Privacy Policy

WHOMA LIMITED (company number 14820252), 85 Great Portland Street, London, England, W1W 7LT is the controller for the processing described in this notice. Contact support@whoma.co.uk for privacy questions or to exercise a right.

This notice applies to visitors, account holders, agents, homeowners, support contacts, early-access leads and people whose information may appear in historical transaction records. WHOMA is intended for adults aged 18 or over.

We collect identifiers and account data such as name, email address, role, authentication and verification status; agent quiz answers, result category, profile-handover choices and limited campaign attribution; agent profile and professional information; property, instruction, proposal, shortlist, award and message data; support and complaint correspondence; security and audit records; and early-access choices.

The agent quiz can collect a required name and work email when you ask for a secure profile link, plus optional agency and phone details. An optional phone number is used only to prepare your private editable profile draft; taking the quiz does not give WHOMA permission to call, text or add the number to an advertising audience.

If you choose resume assistance, we process the file and extracted suggestions needed to return that result. Do not upload special-category data or other information that is not needed for your professional profile.

We receive most information directly from you. We may also receive professional or transaction information from another marketplace participant, public property datasets, authentication and email providers, or security and service logs. Legacy records may contain seller details previously supplied by an agent. The current completed-sale form does not collect seller names or contact details.

Some profile information is public only after the agent completes the relevant publication action. Marketplace information is otherwise limited to authorised participants and operators.

Agent quiz completion, the requested result email and secure profile handover, account creation, authentication, profile setup, requested resume assistance and core marketplace collaboration are processed to take steps at your request and perform our contract with you.

Service security, fraud and abuse prevention, audit trails, product reliability, support, complaints, and protecting users and WHOMA are processed for our legitimate interests, balanced against your rights. We also process information where necessary to comply with legal obligations or establish, exercise or defend legal claims.

Public profile publication and sharing are carried out at the agent's direction as part of the service. Homeowners, not WHOMA automation, make shortlist and award decisions.

Early-access or product marketing email is sent only under the specific consent recorded at collection, unless another PECR-compliant basis applies. Quiz profile-link and sign-in messages are requested service emails. The separate optional quiz marketing choice covers occasional WHOMA product and agent-opportunity updates, no more than twice a month; the current agent waitlist consent remains limited to one selected-area launch update.

Optional analytics and diagnostic technologies use consent. Essential security and service records are not dependent on analytics consent.

When you deliberately use support chat or resume assistance, WHOMA sends the minimum prompt, message or extracted document content needed to an AI service provider to provide the requested feature. Automated output may be incomplete or wrong and must be reviewed before you rely on or publish it.

These features do not make decisions that produce legal or similarly significant effects about you. Do not submit confidential, special-category or third-party personal data unless it is necessary and you are entitled to use it.

Essential cookies and local storage support authentication, quiz continuity, security, consent records, requested onboarding continuity and interface choices. Optional analytics remains off until you opt in.

With consent, our analytics provider may process pseudonymous page visits, feature use and diagnostic information, including masked recordings of how pages are used. Form values and page text are masked. You can withdraw consent from the Cookies Policy at any time; future optional collection then stops.

We disclose only what is needed to service providers acting for WHOMA, including providers of application and database hosting, authentication, transactional and consented email, user-requested AI assistance, and consented analytics. The Cookies Policy identifies the provider used for optional browser analytics.

Information may also be shared with authorised marketplace participants as the service requires, professional advisers, insurers, auditors, regulators, courts, law enforcement, or a buyer of the business where lawful. We do not sell personal data or share it for third-party advertising.

Some providers or their sub-processors may process data outside the UK. Where UK adequacy regulations do not apply, WHOMA uses an appropriate transfer mechanism such as the UK International Data Transfer Agreement or UK Addendum, together with relevant risk and security measures. Contact us for information about the safeguards relevant to your data.

We keep account, profile and core marketplace records while the account or workflow is active. Selected contract, audit, security and transaction records may then be retained for up to six years where needed for legal claims, accountability, fraud prevention or dispute handling, with access restricted and data minimised where possible.

Closed support and complaint correspondence is normally kept for up to 24 months. Resolved bug-report attachments follow a shorter operational schedule: normally 14 days after resolution, or up to 90 days while unresolved. Early-access lead data is kept until the relevant launch update is sent, consent is withdrawn, or the list is closed; a minimal suppression record may be retained to honour an unsubscribe.

An incomplete quiz session and an unbound profile-link request are normally deleted or anonymised after 30 days. A handover bound to an account may be retained for up to 24 months for acquisition measurement and support, while the resulting account and profile follow the ordinary account periods above. Resume suggestions stored in the signed browser cookie expire after 15 minutes. Onboarding drafts stored in your browser remain until onboarding completes, you clear them, or browser storage is cleared. Cookie and analytics periods are described in the Cookies Policy.

We may retain data for longer when a legal hold, active dispute, safety issue or statutory requirement applies, and delete or anonymise it when the purpose ends.

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You may also ask us to explain data received indirectly and challenge an automated decision; WHOMA does not currently make solely automated decisions with legal or similarly significant effects.

Email support@whoma.co.uk with the account email, public profile slug or relevant reference. We may need to verify identity and will normally respond within one month. If you are dissatisfied, you can complain to the UK Information Commissioner's Office.

Fields marked required are needed to create or secure an account or perform the requested workflow. The quiz result is available before contact details are requested. Name and work email are required only when you ask WHOMA to email a secure profile link; agency, phone, quiz marketing, public profile publication, early-access marketing, optional analytics and AI-assisted features remain optional.

WHOMA uses appropriate technical and organisational measures, including access controls, server-side validation, encryption in transit, monitoring, data minimisation and restricted provider access. No internet service can guarantee absolute security; report suspected misuse promptly.

We may update this notice as the service or law changes. We will provide an appropriate notice or request fresh consent where a material change requires it.