CoStar Privacy Policy

The privacy of your information is important to CoStar. We provide this privacy policy explaining our online information practices and the choices you can make about the way CoStar collects, uses and protects your personal information.

We respect your right to privacy and will only process personal information you provide to us in accordance with applicable data protection laws and regulations, including the General Data Protection Regulation (“GDPR”).

We use your personal information in order to provide our products and services to you, including by incorporating your personal information in our products and services in certain cases. We also use your personal information to send you communications unless you have indicated otherwise.

You have certain rights under GDPR, including a right to object to our use of your personal information in some circumstances. These rights are described further in this privacy policy.

Please read this privacy policy in full to ensure you understand its contents and how we use your personal information. If you have any questions about this privacy policy, please contact us at gdpr@costar.co.uk.

1. Who We Are

CoStar UK Limited is a company registered in England and Wales (registration number 01789170), whose registered office is 26th Floor, The Shard, 32 London Bridge Street, London, SE1 9SG and we are the data controller of the personal information that we collect from you.

2. Personal Information and Application of Privacy Policy

This privacy policy provides users of www.costar.co.uk (the “Site”) and services provided by CoStar UK Limited and its affiliates (collectively, “CoStar” or “we” or “us”) with information about how CoStar collects, uses and discloses personal information.

Personal information is information about an identifiable individual. This includes items such as your name, email address, IP address, username or identifier. We set out in the following section details of the specific items of personal data which we collect and use.

The Site and the products licensed to you by us ("Licensed Product" or "Service") contain links to other websites operated by third parties. CoStar has no control over, and is not responsible for the privacy practices or policies of such third party websites and this privacy policy does not apply to those websites. By clicking on third party links you expressly relieve CoStar from any and all liability arising from your use of such third party sites.

3. How We Collect, Store and Use Your Information; Lawful Bases

CoStar offers a variety of different products. Below is a list of our products and services we provide and a description of how we collect, store and use personal information we obtain from you and the lawful basis under which we are processing your personal information, if any. In addition, certain of our uses, collection methods and ways in which we store your information apply to all of our products and are listed at the end of this section.

a) CoStar Suite

Through our CoStar Suite product, we gather personal information from CoStar Suite users (including users operating on free trials), CoStar News users (who receive access through the CoStar Suite product) and individuals associated with the administration of the license agreement between the firm with whom these users are employed and CoStar.

We collect the following types of personal information from these individuals:

  • First Name
  • IP Address
  • Photographs
  • Email Address
  • Device Location
  • Cookie IDs
  • Geographies Viewed
  • Surname
  • Business Address
  • Job Title
  • Authentication
  • FaceTime ID
  • Logon Activity
  • Company Name
  • Mobile Number
  • Nickname
  • Username
  • Dates Logged On
  • LinkedIn ID
  • Marketing Preferences
  • Logon Credentials
  • Telephone Number(s)
  • Password hash (pseudonomised)
  • Properties Viewed
  • Product Modules Viewed

We collect this personal information in the following ways:

  • Extracting information from your CoStar subscription agreement and contract proposals
  • Documenting information obtained by our CoStar sales and client services people and our other CoStar representatives either through email, over the telephone or at various CoStar meetings or events
  • Cataloguing information as a result of our marketing activity to you
  • Monitoring and logging information relating to your product usage (e.g. property views, logon activity, Cookie ID’s, IP address, device geolocation)
  • Following your use of social media and other external websites relating to CoStar

We use this personal information for the purpose of:

  • Delivering the CoStar Suite services
  • Marketing and selling other CoStar products and services
  • Advising clients of CoStar product enhancements and improvements
  • Training clients
  • Tracking usage and providing appropriate training and product demonstrations to our users and prospects
  • Product development
  • Identifying unauthorised usage
  • Constructing attendee lists for CoStar events
  • Creating and displaying an entry in the CoStar Professional Directory, including your name, business address, map of address, telephone number, and deals information.
  • Creating and displaying “Dealmakers” information
  • Developing, testing and maintaining the CoStar Suite product

Storage of personal information

We store your personal information on CoStar’s servers located in data centers in the United States (on production, development, test, backup and training servers). Your personal information is also stored on local file servers in the United Kingdom.

Lawful basis for data processing

To the extent that we are processing your personal information in order to deliver the CoStar Suite service, the lawful basis under which we are doing so is it is necessary for the performance of a contract.

The lawful basis under which we are processing personal information in all other circumstances outlined above is legitimate interests. Those legitimate interests are to facilitate enhancements and improvements to the software available to our clients, determine client training needs, market the services of our clients (through DealMakers and the CoStar Professional Directory) to other subscribers to the product, protect our business against copyright and database infringement and market other CoStar products and CoStar events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

b) CoStar News

In addition to providing our CoStar News service through CoStar Suite (see above), we also provide the CoStar News service through the following three outlets: the Daily News Bulletin, Breaking News Bulletin and Finance News Bulletin. Through these outlets, we gather personal information from CoStar News subscribers as well as free CoStar News recipients.

We collect the following types of personal information from these individuals:

  • First Name
  • Surname
  • Business Name
  • Email Address
  • IP Addresses

We collect this personal information in the following ways:

  • Extracting client details from our internal customer relationship management system and client contracts/client emails
  • Ad hoc adding by sales person (e.g., from a prospective client)
  • Incoming requests from recipients (via email or phone)
  • Past registrations to the CoStar News service

We use this personal information for the purpose of sending our news bulletin, through our third party email platform, on a daily basis for the Daily News Bulletin; 4-5 times a week for the Breaking News Bulletin; and on a weekly basis for the Finance News Bulletin. In addition, (i) our Marketing team sends marketing campaigns to news recipients, (ii) our Sales team uses the details as a source for leads and (iii) our Events team uses the details as a source for invitations to CoStar events.

Storage of personal information

We store your personal information within our internal customer relationship management system. We also store your personal information at a third party marketing platform location, which is a cloud-based service provider which tracks information regarding our marketing campaigns.

Lawful basis for data processing

To the extent that we are processing your personal information in order to deliver CoStar News to you as part of your CoStar Suite service, the lawful basis for doing so is that this is necessary for the performance of our contract with you.

For individuals with non-corporate email addresses receiving CoStar News Bulletins, we will obtain your consent to process your personal information to send you CoStar News Bulletins and any other direct marketing materials.

The lawful basis under which we are processing personal information in all other circumstances outlined above is legitimate interests. Those legitimate interests are to provide commercial property news stories to those within the industry and to market other CoStar products and events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

c) Shopproperty

Through our Shopproperty product, we gather personal information from current Shopproperty subscribers, registered users (who sign up via a web form on the Shopproperty site) and non-Shopproperty subscribers (those who browse the Shopproperty site but are not registered).

Current Shopproperty subscribers

We collect the following types of personal information from current Shopproperty subscribers:

  • First Name
  • Email Address
  • Session ID(s)
  • Surname
  • Staff Code
  • Cookies
  • Business Name
  • IP Addresses
  • Business Address
  • Telephone Number(s)

We collect this personal information in the following ways:

  • Extracting information from your Shopproperty subscription agreement
  • Extracting information added by your company administrators into the Shopproperty site
  • Receiving emails or phone calls from clients with updated contact information

We use this personal information to:

  • Permit you to list your properties on Shopproperty
  • Create an entry for you in the Shopproperty directory
  • Permit subscribers to market retail properties to you
  • Market, prospect and sell other CoStar products and services
  • Allow you to receive retail property marketing communications from other subscribers
  • Monitor your usage in conjunction with our anti-piracy programme

Storage of personal information

For current Shopproperty subscribers, we store your personal information in our UK data centre and on back-ups servers also located in the UK. Your personal information may be saved on local file servers and personal computers in the United Kingdom.

Lawful basis for data processing

To the extent we process your personal information in order to provide you with services associated with your Shopproperty subscription, the lawful basis for doing so is necessary for the performance of our contract with you.

For all other reasons stated above as to how we use your personal information, the lawful basis under which we are doing so is legitimate interests. Those legitimate interests are to enable our subscribers to market their retail properties online, protect our business against copyright and database infringement and market other CoStar products and events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

Registered users

We collect the following types of personal information from registered users:

  • First Name
  • Title
  • Session ID(s)
  • Surname
  • User Name
  • Cookies
  • Business Name
  • IP Addresses
  • Business Address
  • Telephone Number(s)

We collect this personal information in the following ways:

  • Receiving information via a web registration form completed by you
  • Receiving information updated by the user on the “My profile” page on the Shopproperty site
  • Receiving emails or phone calls from clients with updated information

We use this personal information to:

  • Send daily alerts based on user preferences
  • Send marketing emails on behalf of third parties
  • Market, prospect and sell other CoStar products and services
  • Provide your contact information to agents of properties you have viewed

Storage of personal information

For registered users, we store your personal information in our UK data centre and on back-ups servers also located in the UK. Your personal information may be saved on local file servers and personal computers in the United Kingdom.

Lawful basis for data processing

To the extent we process your personal information in order to provide you with services associated with your Shopproperty registration (such as sending daily alerts based on your preferences), the lawful basis for doing so is that it is necessary for the performance of the contract.

For registered users using personal email providers to register on Shopproperty, we will obtain your consent to process your personal information to send you Shopproperty daily alerts and marketing emails.

The lawful basis under which we are processing personal information in all other circumstances outlined above is legitimate interests. Those interests are to enable our subscribers to market their retail properties online, provide our subscribers with lead generation information in respect of those who have viewed particular retail properties and market CoStar’s other products and services.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

Non-Registered users of the Shopproperty website

We collect the following types of personal information from non-registered users of the Shopproperty website:

  • Email addresses
  • Browser activity
  • IP Address
  • Cookies
  • Log on Time

We collect this personal information in the following ways:

  • Receiving information through web logs of the users’ use of the Shopproperty site
  • Receiving information directly from a non-client (e.g., from a prospective Shopproperty sale)
  • Receiving a direct request from the non-subscriber to add details to the Shopproperty directory (e.g. details for retail agents, property companies, developers and investors)
  • Receiving emails or phone calls from contacts on the directory with updated contact information or to add a non-subscriber to the database.

We use this personal information to supplement the Directory that is visible to everyone who subscribes to the Shopproperty service. In addition, we use this personal information to:

  • Send property advertising emails
  • Send direct email and postal marketing (marketing other CoStar products and services as well as Shopproperty product enhancements)
  • Identify sales opportunities
  • Invite people to CoStar marketing events
  • Monitor usage of the Shopproperty Site

Storage of personal information

For non-registered users of the Shopproperty website, we store your personal information in our UK data centre and on back-ups servers also located in the UK. Your personal information may be saved on local file servers and personal computers in the United Kingdom.

Lawful basis for data processing

The lawful basis under which we are processing your personal information is legitimate interests. Those interests are to enable our subscribers to market their retail properties online, protect our business against copyright and database infringement, market enhancements to Shopproperty and market other CoStar products and events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

d) Propex

Through our Propex product, we gather personal information from Propex subscribers (i.e. individuals working for companies who subscribe to Propex and who have access to the Propex product) and non-Propex subscribers (i.e., professional UK investments agents whose personal information has been added to the Propex directory over time).

We collect the following types of personal information from these individuals:

  • First Name
  • Job Title
  • Qualifications
  • IP Address
  • Surname
  • Photograph
  • Narrative Profile
  • Company Name
  • Email Address
  • Fax Number
  • Responsibilities
  • Telephone Number(s)
  • Company Website
  • Company Address (branch)

Propex Subscribers

For Propex subscribers, we collect this personal information in the following ways:

  • Extracting information from your Propex subscription agreement
  • Extracting information added by your company administrators into the Propex site
  • Extracting information from your company’s website
  • Receiving emails or phone calls from clients with updated contact information

For Propex subscribers, we use this personal information to provide the Propex service, which is a directory visible to everyone who subscribes to the Propex service. In addition, we use this personal information to:

  • Send out property advertising emails
  • Send direct email and postal marketing (marketing other CoStar products and services as well as Propex product enhancements)
  • Identify sales and training opportunities
  • Arrange product feedback sessions
  • Create lists of potential attendees at CoStar events and invite them to those events, and
  • Create and maintain a customer relationship management system

Storage of personal information

For Propex subscribers, we store your personal information in our UK data centre (there are multiple versions covering production, staging and training). Back-ups for these servers are retained on servers in our offices in the UK. We also retain a copy of your personal information on our UK network for mail merging purposes.

Lawful basis for data processing

To the extent we process your personal information in order to provide you with services associated with your Propex subscription, the lawful basis under which we are doing so is it is necessary for the performance of a contract.

The lawful basis under which we are processing personal information in all other circumstances outlined above is legitimate interests. Those legitimate interests are to facilitate enhancements and improvements to the software available to our clients, market the services of our clients to other subscribers to the product, protect our business against copyright and database infringement and market other CoStar products and events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

Propex non-subscribers

For Propex non-subscribers, we collect this personal information in the following ways:

  • Receiving information directly from a non-client (e.g., from a prospective Propex sale)
  • Receiving a direct request from the non-subscriber to add details to the Propex directory (e.g. details for investment agents, property companies, developers and investors)
  • Receiving emails or phone calls from contacts on the directory with updated contact information or to add a non-subscriber to the database.

For Propex non-subscribers, we use this personal information to supplement the Propex directory that is visible to everyone who subscribes to the Propex service. In addition, we use this personal information to:

  • Send property advertising emails
  • Send direct email and postal marketing (marketing other CoStar products and services as well as Propex product enhancements)
  • Identify sales opportunities, and
  • Invite people to CoStar marketing events

Storage of personal information

For Propex non-subscribers, we store your personal information in our UK data centre (there are multiple versions covering production, staging and training). Back-ups for these servers are retained on servers in our offices in the UK. We also retain a copy of your personal information on our UK network for mail merging purposes.

Lawful basis for data processing

The lawful basis under which we are processing your personal information is legitimate interests. Those interests are to facilitate the marketing of investment properties by our subscribers, to market enhancements to Propex and market other CoStar products and events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

e) Direct Marketing

Through our direct marketing, we gather personal information from clients and prospective clients of any CoStar product. We collect the following types of personal information from these individuals:

  • First Name
  • Surname
  • Company Name
  • Email Address
  • Telephone Number(s)

We collect this personal information in the following ways:

  • From our third party email provider, web-based forms completed by clients who have accessed the form through an email from CoStar, a link through a social media post, costar.co.uk or a search engine
  • From emails or phone calls from clients or other contacts
  • From third party professional conference organisers

We use this personal information to send direct marketing email campaigns about CoStar’s products and services through our third party email marketing platform. We also use your personal information for printed direct mail campaigns.

Our direct marketing campaigns typically invite recipients to complete a web-based landing page form in order to receive a piece of market insight. Details of who has completed the form are recorded on our behalf by another third party email provider so we are able to assess how successful a campaign has been. We will use personal information captured through the landing page form to send future direct marketing emails about CoStar’s products and services.

Storage of personal information

We store your personal information with a third party email marketing provider who retains personal data from a particular campaign in respect of every individual who has received that email campaign. Where an individual completes a web-based landing page form, the personal data captured by that form is recorded and retained by a separate third party email marketing provider. In both cases these third parties are data processors under the definitions of GDPR and neither uses the personal data captured by them on behalf of CoStar for any other purpose. We also store your personal information within our internal customer relationship management system.

Lawful basis for data processing

To the extent that you are a current or former client or a prospect and you have a business email address, then the lawful basis under which we are processing your personal information for the purposes of receiving direct marketing is legitimate interests. Those legitimate interests are to market CoStar’s products and services, including CoStar’s events and to enable us to assess how successful a campaign has been. On every landing page form we will always provide you with the opportunity to unsubscribe from receiving future email marketing campaigns from us.

To the extent that you use a personal email address, we will obtain your consent to process your personal information for the purposes of receiving direct marketing.

f) Advertising

CoStar provides several email advertising products:

In respect of our Auction Marketing, First Rate, Investment Development and Third Party Advertising email advertising products, we gather personal information from individuals whose details are on our Propex and Shopproperty database and who are most likely to be either a commercial or private investor.

In respect of our Secondary Corporate Marketing email advertising product, we gather personal information from individuals whose details are on our Shopproperty or Propex databases.

In respect of our Weekly Property Marketing email advertising product, we gather personal information from individuals whose details are on our Propex database and who are most likely to be either a commercial or private investor.

Through our Retail email advertising product, we gather personal information from individuals whose details are on our Shopproperty Database and who will be either commercial or private individuals.

We collect the following types of personal information from these individuals:

  • First Name
  • Surname
  • Email Address
  • IP Address

We collect this personal information in the following ways:

  • from meetings and telephone calls or emails made by/to individuals which we upload to the Propex or Shopproperty database. Some contacts within the Propex database are contained within the Propex directory, which is a directory visible to those who subscribe to the Propex product

We use your personal information when extracting the data from the Propex and Shopproperty databases (as applicable), uploading the information into our third party email advertising platform and sending advertising emails periodically.

Storage of personal information

We store your personal information in our Propex and Shopproperty databases which are housed in servers located in the UK. Back-ups for these servers are retained on servers in our offices in the UK. Your personal information is also stored by our third party email marketing platform on its services located in the European Union. This third party is a data processor under the definitions of GDPR and does not use the personal data captured by them on behalf of CoStar for any other purpose. We also retain a copy of your personal information on our UK network for mail merging purposes.

Lawful basis for data processing

To the extent that you use a personal (i.e. a non-corporate) email address, we will obtain your consent to process your personal information for the purposes of receiving email advertising.

In all other cases, the lawful basis under which we are processing this personal information is legitimate interests. These legitimate interests are to advertise commercial properties, auctions and requirements, as well as companies working in the commercial property market, to participants and advisors in that market.

g) Showcase

With respect to our Showcase product, we gather personal information about both subscribers to Showcase as well as individuals who visit our Showcase website.

Showcase subscribers

Through our Showcase product, we gather personal information from Showcase users individuals associated with the administration of the license agreement between the firm with whom these users are employed and CoStar.

We collect the following types of personal information from these individuals:

  • First Name
  • IP Address
  • Photographs
  • Email Address
  • Device Location
  • Cookie IDs
  • Geographies Viewed
  • Surname
  • Business Address
  • Job Title
  • Authentication
  • FaceTime ID
  • Logon Activity
  • Company Name
  • Mobile Number
  • Nickname
  • Username
  • Dates Logged On
  • LinkedIn ID
  • Marketing Preferences
  • Logon Credentials
  • Telephone Number(s)
  • Password hash (pseudonomised)
  • Properties Viewed
  • Product Modules Viewed

We collect this personal information in the following ways:

  • Extracting information from your Showcase subscription agreement and contract proposals
  • Documenting information obtained by our CoStar sales and client services people and our other CoStar representatives either through email, over the telephone or at various CoStar meetings or events
  • Cataloguing information as a result of our marketing activity to you
  • Monitoring and logging information relating to your product usage (e.g. property views, logon activity, Cookie ID’s, IP address, device geolocation)
  • Following your use of social media and other external websites relating to CoStar

We use this personal information for the purpose of:

  • Delivering the Showcase services
  • Marketing and selling other CoStar products and services
  • Advising clients of CoStar product enhancements and improvements
  • Training clients
  • Tracking usage and providing appropriate training and product demonstrations to our users and prospects
  • Identifying unauthorised usage
  • Constructing attendee lists for CoStar events
  • Creating and displaying an entry in the CoStar Professional Directory, including your name, business address, map of address, telephone number and deals information.
  • Creating and displaying “Dealmakers” information
  • Developing, testing and maintaining the Showcase product

Storage of personal information

We store your personal information on CoStar’s servers located in data centers in the United States (on production, development, test, backup and training servers). Your personal information is also stored on local file servers in the United Kingdom.

Lawful basis for data processing

To the extent that we are processing your personal information in order to deliver the CoStar Suite service, the lawful basis under which we are doing so is it is necessary for the performance of a contract.

The lawful basis under which we are processing personal information in all other circumstances outlined above is legitimate interests. Those legitimate interests are to facilitate enhancements and improvements to the software available to our clients, determine client training needs, market the services of our clients (through DealMakers and the CoStar Professional Directory) to other subscribers to the product, protect our business against copyright and database infringement and market other CoStar products and CoStar events.

If you wish to have more information regarding the legitimate interests assessment we have conducted in order to reach this conclusion please contact us at gdpr@costar.co.uk.

Visitors to Showcase website

We collect the following types of personal information from these individuals:

  • IP addresses

We collect this personal information by monitoring and recording your use of the Showcase website.

We use this personal information in the following ways:

  • Match the IP addresses to a domain register so that we can create reports to show our clients who has viewed their Showcase listings
  • Monitor usage of the Showcase service for tracking purposes to ensure compliance with your agreement

Storage of personal information

We store your personal information on CoStar’s servers located in data centers in the United States. Your personal information is also stored on local file servers in the United Kingdom.

Lawful basis for data processing

The lawful basis under which we are processing this personal information is legitimate interests. Those interests are to provide our subscribers with lead generation information in respect of those who have viewed particular properties.

h) Listing Agents and Corporate Tenants and Landlords

We permit agents to list properties for lease or sale through our CoStar Suite product (“Listing Agents”). We gather Listing Agents’ personal information through agents, owners, property managers, developers, asset managers, architects and council employees. We gather corporate tenants’ (e.g., CEOs, Finance Directors, Facilities coordinators, branch managers) and corporate landlords’ personal information (collectively, “Corporate Tenants and Landlords”).

Listing Agents

We collect the following types of personal information about Listing Agents:

  • First Name
  • Fax Number
  • Photograph
  • IP Address
  • Surname
  • Mailing Address
  • Business History
  • Logon History
  • Email Address
  • Job Title
  • Credentials
  • Phone call recordings
  • Telephone Number(s)
  • Search History
  • Prior Companies

We collect this personal information in the following ways:

  • From emails or phone calls from clients or other contacts (including, among others, admins, colleagues, joint agent's brochures) with updated contact information
  • From your company’s website or through search engine searches

We use this personal information for the following purposes:

  • Calling and emailing out to contacts to collect listing, deal and other industry data on a monthly basis
  • Executing outbound marketing campaigns (see "Direct Marketing" section)
  • Creating workflow spreadsheets and analysis that are used internally
  • Entering details into our CoStar product from where those details can be viewed by our subscriber base. In particular those personal details appear within (a) the Professional Directory section (b) the DealMakers sections and (c) attached to specific and relevant building and transactional records.

Storage of personal information

We store your personal information within our internal customer relationship management system, email exchange servers and their archives, paper on desks, personal desktops, internal shared drives and storage devices (e.g., USB sticks).

Lawful basis for data processing

The lawful basis on which we collect this personal information is legitimate interests. Those legitimate interests are to help Listing Agents successfully market their properties to a professional commercial property audience by calling them for their listings, help Listing Agents market their services to the rest of our subscriber base and market CoStar products and events.

Corporate Tenants and Landlords

We collect the following types of personal information about Corporate Tenants and Landlords:

  • First Name
  • Job Title
  • Surname
  • Business Address
  • Email Address
  • Telephone Number(s)

We collect this personal information in the following ways:

  • From emails or phone calls from corporate tenants, landlords and building managers
  • From your company’s website or through search engine searches
  • From information originating from third party sources, including, among others: (i) building front desk/concierge/building manager/neighbouring tenants (ii) LinkedIn or other social media (business Facebook page, Twitter) (iii) public and freely accessible databases such as Companies House, Charities Register and Scottish Assessors and (iv) published agent investment brochures and tenancy schedules

We use this personal information for the following purposes:

  • Providing the CoStar Suite service, which is a directory visible to everyone who subscribes to the service
  • Calling relevant corporate tenants to capture or confirm occupancy, leasing information, and other commercial real estate information
  • Entering details into our CoStar product from where those details can be viewed by our subscriber base. In particular those personal details appear attached to specific and relevant building and transactional records

Storage of personal information

We store your personal information within our internal customer relationship management system, email exchange servers and their archives, paper on desks, personal desktops, internal shared drives and storage devices (e.g., USB sticks).

Lawful basis for data processing

The lawful basis under which we are processing this personal information is legitimate interests. These legitimate interests are to assist in keeping our commercial property database up to date and accurate; to enable our subscribers to contact key commercial property contacts within Corporate Tenant and Landlords companies and market their services and also for them to understand who they are doing business with and to manage their financial risk (for example understanding the financial strength of certain Corporate Tenants and Landlords).

Certain of our uses, collection methods and ways we store your information are applicable to all of our products and these are as follows:

(1) Google Analytics

We will monitor your web site usage in order to identify trends, aggregate statistics, optimize your use of the web site and provide a safer environment for purchasing. Examples of the data we will collect and analyse include the Internet protocol (IP) address used to connect your computer to the Internet, your login credentials, your computer connection information (such as browser type and version), your operating system and platform, the full Uniform Resource Locators (URL) click stream to, through and from our websites (including date and time), your CoStar-related preferences and the terms you searched for.

This applies to your use of CoStar Suite, CoStar News, Shopproperty, Propex and Showcase.

The lawful basis under which we are processing this personal information is our legitimate interest in helping to maximize our users’ experience of our products and in providing educated insight into enhancements we can make to those products.

(2) Cookies

Some areas of this Site use and require that you accept "cookies." Cookies are small text files that are stored on your computer or other device to keep track of settings or data for a particular web site. Cookies make it possible and easier for you to access and use certain areas of this Site. If you have disabled cookies from within your browser, or if you are running third-party software that intercepts or deletes cookies, you may not be able to visit certain areas of the Site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy.

(3) Anonymous data

We will also collect anonymised details about visitors to our website for the purposes of aggregate statistics or reporting purposes. However, no single individual will be identifiable from the anonymised details we collect for these purposes.

(4) Suppression lists

In the case of product information newsletters or direct or electronic mailing lists, you will be able to "unsubscribe" to these mailings at any time. If you choose to do so, CoStar will store your first name, last name and email address that it has collected in an internal database and use it only for the purpose of periodically referencing the list to ensure that we do not contact you.

4. Accuracy

We will, as necessary, keep your personal information accurate and complete based on the information provided to us. However, information contained in files that are dormant or have been closed will not be actively updated or maintained by CoStar.

If you believe that any of your personal information held by us is not correct, you may request an update of that information by sending a written request to CoStar’s Data Protection Officer: CoStar UK Limited, 26th Floor, The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom.

5. Data Sharing

Circumstances may arise where we are required to disclose your personal information to third parties for purposes other than to support your customer relationship with CoStar. Those circumstances are as follows;

(i) in connection with a corporate divestiture or dissolution where we sell all or a portion of our business or assets (including our associated customer lists containing your personal information);

(ii) if disclosure is permitted or required by law (for example, in connection with judicial proceedings or governmental investigations); or

(iii) to identify possible violations of the Terms of Use or a separate License Agreement and to identify, contact or bring legal action against persons or entities that may be violating your rights, our rights or the rights of others.

5. Data Processing

CoStar may permit its affiliates and certain third parties to access your personal information for the purpose of processing personal information on our behalf to assist us in providing our services to you. These parties must keep your personal information confidential and must not use it for any purpose other than to carry out the services they are performing for CoStar.

These affiliates and third parties include:

  • CoStar Realty Information, Inc.
  • IT infrastructure companies that facilitate our provision of the Site and the Services to you;
  • IT support service providers; and
  • Other third-party service providers, for the purpose of tracking our customers' use of the Site and the Services (such as Google Analytics).

7. International Transfers

We will transfer, in accordance with applicable law, personal information that we collect from you to third party data processors located in countries that are outside of the European Economic Area, specifically, to members of our group of companies located in the United States, including CoStar Realty Information, Inc., in connection with the above purposes. We have entered into an intra-company agreement with CoStar Realty Information, Inc. that sets forth the operational processes and meets the European Commission’s requirements of the Standard Contractual Clauses for the transfer of personal data outside of the European Economic Area. Whenever we transfer your personal information out of the European Economic Area, we ensure a similar degree of protection is afforded to it by transferring your personal information to countries that have been deemed to provide an adequate level of protection for personal information by the European Commission or we may use specific contracts approved by the European Commission (such as the Standard Contractual Clauses) which give personal data the same protection that it has in Europe. If we are transferring personal data to a party based in the United States, then we may transfer the data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the United States to that which it has in Europe.

Please be aware that countries which are outside the European Economic Area may not offer the same level of data protection as the United Kingdom, although our collection, storage and use of your personal information will continue to be governed by this privacy statement.

8. Consent

For certain individuals who use non-corporate personal email accounts to receive (i) CoStar News Bulletins and (ii) direct marketing, and Shopproperty users with non-corporate personal email accounts, we require your consent for you to receive those services.

Where consent is required under applicable data protection laws, we will obtain your consent for the collection, use and disclosure of personal information for the purposes of providing you with products and services by you giving us your personal information for those purposes. You can withdraw your consent to receive such mailings at any time by contacting us by email at gdpr@costar.co.uk. You can also select unsubscribe on any of our email marketing communications to you. If you opt out of marketing communications, CoStar will still contact you in connection with providing any products and services that you have requested from us.

9. Your Rights

You have the right the right to ask us to provide you with copies of personal information that we hold about you at any time. In addition, you have the right to update or correct any out-of-date or inaccurate personal information that we hold about you (in accordance with applicable data protection laws). If you would like to access and make changes to information that you have provided to us in connection with your online account, please log-into your account and review and correct the information that you provided. If you would like assistance in accessing or correcting other information, please write to us (either by mail to CoStar UK Limited, 26th Floor, The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom or by email at gdpr@costar.co.uk).

If you want us to stop using or to delete your personal information, you can contact us at gdpr@costar.co.uk and tell us why. In certain circumstances we may not be able to stop using your personal information but, if that is the case, we'll let you know and tell you why.

10. Retention

CoStar retains personal information as long as necessary to fulfil the purposes for which it was collected and as required to comply with business and legal requirements (e.g., to comply with legal obligations, resolve disputes (legal or otherwise) or enforce our agreements).

We will retain information (including personal information) about current subscribers to any of our products for up to 12 months following the termination of your access to the relevant product.

We will retain information (including personal information) about Listing Agents for as long as it remains applicable and we will update or remove it when we are made aware that it has become inaccurate.

We will retain information (including personal information) in recorded phone calls with Listing Agents for up to 12 months following the time of the phone call.

We will retain information (including personal information) about Corporate Tenants and Landlords as long as it remains applicable and we will update or remove it when we are made aware that it has become inaccurate.

Where we have obtained your consent to process your personal information, we will retain that information until such time as you withdraw that consent.

Where we no longer require your personal information, we will remove it from our primary customer relationship management system as well as from the relevant product database. We may retain copies of your data in back-ups and archival systems and we will either delete it from these systems or put the information beyond use where deletion is not currently possible.

11. Compliance with Laws and Legal Proceedings

We share your personal information with the appropriate authorities when we respond to court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims. In addition, we will share your personal information with the appropriate authorities when we believe in our sole discretion it is necessary to share information in order to investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use, or as otherwise required by law.

12. Security

We take steps to protect the security of the personally identifiable information we collect, including, for example, physical, electronic, and procedural safeguards.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your data transmitted to our Site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

13. No Data Regarding Children

Although the Site can technically be viewed by children, we do not knowingly request personally identifiable information from them nor does the Site publish content that is targeted to children. No information should be submitted to, or posted at, the Site by visitors under the age of 18.

14. Amendment of CoStar’s Practices and This Privacy Policy

We will from time to time review and revise our privacy practices and this privacy policy. Policy changes will apply to the information collected from the date of the revised privacy policy as well as to existing information held by CoStar. Please refer to our website for the most current version of our privacy policy; however, we will distribute this privacy policy to our clients and others whose personal information we collect in the event we make a material change.

15. Questions and Complaints

We have appointed a Data Protection Officer to investigate and respond to privacy issues and to be accountable for our compliance with this privacy policy.

If you have questions about access to your personal information held by us or about our collection, use or disclosure of your personal information, or if you wish to make a privacy-related complaint, you may contact our Data Protection Officer by email at gdpr@costar.co.uk or by mail to CoStar UK Limited, 26th Floor, The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom.

You may also make a complaint to the Information Commissioner in the UK (www.ico.org.uk) or in certain circumstances to your local data protection authority (if different). Alternatively, you may seek a remedy through local courts if you believe your rights have been breached.

Last Updated: May 17, 2018