What happens to the details you send us

Who we are

The controller

The controller of your information is LANA NEILL ESTATES LTD, registered in Wales, company number 17431561, registered office 76 Corporation Avenue LLANELLI, SA15 3SR United Kingdom, D-U-N-S 235119600. Write to us at property@lananeillestates.life, with “Your data” in the subject, about anything on this page.

This notice covers the first-visit form, the mover’s account, any email you send us, and the technical side of visiting the site. It is written from the code that runs the site, so it lists what is really kept, not what might be.

Item by item

What the site keeps

Two storage areas belong to this site at Cloudflare: one for first-visit requests, one for mover’s accounts. Every kind of entry in them is below.

A first-visit request

What is in it: Your name, email and, if you give one, telephone; the postcode district, type of home and bedrooms; when you hope to move and good times to visit; your notes; your agreement to be contacted; the language of the page; the time it arrived, its reference and its status.
Why, and the lawful basis: To answer you and arrange a visit: steps you asked for before any contract (UK GDPR Article 6(1)(b)). Keeping a copy so a reply cannot be lost is in our legitimate interests (Article 6(1)(f)).
How long: Deleted automatically 180 days after it arrives. A request raised from an account is also deleted when the account is.

A mover’s account

What is in it: Your name and email; the language you chose; the day it was opened and the day you agreed to this notice; your password as a salted one-way hash (PBKDF2-SHA256, 100,000 rounds), from which the password cannot be read back; scrambled fingerprints of your sign-ins and of any reset link; the references of requests raised from it.
Why, and the lawful basis: To run the account you asked us to open (Article 6(1)(b)).
How long: Until you delete it from Settings, which removes everything listed in this section at once.

The address lookup

What is in it: A one-way scramble (SHA-256) of your email address, pointing to your account, so that signing in can find it without the address being stored as a name.
Why, and the lawful basis: Part of running the account (Article 6(1)(b)).
How long: As long as the account; deleted with it.

A sign-in

What is in it: Which account it opens, and when. The key in your cookie is kept only as a scramble, so a copy of the storage could not be used to sign in.
Why, and the lawful basis: Keeping you signed in (Article 6(1)(b)).
How long: 21 days, or until you sign out, change your password or delete the account.

A password-reset link

What is in it: Which account it resets, stored under a scramble of the link. The link itself is emailed to our own mailbox only, as “Where it goes” explains.
Why, and the lawful basis: Letting you back into your account (Article 6(1)(b)).
How long: One hour, or until it is used or replaced by a newer one.

Your completion-day plan

What is in it: The completion date you saved, the number of bedrooms being packed, the dated steps worked out from them, and when you saved it.
Why, and the lawful basis: A feature of the account you asked for (Article 6(1)(b)).
How long: Until you clear it or delete the account.

Your chain

What is in it: Whether you are selling, buying or both; the stages you ticked and the day of each; and, only once you instruct us, the stage we have reached on your sale.
Why, and the lawful basis: A feature of the account (Article 6(1)(b)).
How long: Until the account is deleted.

Your seller’s pack

What is in it: Whether the home is freehold, leasehold or not yet known; which items of the pack you ticked as gathered or as not applying, and the day of each. No documents: the papers stay with you.
Why, and the lawful basis: A feature of the account (Article 6(1)(b)).
How long: Until you clear it or delete the account.

Behind the forms

The technical side

Form stamps	Every form carries a short signed stamp of when the page was opened, so that robots posting at once can be turned away. It holds no personal data. The key that signs it is a random value stored once by the site.
Pacing	Cloudflare’s rate limiter counts attempts to send a form, sign in, open an account or reset a password for one minute, against one-way scrambles of the IP address and, where there is one, the email address. We store nothing about attempts. Basis: our legitimate interest in protecting accounts (Article 6(1)(f)).
Operating logs	Cloudflare keeps the site’s own logs of each request it handles, with short messages our code writes, such as a reference whose email could not be sent. They are used only to find faults, and Cloudflare deletes them after three days. Basis: legitimate interests (Article 6(1)(f)).
Page speed	On this domain, Cloudflare adds its Web Analytics script to each page. It reads from your browser how quickly the page loaded and reports those timings to Cloudflare, which shows them to us only as totals. It does not record the query part of an address, sets no cookie and stores nothing in your browser; Cloudflare says it collects no personal data with it and does not follow visitors from site to site. Cloudflare keeps the raw reports for seven days, then a sample of about a tenth for up to six months. If you would rather it did not run, a content blocker that blocks static.cloudflareinsights.com stops it, and the site works the same. Basis: our legitimate interest in pages that load quickly (Article 6(1)(f)).
Your email to us	A message you send us is kept in the company mailbox for as long as we need it to deal with what you asked, and at most a year if nothing comes of it.
If you instruct us	The details become part of that sale’s file. The identity checks and the file are kept for five years after the sale ends, as the Money Laundering Regulations 2017 require (Article 6(1)(c), a legal obligation).

Cookies

The site sets a single cookie, and only for a mover’s account. It is strictly necessary for the account to work, so there is no consent banner: there is nothing else to agree to. Nothing else on the site sets a cookie or stores anything in your browser; the page-speed script described above reads timings and stores nothing.

Name	`__Host-lne_mover`
Purpose	A random sign-in key that keeps you signed in to your account. Scripts on the page cannot read it, and it is sent only to this site, only over a secure connection.
Set	When you open an account, sign in, or set a new password from a reset link.
Lasts	21 days, or until you sign out, whichever comes first.

Who handles it

Where it goes

Cloudflare hosts the site and stores what it keeps, as our processor. Its network spans many countries, so a request can be handled in a data centre outside the United Kingdom; Cloudflare’s data processing agreement covers that with the transfer safeguards UK data protection law asks for.

Each first-visit request is saved here first, with its reference, and then emailed to our own mailbox, kept by our email provider as a processor. A password-reset request goes to the same mailbox with its one-hour link, and we pass the link on only in a reply to a message from the account’s own address. The site itself never emails account holders.

Only the company reads any of it. We do not sell it, share it for marketing or add it to any mailing list.

Your rights

You can ask to see what we hold about you and receive a copy, to have it corrected or deleted, to restrict how we use it or object to it, and to take it elsewhere. We answer within one month.

Account holders can delete everything themselves, at once, from the account’s Settings page; clearing the plan or the pack, or unticking a stage, takes effect immediately. Anyone else writes to property@lananeillestates.life.

If you are unhappy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

When this notice changes

The new version replaces this page, and the forms and the account pages link to it. This version was written on 13 November 2026.

Back to the first-visit form Your account