Skip to content

Privacy Policy

This policy covers the public Kotta website: what it collects when you use it or fill in a form, why, and what you can ask us to do about it.

Last updated
17 August 2026
Operator
Longrad Ltd (company number 08560970)

1. Who is responsible

Longrad Ltd is the data controller for the personal information described in this policy. We are registered in England and Wales under company number 08560970, at 23 Berkeley Square, Mayfair, London, W1J 6HE, United Kingdom.

We are registered with the Information Commissioner’s Office as a data controller under registration ZA123757.

This policy covers the public Kotta website. If you use the Kotta application as a customer, or if you have been sent a property selection by an adviser who uses Kotta, separate information applies to that use and to the material within it.

2. What we collect

When you fill in a form

The contact form and the request-access form collect what you type into them. Depending on the form, that is:

  • your name;
  • your work email address;
  • your company;
  • your role, company website and country, if you give them;
  • an approximate band for how many property searches you are running, if you give it;
  • whatever you write in the message box; and
  • the fact that you ticked the privacy acknowledgement.

Technical information

When you submit a form we also store, alongside the submission:

  • a one-way hash of your IP address, not the address itself. It is salted and truncated, which lets us recognise repeated abuse of the form without keeping a record of where you were; and
  • your browser’s user-agent string, for the same reason.

Our hosting provider processes the usual request information — including IP addresses — in order to serve the site and protect it, and keeps short-lived operational logs. We do not hold those logs ourselves.

Analytics

None. This site runs no analytics, no advertising tags and no third-party tracking scripts, and it sets no cookies. See our Cookie Policy. If that changes, this policy and that one will be updated first, and non-essential cookies will not be set before you agree to them.

3. Why we use it, and our lawful basis

  • To reply to an enquiry you send us. Lawful basis: legitimate interests — it is in both our interests that a message you deliberately sent us gets an answer.
  • To assess a request for access to Kotta and discuss it with you. Lawful basis: steps taken at your request before entering into a contract; and our legitimate interest in deciding who to open the product to.
  • To operate and secure the website, including limiting abuse of the forms. Lawful basis: legitimate interests — keeping a public form usable.
  • To keep business records and comply with the law. Lawful basis: legal obligation, and legitimate interests in administering our business.

Where we rely on legitimate interests, we have considered the effect on you, and you can object at any time — see section 7.

4. Marketing

We do not currently send marketing emails from this website, and nothing on it is a subscription form. If that changes:

  • no consent box will ever be pre-ticked;
  • every message will carry a working unsubscribe link; and
  • unsubscribing will not affect our reply to an enquiry you have already sent.

We do not sell personal information, and we do not share it with third parties for their own marketing.

5. Who else handles it

We use a small number of service providers who process this information on our instructions, under contract:

  • Hosting — Vercel Inc., which serves this website and runs the code behind the forms.
  • Database — Neon Inc., which hosts the database in which submissions are stored. The database region is London.
  • Email delivery — Resend, which delivers a copy of your submission to our inbox.

We may also disclose information where we are required to by law, or to establish, exercise or defend legal claims.

6. Where it is held

Submissions are stored in a database hosted in London. Some processing by our hosting and email providers takes place on infrastructure outside the United Kingdom, including in the United States. Where personal information is transferred outside the UK, we rely on UK adequacy regulations or on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, together with appropriate safeguards.

7. How long we keep it

  • Enquiries and access requests we do not take further — up to 24 months from our last contact with you, then deleted.
  • Enquiries that become a business relationship — for the life of that relationship, and then for six years afterwards, which is the period in which a claim could ordinarily be brought.
  • Hashed IP addresses and user-agent strings — kept with the submission they belong to and deleted with it.

We delete sooner if you ask us to and we have no reason to keep it.

8. Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal information we hold about you;
  • have inaccurate information corrected;
  • ask us to erase it;
  • ask us to restrict how we use it;
  • object to our use of it where we rely on legitimate interests, including for direct marketing, which you can stop at any time;
  • ask us to transfer it to you or another provider, where the right to data portability applies; and
  • withdraw consent, where we rely on consent, without affecting what came before.

To exercise any of these, write to info@longrad.com. We will respond within one month.

You can also complain to the Information Commissioner’s Office — ico.org.uk or 0303 123 1113 — though we would rather you came to us first so we can put it right.

9. Changes to this policy

We may update this policy. The date at the top of this page shows when it last changed, and the version published here is the one that applies.

10. Contact

Longrad Ltd
23 Berkeley Square, Mayfair, London, W1J 6HE
United Kingdom
info@longrad.com