Last updated 15th May 2026
This notice explains how Grafton Asset Research Ltd collects, uses and protects personal information. In this notice, "we", "us" and "our" refer to Grafton Asset Research Ltd.
The data controller is Grafton Asset Research Ltd, whose registered office is at Crown Chambers, Princes Street, Harrogate HG1 1NJ, United Kingdom, and whose trading address is Studio 4 RVPB, John Archer Way, London SW18 3SX.
We are registered with the Information Commissioner's Office as a data controller under registration number ZA267630.
Grafton Asset Research Ltd provides research and tracing services across a number of areas, including:
• Identifying owners and heirs of vacant property and estates.
• Tracing missing freeholders and leaseholders in connection with property, enfranchisement and lease extension matters.
• Identifying persons entitled to unclaimed shares, dormant shareholdings and unclaimed dividends, including work for companies and their registrars or transfer agents.
• Tracing persons entitled to funds held by the courts (including funds held by the Court Funds Office) that have remained unclaimed, and assisting parties to court proceedings in locating other parties or beneficiaries.
• Other estate administration and asset reunification tasks for our clients.
To carry out this work we need to collect and use personal data about a number of categories of person. This notice explains what data we collect, why, and what rights you have in relation to it.
We obtain personal data from a range of sources, including:
• Public records, including the probate register, the Land Registry, Companies House and the electoral roll.
• Records of court proceedings and information made available by the courts and the Court Funds Office.
• Family history and genealogy services, including Ancestry and FindMyPast.
• Asset reunification and tracing services, including LexisNexis, which draw on credit reference agency data and other publicly available sources.
• Statutory authorities and regulators, including local councils.
• Publicly available sources such as websites, social media and media publications.
• Trusted third-party companies such as credit reference agencies and tracing firms.
• Clients and partner organisations that refer matters to us, or provide information in the course of a matter.
We process personal data about you where we, or a client of ours, has a legitimate interest in doing so or where another lawful basis applies. The categories of person whose data we process include:
• Proprietors, co-proprietors, freeholders or leaseholders of property, including property that is vacant, where the owner is missing, or that is involved in enfranchisement or lease extension proceedings.
• Relatives or next of kin of any of the above.
• Executors, administrators or personal representatives of a deceased estate.
• Beneficiaries of an estate.
• Shareholders, or persons entitled to a share, of a shareholding that has become dormant or of unclaimed dividends, together with related parties such as personal representatives of deceased shareholders.
• Persons entitled to all or part of a dormant pension, asset or unclaimed fund.
• Persons entitled to funds held by the courts (including funds held by the Court Funds Office) that have remained unclaimed.
• Parties to court proceedings, and other persons whose identification or location is relevant to those proceedings, where we have been instructed to assist.
• Persons who appear in trace results obtained from our data providers as residentially or financially linked to someone we are researching in one of the categories above. In the course of carrying out a trace, we may incidentally process limited personal data relating to other individuals who appear in trace results as linked to the person we are tracing. We hold such incidental data only to the extent necessary to identify the correct individual, do not use it for any other purpose, and do not disclose it to third parties.
Under the UK GDPR we must have a lawful basis for each type of processing we carry out. Our lawful bases are summarised in the table below.
|
Purpose |
Lawful basis |
|
Researching the ownership of vacant or unclaimed property; identifying executors, administrators, beneficiaries and next of kin; tracing missing freeholders and leaseholders; identifying persons entitled to unclaimed shares, dormant funds and other unclaimed assets; and tracing persons entitled to funds held by the courts. |
Legitimate interests (Article 6(1)(f) UK GDPR). |
|
Providing services to clients (including solicitors, estate administrators, registrars, transfer agents, companies and local authorities) under a contract or in connection with a prospective contract. |
Performance of a contract (Article 6(1)(b) UK GDPR). |
|
Identity verification, fraud prevention, anti-money laundering and other regulatory checks. |
Legal obligation (Article 6(1)(c) UK GDPR) and legitimate interests (Article 6(1)(f) UK GDPR). |
|
Responding to requests from data subjects and handling complaints. |
Legal obligation (Article 6(1)(c) UK GDPR). |
|
Keeping records for the period necessary to demonstrate that work was properly carried out, and to meet our legal, regulatory and tax obligations. |
Legal obligation (Article 6(1)(c) UK GDPR) and legitimate interests (Article 6(1)(f) UK GDPR). |
Where we rely on legitimate interests, we have considered the impact on the individuals concerned and concluded that the processing is necessary, proportionate, and unlikely to override their rights and interests. Individuals may object to processing carried out on the basis of legitimate interests at any time (see "Your rights" below).
Under the UK GDPR, certain types of personal data are treated as "special category data". These include information about health, religious or philosophical beliefs, political opinions, racial or ethnic origin, sexual orientation, trade union membership, genetic data and biometric data. Information about criminal convictions is also subject to additional protection.
We do not usually need to process this kind of data. If the need arose, we would only do so on the basis of your explicit consent or on another lawful condition permitted by the legislation.
We may share limited personal data with the following categories of recipient where there is a clear purpose and an appropriate lawful basis for doing so:
• Our clients (such as solicitors, estate administrators, companies, registrars and transfer agents, and local authorities) for the purposes of the work we are carrying out for them.
• The courts, the Court Funds Office and other tribunals or judicial bodies, where this is necessary for the matter we are working on.
• Statutory and regulatory authorities, including local councils.
• Professional and legal advisors.
• Trusted third-party companies, including credit reference agencies and tracing firms, in connection with asset reunification, fraud prevention, anti-money laundering checks and identity verification.
• Property referral partners under data sharing arrangements, where we report the outcome of research carried out at their request.
• Other companies within the Grafton group, where this is necessary to provide a coordinated service and where the receiving company has a lawful basis to receive the data.
We do not disclose to any of the recipients above the personal data of individuals who appear only incidentally in trace results (see "Categories of person whose data we process" above).
Beyond the disclosures described in this section, we will not disclose your personal data to third parties without your consent.
Some of the service providers we use may store or process personal data in countries outside the United Kingdom. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with the UK GDPR. These safeguards include transfers to countries the UK government has determined provide an adequate level of data protection, transfers made under the International Data Transfer Agreement, and transfers made under the UK Addendum to the EU Standard Contractual Clauses.
Some of the third parties we work with publish their own privacy notices, which explain how they handle personal data:
Ancestry: https://www.ancestry.co.uk/cs/legal/privacystatement
TransUnion: https://www.transunion.co.uk/legal/privacy-centre
LexisNexis: https://risk.lexisnexis.co.uk/processing-notices/business-services3
FindMyPast: https://www.findmypast.co.uk/help/sections/4411074088593-privacy-policy
We keep personal data only for as long as we need it. As a general rule:
• Personal data relating to a matter we are working on is retained for the duration of the matter, plus one year after its conclusion.
• Personal data of individuals who appear incidentally in trace results, and which is not used further, will be deleted at the close of the relevant matter.
• Some records may be retained for longer where we are required to do so by law, by a regulator, by a court, or for tax or audit purposes.
Under the UK GDPR you have a number of rights in relation to your personal data. In summary, you have the right:
• To be informed about how your personal data is processed.
• To request a copy of the personal data we hold about you (a "subject access request").
• To request that inaccurate or incomplete personal data is corrected.
• To request that your personal data is deleted, where we no longer have a lawful reason to retain it.
• To request that we restrict our processing of your personal data in certain circumstances.
• To object to our processing of your personal data where we rely on legitimate interests.
• To request that your personal data is transferred to you or to another organisation in a portable format, where this right applies.
• To lodge a complaint with the Information Commissioner's Office about how we have handled your personal data. The ICO can be contacted at ico.org.uk or on 0303 123 1113.
To exercise any of these rights, please contact us using the details below.
We do not use your personal data for marketing purposes.
It is important that the personal data we hold about you is accurate and up to date. If you would like to review, verify, correct or request the deletion of your personal data, object to its processing, or exercise any of your other rights, please contact us:
• By email: info@graftonassets.com
• By post: Data Controller, Grafton Asset Research Ltd, Studio 4 RVPB, John Archer Way, London SW18 3SX
We aim to respond to all requests within one calendar month, as required by the UK GDPR.
- End of notice -
Update your browser to view this website correctly. Update my browser now