance on legitimate interests must also satisfy the separate rules governing the relevant marketing channel.
Records, compliance and disputes
To meet legal, regulatory, accounting and tax obligations, maintain appropriate evidence and establish, exercise or defend legal claims. We rely on applicable legal obligations and legitimate interests in keeping necessary records and protecting legal rights.
If a service requires special-category information, such as health information, or criminal-offence information, we must identify the additional legal condition required for that processing and provide relevant information at the point it is requested.
Website analytics
Where enabled, HOMESTEAD’s first-party analytics records how visitors use this website. Collection is enabled by default on the platform unless we turn it off. Collection is separate from whether we subscribe to reporting tools.
Information may include:
Pages, properties and rooms viewed.
Search and filter interactions, listing impressions and result counts.
Image and virtual-tour interactions.
Approximate engagement time, scroll depth and link or form interactions.
Referral source, device category and website performance.
Approximate country and, for UK visits, local-authority area.
Your network address is used temporarily on HOMESTEAD’s infrastructure to estimate location. The analytics system does not retain that address or network-derived city, postcode or precise coordinates. Location estimates may be inaccurate.
Limited pseudonymous statistics may be collected before you make a cookie choice. Choosing “Reject non-essential” stops this collection. Recognised Do Not Track and Global Privacy Control signals are also respected.
Live reporting uses signals when you enter a page, navigate or return to a visible tab, and approximately every 30 seconds while the page remains visible. Authorised users may see temporary visit rows showing the latest page, source, device, approximate location and last-seen time. A visit row does not by itself establish who a visitor is.
With analytics consent, longer-lived visit journeys and exact text entered into property-search fields may be retained and shown to authorised users. Please do not put confidential or unnecessary personal information into search fields.
Where separately enabled, a consented journey may be linked to the enquiry it produces, or visits using the same pseudonymous browser identifier may be grouped. A shared browser does not necessarily represent one person. Campaign attribution requires the relevant marketing choice.
HOMESTEAD also uses the collected website information for its own general analytics of websites using its platform.
Marketing choices
You can withdraw consent or object to direct marketing at any time by using the unsubscribe or preference link in a message, using available Portal preferences, or contacting us.
Where available, choices are recorded separately for each property brand and for email, SMS and telephone. Changing one preference does not necessarily change your choices for another brand or channel.
Opting out stops the selected marketing. We may retain minimal suppression information so that we can continue to respect your choice. Necessary service messages remain separate from marketing.
Where enabled, email delivery and engagement information may include deliveries, bounces, complaints, opens and clicks. Open measurements are approximate because email privacy features can generate or conceal them.
You have an absolute right to object to the use of your personal data for direct marketing, including related profiling.
Optional connected services
Browser notifications
If you enable Portal browser notifications, HOMESTEAD stores your notification preferences and the device subscription information needed to deliver them.
Notifications use the delivery service selected by your browser or operating system, which may be operated by Apple, Google or Mozilla. The service receives an encrypted message and delivery metadata.
Signing out does not necessarily stop notifications. Disable or remove the device in notification settings before leaving a shared device.
AI-assisted services
Where we use HOMESTEAD’s optional AI-assisted services, relevant instructions, permitted records or property images may be sent to OpenAI to help with administrative requests, reporting, property content or image processing.
Depending on the task, this may include names, contact details, addresses, ordinary administrative notes or messages. Optional aggregate reporting uses de-identified measurements rather than raw enquiries or individual payment records.
These services should not receive payment-card or bank-account details, identity-document numbers, login credentials or unnecessary highly sensitive information. Access restrictions and applicable review controls continue to apply.
OpenAI’s processing and retention arrangements are separate from HOMESTEAD’s. Immediate deletion and UK-only processing are not promised. Our use of these services does not remove our responsibility for the lawful handling of your information.
Technical support
If you contact HOMESTEAD directly for technical support, that conversation is private between you and HOMESTEAD and is not visible to us as your housing provider. Please contact us directly about properties, repairs, rent, applications and tenancy matters.
Who we share personal data with
Where necessary for the relevant purpose, recipients may include:
HOMESTEAD and its hosting, infrastructure, email, security and support providers.
Communications and property-administration providers.
Relevant landlords, authorised agents, guarantors or representatives involved in your application or tenancy.
Identity, referencing, compliance and fraud-prevention providers.
Maintenance contractors, inventory providers and other relevant tenancy-service providers.
Professional advisers, insurers and auditors.
Regulators, courts, law enforcement or other bodies where disclosure is required or justified by law.
Parties and advisers involved in a relevant property or business sale, transfer or restructuring.
Mailgun receives the addressing and message information needed to deliver platform emails and returns relevant delivery and, where enabled, engagement events.
HOMESTEAD uses a locally hosted DB-IP reference database for coarse analytics location estimates. DB-IP does not receive visitor lookup requests or network addresses from HOMESTEAD for those estimates.
Google and other connected website services may receive information as explained in the Cookie and Similar Technologies Notice below. OpenAI may receive information where relevant optional AI services are used.
We do not sell your personal data.
International transfers
Some providers may process personal data outside the United Kingdom.
Where a transfer requires protection under UK data protection law, we or HOMESTEAD use an applicable adequacy regulation or another lawful transfer mechanism, such as appropriate contractual safeguards.
You can contact us for information about the countries and safeguards relevant to your information, including how to obtain a copy of applicable safeguards.
How long we keep personal data
The following schedules apply to relevant records held through HOMESTEAD.
Enquiries and applications: normally six years from the later of the last meaningful activity or final outcome.
Tenancy records: where an applicant becomes a tenant, relevant enquiry records and core tenancy, guarantor, identity, compliance, document, payment, deposit and communication records are normally retained for six years after the tenancy ends.
Inventories and inspections: tenancy-linked evidence is normally retained for six years after the tenancy ends. Standalone property inventories are normally retained for six years after we record that our ownership or management of the property ended.
Viewing-access evidence: notices and written permissions follow the later applicable retention period for the related viewing or enquiry and any linked tenancy.
Marketing: a minimal marketing profile may be retained while explicit consent remains valid. The platform requires reconfirmation after the applicable 36-month inactivity period. Following an opt-out, only minimal suppression evidence is retained for marketing-preference enforcement.
First-party website analytics:
Temporary live-presence samples expire 20 minutes after the relevant minute ends, with background deletion following shortly afterwards.
Limited statistics-only raw events expire after 48 hours.
Consented journey records, associated raw events and optional enquiry links expire after approximately 13 months.
Consented exact search text expires after approximately three years.
De-identified daily aggregate reports expire after approximately five years.
Changing cookie choices removes available visitor or session identifiers and associated raw journey, enquiry-link and exact-search records. Previously produced de-identified daily totals cannot identify an individual visitor.
Browser notifications: subscriptions are disabled after approximately 90 days without activity. Secrets for revoked, expired or invalid subscriptions are deleted within approximately 30 days. Notification delivery records expire after approximately 90 days, while minimal non-secret audit evidence may remain for up to 12 months.
Optional AI-assisted administration: conversations and permitted reports may be retained for up to one year. A restricted, redacted excerpt from an unsuccessful request may also be retained for up to one year for service improvement. Separate structured accountability records may be retained indefinitely without conversation text or entered values. Different content-generation services and providers have their own applicable retention arrangements.
Other correspondence, security records and records held outside HOMESTEAD are retained according to their purpose, any applicable legal requirement and the need to resolve complaints or disputes. You can contact us for the schedule relevant to a particular record.
Legal holds may pause deletion. Expired live records are deleted or irreversibly anonymised, subject to protected backup cycles and continuing legal requirements. Retention schedules do not override applicable data protection rights.
Your rights
Depending on the processing involved, you may have the right to:
Access your personal data.
Correct inaccurate or incomplete information.
Request erasure.
Restrict processing.
Object to processing based on legitimate interests.
Receive or transfer certain information in a portable format.
Withdraw consent at any time.
Some rights depend on the circumstances and lawful basis. Your right to object to direct marketing is absolute.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, contact office@edenpropertymanagement.co.uk. We may need proportionate information to verify your identity before responding.
Complaints
Please contact us if you have concerns about how we handle your information.
You may also complain directly to the Information Commissioner’s Office. You do not have to complete our complaints process before contacting the ICO.
Contact the ICO or make a complaint.
Security
We and HOMESTEAD use appropriate technical and organisational measures, including access controls, authentication, logging and backups, to protect personal data.
No internet transmission or storage method is completely secure. Keep account credentials, support-access links and private document or inventory-review links confidential.
Changes to this notice
We will review this notice when our services, processing, suppliers or legal obligations change. The latest version will be published on this page.
Cookie and Similar Technologies Notice
Last updated: 15 September 2026
This notice explains how cookies and similar technologies are used on this website.
What these technologies do
Cookies are small files stored on your device. Similar technologies include browser storage, scripts, pixels and other mechanisms that store information on, or access information from, your device.
These technologies can support website operation, security, preferences, statistics, embedded services and marketing measurement.
Cookie settings
Necessary technologies
We use technologies needed to operate the website, protect forms, maintain security and remember privacy choices.
The hs_cookie_consent cookie stores your analytics and marketing preferences for 180 days. It does not record a list of the pages you visit.
HOMESTEAD may also use authentication, session and abuse-prevention technologies, including Google reCAPTCHA where enabled. The applicable consent requirements depend on the technology’s actual purpose and configuration.
HOMESTEAD first-party analytics
Where enabled, limited visit statistics may be collected before you make a choice. Choosing “Reject non-essential” stops this collection.
Longer-lived journey measurement and retention of exact property-search text require analytics consent. Campaign attribution requires the relevant marketing choice.
The Privacy Notice above explains the information collected, live reporting, optional enquiry links and retention periods.
Google Analytics and other measurement tools
Where enabled on this website, Google Analytics helps measure page views and website interactions. Google Tag Manager may be used to manage connected tags; the purposes and consent requirements depend on the tags it loads.
Advertising tools, such as Meta Pixel, may measure campaigns or conversions where enabled. Advertising and remarketing technologies require the relevant consent before use.
These optional tools are subject to the website’s consent controls. Their inclusion here does not mean that every tool is active on every page.
Google Maps
Where pages use Google Maps, loading the map may send technical information to Google and allow Google to store or access information on your device.
Where consent is required, the map should load only after the relevant choice. An embedded service may be unavailable until that choice is provided.
Google Fonts
This website loads its selected Google Fonts directly from Google. Font requests occur when the page loads and provide Google with technical request information, such as your network address, browser or device information, request time and referring page.
Forms and platform services
Website forms are handled through HOMESTEAD’s form-handling infrastructure. Relevant enquiry information is processed for Eden Property and its services as described in the Privacy Notice.
If you follow the “Powered by HOMESTEAD” link, the destination receives information identifying this website and its template. The link does not send your property-search details. Optional referral measurement on HOMESTEAD’s website uses a separate consent choice and does not enrol you in marketing.
Managing your choices
Use the website’s Cookie settings control to accept, reject or change optional preferences.
Reject non-essential stops optional analytics and marketing technologies and limited HOMESTEAD first-party visit statistics.
Analytics and marketing preferences can be managed separately.
You can revisit your choices.
Recognised Do Not Track and Global Privacy Control signals are respected by HOMESTEAD’s first-party analytics.
You can also delete or block cookies through your browser settings. Blocking necessary technologies may affect forms, sign-in or other requested services. Deleting preference cookies may cause the website to ask for your choices again.
How long technologies last
The HOMESTEAD preference cookie lasts for 180 days. Where marketing attribution is permitted, the platform’s attribution cookie lasts for up to 90 days.
Other session technologies may expire when your browser session ends. The duration of third-party technologies depends on the service and configuration in use.
Cookie expiry and server-side data retention are different. The Privacy Notice explains how long relevant information is retained after collection.
For further information about the technologies active on this website, contact office@edenpropertymanagement.co.uk.
Changes to this notice
We will update this notice when the technologies, purposes or privacy choices on this website change.