Privacy Policy

Contact us about privacy:

Email: privacy@renteroo.co.uk
Website: www.renteroo.co.uk
Registered: Renteroo Ltd, Wales, United Kingdom

1.1 Account and Identity Data

• Full name, email address, and phone number
• Date of birth (where required for identity verification)
• Profile photograph (optional)
• Your role: Landlord, Tenant, Tradesperson, or Property Manager

1.2 Property Data

• Property address, postcode, type, size, and photographs
• Rental price, deposit, and tenancy terms
• Compliance certificates (Gas Safety, EICR, EPC)
• Occupation contract and tenancy agreement details
• Rent Smart Wales registration and licence numbers

1.3 Financial Data

• Rental income and payment records
• Expense records for tax purposes
• Unique Taxpayer Reference (UTR) — stored securely for Making Tax Digital
• National Insurance number (NINO) — stored securely for Self Assessment
• Bank account details for property manager withdrawals
• Deposit protection scheme references

1.4 Identity Documents

• Passport or driving licence
• Proof of address, payslips, bank statements
• References from previous landlords or employers

1.5 Communications and Technical Data

• Messages, callouts, enquiries, and applications
• IP address, browser type, device type, session tokens, usage logs

2.1 Providing the Platform

Legal basis: Performance of a contract (UK GDPR Article 6(1)(b))

• Creating and managing your account
• Enabling property listings and tenant applications
• Facilitating secure messaging between platform users
• Processing maintenance callouts and tradesperson bookings
• Managing tenancy documents and compliance checklists

2.2 Legal and Regulatory Compliance

Legal basis: Legal obligation (UK GDPR Article 6(1)(c))

• Complying with UK GDPR and the Data Protection Act 2018
• Supporting compliance with the Renting Homes (Wales) Act 2016
• Supporting Making Tax Digital (MTD) obligations
• Responding to Subject Access Requests within one calendar month

2.3 Legitimate Interests

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f))

• Improving and developing the platform
• Preventing fraud and ensuring platform security
• Sending service notifications (e.g. compliance deadline reminders)
• Anonymised analytics to understand platform usage

We do not sell your personal data. We share data only in the following circumstances:

Other Platform Users

• Landlords see tenant application details for their properties
• Tenants see basic landlord contact details for properties they enquire about
• Property managers see tenant name and address only during an active handover — not full details or message history
• Tradespeople see callout details posted publicly or sent directly by a landlord

Service Providers

• Supabase — database and authentication, EU (Ireland), subject to GDPR
• Vercel — hosting and content delivery only
• Payment processors — where payment functionality is enabled

Legal Requirements

We may disclose your data to law enforcement, regulatory authorities (HMRC, ICO), or courts where required by law.

• Right of access — request a copy of all personal data we hold (Subject Access Request). We respond within one calendar month.
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion where there is no legitimate reason for continued processing
• Right to restriction — request we limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any right, contact privacy@renteroo.co.uk. No charge applies.

• All data transmitted over encrypted HTTPS
• Authentication via industry-standard JWT and bcrypt password hashing
• Row Level Security at database level — users access only their own data
• Sensitive fields stored with appropriate technical safeguards
• Database access restricted to authorised personnel only

In the event of a data breach likely to cause risk to your rights, we will notify the ICO within 72 hours and affected individuals without undue delay.

• Authentication cookies — strictly necessary to keep you signed in
• Security cookies — strictly necessary to protect against cross-site request forgery

We do not currently use analytics, advertising, or tracking cookies.