Privacy Policy

Contact us about privacy:

Email: hello@renteroo.co.uk
Website: www.renteroo.co.uk
Data controller: 4Real Estate Limited (company 15119929), 42 Ffordd Y Meillion, Llanelli, SA15 2EX

1.1 Account and Identity Data

• Full name, email address, and phone number
• Date of birth (where required for identity verification)
• Profile photograph (optional)
• Your role: Landlord, Tenant, Tradesperson, or Property Manager

1.1a Waitlist and Early Access Data

• Name and email address
• Property count, Wales relevance, and whether you self-manage or use an agent
• Current tools, biggest pain point, Beta interest, and feedback willingness
• How you heard about RenteRoo, plus referral or campaign details where present in the link you used

1.2 Property Data

• Property address, postcode, type, size, and photographs
• Rental price, deposit, and tenancy terms
• Compliance certificates (Gas Safety, EICR, EPC)
• Occupation contract and tenancy agreement details
• Rent Smart Wales registration and licence numbers

1.3 Financial Data

• Rental income and payment records
• Expense records for tax purposes
• Unique Taxpayer Reference (UTR) — stored securely for Making Tax Digital
• National Insurance number (NINO) — stored securely for Self Assessment
• Bank account details for property manager withdrawals
• Deposit protection scheme references

1.4 Identity Documents

• Passport or driving licence
• Proof of address, payslips, bank statements
• References from previous landlords or employers

1.5 Communications and Technical Data

• Messages, callouts, enquiries, and applications
• IP address, browser type, device type, session tokens, usage logs

2.1 Providing the Platform

Legal basis: Performance of a contract (UK GDPR Article 6(1)(b))

• Creating and managing your account
• Enabling property listings and tenant applications
• Facilitating secure messaging between platform users
• Processing maintenance callouts and tradesperson bookings
• Managing tenancy documents and compliance checklists

2.2 Legal and Regulatory Compliance

Legal basis: Legal obligation (UK GDPR Article 6(1)(c))

• Complying with UK GDPR and the Data Protection Act 2018
• Supporting compliance with the Renting Homes (Wales) Act 2016
• Supporting Making Tax Digital (MTD) obligations
• Responding to Subject Access Requests within one calendar month

2.3 Legitimate Interests

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f))

• Improving and developing the platform
• Preventing fraud and ensuring platform security
• Sending service notifications (e.g. compliance deadline reminders)
• Anonymised analytics to understand platform usage

2.4 Waitlist and Early Access

Legal basis: Consent (UK GDPR Article 6(1)(a))

• Emailing you about RenteRoo early access and product updates
• Understanding whether RenteRoo is relevant to your landlord setup
• Selecting suitable landlords for a small Beta cohort and feedback loop
• Understanding which channels are bringing landlords to the waitlist, without using analytics or advertising cookies

We do not sell your personal data. We share data only in the following circumstances:

Other Platform Users

• Landlords see tenant application details for their properties
• Tenants see basic landlord contact details for properties they enquire about
• Property managers see tenant name and address only during an active handover — not full details or message history
• Tradespeople see callout details posted publicly or sent directly by a landlord

Service Providers

• Supabase — database and authentication, EU (Ireland), subject to GDPR
• Vercel — hosting and content delivery only
• Payment processors — where payment functionality is enabled

Legal Requirements

We may disclose your data to law enforcement, regulatory authorities (HMRC, ICO), or courts where required by law.

When you close your account, we anonymise your own profile data (name, contact details, login) 30 days later — or immediately if you choose instant deletion and re-confirm your password. During those 30 days your account stays active and you can cancel the closure or download your data at any time. Property, tenancy and compliance records are not solely your own data — they reflect a relationship with a tenant or landlord, so they are retained rather than deleted, on the schedule below:

• Profile data (name, contact, login): anonymised 30 days after account closure, or immediately with instant deletion
• Property, tenancy and compliance records (documents, certificates, deposit protection, dates): bulk-downloadable at closure; retained 6 years after tenancy end or property closure, re-attributed to an anonymised reference (Limitation Act 1980)
• Financial records: 6 years as required by HMRC
• Identity documents: tenancy duration plus 12 months
• Messages and communications: 3 years
• Audit and security logs: 12 months
• Technical logs: 90 days

• Right of access — request a copy of all personal data we hold (Subject Access Request). We respond within one calendar month.
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion where there is no legitimate reason for continued processing
• Right to restriction — request we limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any right, contact hello@renteroo.co.uk. No charge applies.

• All data transmitted over encrypted HTTPS
• Authentication via industry-standard JWT and bcrypt password hashing
• Row Level Security at database level — users access only their own data
• Sensitive fields stored with appropriate technical safeguards
• Database access restricted to authorised personnel only

In the event of a data breach likely to cause risk to your rights, we will notify the ICO within 72 hours and affected individuals without undue delay.

• Authentication cookies — strictly necessary to keep you signed in
• Security cookies — strictly necessary to protect against cross-site request forgery

We do not currently use analytics, advertising, or tracking cookies.