Privacy Policy

1. Introduction

OMPTG is the data controller for your personal information. We treat your data confidentially and in compliance with UK data protection laws. This Notice outlines:

• What personal data we collect
• How we collect and use your personal data
• The legal grounds for processing your data
• Who we share your data with, including our third-party website analytics providers
• Your rights regarding your personal data
• How long we keep your data
• How we protect your data
• International data transfers
• How to contact us or raise complaints

2. What is personal data?

Personal data means any information relating to an identifiable individual, such as your name, contact details, date of birth, or financial information. Some data is classified as “special category” (e.g., health, ethnicity, religion), which requires additional protections under law.

3. What personal data do we collect?

We collect your name and contact details whenever you engage with us. For certain services, we may require identification documents (e.g., passport, driving licence) and proof of address (e.g., utility bill) to comply with legal obligations.

We may also check for any conflicts of interest by verifying if relatives or close connections work within our wider group.

If you subscribe to updates, we collect information about your sector and content preferences.

4. How we use your personal data

We process your data based on the following legal grounds:

• To fulfil our contract with you (e.g., property sales or purchases)
• To comply with legal obligations (e.g., anti-money laundering)
• Based on our legitimate interests, such as:
  • Promoting our services and sending relevant marketing communications (you may opt out anytime)
  • Improving our knowledge of the property sector via market research
  • Operating and securing our business systems
• With your explicit consent, for processing special category or criminal conviction data
• Where necessary to protect your or others’ vital interests or for public interest reasons

We may share your information with regulators, law enforcement, third-party service providers, and within our group on a strict need-to-know basis. If our business is sold or merged, your data may be transferred to the new owners under similar terms.

Failure to provide necessary data may affect our ability to deliver services or meet legal requirements.

5. Website analytics providers

To understand how visitors use our website, identify which pages load and which fail, measure the effectiveness of our marketing, and prioritise our product roadmap, we use two third-party analytics providers:Google Analytics 4 (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with data processed by Google LLC in the United States) andPostHog (operated by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, with EU customer data hosted in Frankfurt, Germany).

Purpose of processing. Aggregate behavioural insight — page-view counts, funnel drop-off, feature usage, error diagnosis, and campaign attribution. We do not use either provider for cross-site behavioural advertising, remarketing lists, or data enrichment sold to third parties.

Legal basis. This depends on the choice you make in our cookie banner, and we have set it out in full because the two cases genuinely differ.

If you choose “Allow analytics”: we rely on your consent (UK GDPR Article 6(1)(a)). Both Google Analytics 4 and PostHog receive events, and we may store a small identifier on your device so we can tell one visit apart from another. You can withdraw consent at any time from the “Manage cookie preferences” link in the site footer, and anything we stored is deleted when you do.

If you choose “Essential only”: nothing is collected. No events are sent to either provider, and anything previously stored is deleted. This is absolute — it is not a reduction in tracking, it is the end of it.

If you have not yet made a choice: Google Analytics 4 does not run at all. PostHog does — we count page views and record which steps of a journey were reached, so we can find what is broken and fix it. Our legal basis for this is our legitimate interests (UK GDPR Article 6(1)(f)) in understanding and improving our own website, and it is permitted without consent by paragraph 5 of Schedule A1 to the Privacy and Electronic Communications Regulations, which covers collecting statistics about how a website is used in order to improve it. We keep this deliberately narrow: no advertising, no remarketing, no profiling, no sale or sharing of the data, and none of it is linked to your name or email address. We also hold back the detailed device information (your exact screen size, full browser string and pixel ratio) that we would otherwise collect, because together those can identify a device. You can stop it at any time by choosing “Essential only”, or object under Article 21 by emailing steven@openforoffer.com.

The one cookie this sets, and how to stop it. While you have not chosen, we store a single cookie called ofo_stat_session — your browser may show it as LSKey-c$ofo_stat_session. It holds one random number and nothing else. Its only job is to let us tell one visit apart from another, so we can see whether someone got through a journey or gave up partway; without it, a person who reads five pages looks like five different people and we cannot tell a working page from a broken one. It ends 24 hours after it is set at the latest, and sooner if you stop browsing. To stop it, choose “Essential only” on the cookie bar or “Manage cookie preferences” in the footer — it is then deleted from your device. We never use it to recognise you on a later visit, to build a profile, to choose what you see, or to link your browsing to your name or email.

Data recipients. Google LLC (US), Google Ireland Limited (EU), PostHog Inc. (US). PostHog processes EU customer data on infrastructure located in Frankfurt.

International transfers. Google LLC transfers are covered by the EU–US Data Privacy Framework (Google LLC is certified) as extended by the UK–US Data Bridge for UK personal data. PostHog Inc. transfers rely on the UK Addendum to the EU Standard Contractual Clauses (2021 form). GA4 is configured with IP anonymisation enabled — the last octet of your IP address is truncated before storage.

Retention. Google Analytics 4 event and user data: 14 months (Open For Offer’s chosen setting; the GA4 default is 2 months and the maximum is 14 months). PostHog event data: 12 months. Both providers permanently delete data after the retention window.

Opt-out. Cookie banner → “Essential only”, or the “Manage cookie preferences” link in the site footer → turn Analytics off. Either one stops all analytics immediately: no events are sent to either provider from that point, and any identifier we stored is deleted from your device.

Why refusing still sets a cookie. Choosing “Essential only” stores one small cookie called cookie_consent, because without it we would have no record of your choice and would have to ask you again on every page. It holds your choice and the date you made it. There is no identifier in it and no browsing history. Storing it is permitted without consent by paragraph 4 of Schedule A1 to the Privacy and Electronic Communications Regulations, which covers storage that is strictly necessary to do the thing you have just asked us to do. If you refuse, we keep that record for 12 months — longer than a consent, because forgetting a refusal would quietly restart what you asked us to stop.

6. How we keep your data secure

We implement robust security measures to prevent unauthorised access, including restricted access controls, secure data storage, and staff training. Our systems are hosted in secure data centres with strict access protocols.

7. How long we keep your data

We retain your personal data only as long as necessary to provide our services, comply with legal obligations, or resolve disputes. Retention periods vary depending on the nature of the data and services provided. Retention for third-party analytics providers is set out in section 5 above.

8. International transfers

Your data may be transferred outside the UK or EEA. Where this occurs, we ensure appropriate safeguards, such as:

• Transfers to countries with an adequacy decision by the UK government (including the UK–US Data Bridge extension of the EU–US Data Privacy Framework)
• Use of standard contractual clauses approved by data protection authorities (including the UK Addendum to the EU SCCs, 2021 form)
• Binding corporate rules within our group

9. Your rights

You have the right to:

• Be informed about how your data is used
• Access and receive a copy of your personal data
• Correct inaccurate or incomplete data
• Request deletion of data in certain circumstances
• Restrict or object to processing where applicable
• Withdraw consent where processing is consent-based
• Not be subject to automated decision-making with significant effects

To exercise your rights, please contact steven@openforoffer.com. We keep records of your requests to comply with legal obligations.

10. Complaints and contact details

If you have concerns about our use of your data, contact our Customer Relations Officer atsteven@openforoffer.com. If unresolved, you have the right to complain to the UK Information Commissioner’s Office (ICO).

For any questions about this policy, please email steven@openforoffer.com.