Privacy Policy

This notice applies to luna-property.co.uk, public enquiries and, when released, the Luna Property client portal.

The primary UK controller is Luna Property Developments Ltd, company number 17016985, registered at 19 Repton Court, Basildon, Essex, SS13 1LN, United Kingdom. Luna Home Ltd, registration number 9537685, supports Nigerian operations and may act as a controller for local processing connected with Nigerian developments.

Privacy enquiries and rights requests may be sent to info@luna-property.co.uk.

Depending on how you use our services, we may collect:

• name, email address, telephone number, country, preferred contact method and enquiry details;
• property interests, budget range, purchase objectives and communications with our team;
• account, authentication, approval, booking and portal activity where portal access is enabled;
• identity, proof-of-address, source-of-funds and transaction documents submitted through a secure channel;
• reservation, payment, allocation, contract and accounting records;
• technical and security data including IP address, browser, device, timestamps and audit logs;
• cookie preferences and marketing choices.

Do not send passports, driving licences, bank statements or other sensitive documents through the public contact form or WhatsApp.

We process information only where we have a lawful basis. Depending on the activity, this may include taking steps at your request before a contract, performing a contract, complying with legal obligations, pursuing legitimate interests that do not override your rights, or obtaining consent.

• responding to enquiries and arranging appointments;
• presenting suitable property information and managing buyer relationships;
• creating and protecting accounts and administering private portal services;
• conducting identity, fraud-prevention, sanctions, source-of-funds and buyer-review checks where appropriate;
• processing reservations, payments and transaction records;
• maintaining security, preventing misuse and investigating incidents;
• meeting accounting, legal, regulatory and dispute-resolution obligations;
• sending optional marketing only where permitted and providing an unsubscribe route.

Information may be shared only where necessary with authorised staff, the relevant Luna entity, developers, professional advisers, payment and banking providers, hosting and technology suppliers, regulators, courts, law-enforcement bodies or parties involved in a corporate transaction.

Current or planned service providers may include Supabase, Cloudflare R2, Cloudinary, Resend, Vercel and Flutterwave. These providers process information under their own contractual and security arrangements. We do not sell personal information.

Our work connects the United Kingdom and Nigeria, and service providers may process information in other countries. Where personal information is transferred internationally, we will use an available legal mechanism and proportionate safeguards, such as adequacy regulations, contractual protections, transfer risk assessments or another lawful basis.

We keep information only for as long as reasonably necessary for the purpose collected and for legal, accounting, security and dispute requirements.

• general enquiries: normally up to 24 months;
• client and transaction correspondence: for the relationship and normally six years afterwards;
• contracts, payment and accounting records: normally six years or longer where law requires;
• buyer-review and anti-fraud records: according to applicable legal and risk requirements;
• security and audit logs: normally 12 to 24 months;
• marketing suppression records: for as long as needed to respect an opt-out.

We use proportionate technical and organisational measures, including authentication controls, role-based access, row-level database rules, private storage, time-limited download links, validation, encryption in transit, logging and restricted administrator access.

No internet service is risk-free. Users should protect credentials and report suspected unauthorised access promptly.

Subject to the law that applies, you may have rights to be informed, access your information, correct it, request deletion or restriction, object to certain processing, withdraw consent, receive portable data and complain to a regulator.

UK concerns may be raised with the Information Commissioner’s Office. Nigerian concerns may be raised with the Nigeria Data Protection Commission. Please contact us first where possible so we can investigate promptly.

Necessary technologies support security, authentication and saved preferences. Optional analytics or marketing technologies must not be activated until the relevant choice is recorded. See our Cookie Policy.

You can unsubscribe from marketing at any time. Service messages connected with an enquiry, booking, reservation or account are not marketing messages.

We may update this notice when our services, providers or legal obligations change. Material changes will be highlighted on the website or communicated directly where appropriate.