Legal

Data Protection & GDPR

1. The law that applies

LandlordHub operates under UK data protection law: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, as amended (including by the Data (Use and Access) Act 2025). The regulator is the Information Commissioner's Office (ICO).

2. Who we are

LandlordHub is a trading name of Gary Callaway, a sole trader based in England. Address: Unit 173641, PO Box 7169, Poole, BH15 9EL. ICO registration number: ZC262506.

3. Who is responsible for what

In this page, "Customer" means the landlord or letting agency that manages a property in LandlordHub. Where an agency manages a property, the agency is the Customer for it.

Activity	Controller	LandlordHub's role
User accounts, sign-in, agency team logins, security, billing, agency credit, support, the referral programme and the assistant	LandlordHub	Controller
Guest AI inventories and guest referencing orders (buyer's email, payment and access link)	LandlordHub	Controller
Property, tenancy and tenant information, documents and certificates	Customer	Processor
Inviting tenants and landlords and linking them to a property	Customer	Processor
Repair requests, and messages between landlords, agencies and tenants	Customer	Processor
Compliance tracking and reminders	Customer	Processor
Viewings, the letting pipeline and applicant checks	Customer	Processor
Deposit records, Right to Rent records and evidence, key register, approvals, move-outs and landlord onboarding links	Customer	Processor
Tenancy agreements, written statements and AI inventories (for account holders)	Customer	Processor
Recordings for a guest AI inventory	The guest	Processor (recordings are not kept after analysis)
Tenant referencing and credit checks	Vorensys, for the checks it carries out, and the Customer, for its letting decision	Passes the order to Vorensys and shows the result
Card and Direct Debit payments	LandlordHub, with Stripe and GoCardless as processors and, for some purposes, independent controllers	Controller
Enquiries and viewing requests from property adverts	Customer	Processor
Electronic signatures and acknowledgements on Customer documents	Customer	Processor
Contractor requests a user chooses to send	Our contractor-matching partner (currently MyJobQuote), for matching and contacting tradespeople; LandlordHub, for the request and commission record	Sends the request at the user's instruction; controller of its own records
Affiliate programme (links, credited sign-ups, commission)	LandlordHub; Stripe as an independent controller for payout identity checks and bank details	Controller
Partner introductions a user asks for (for example moving-home services)	The partner, once it receives the details	Sends the details at the user's instruction

4. What landlords and agencies must do

As controller, you are responsible under UK GDPR for how the personal data you put into LandlordHub is used. In particular you should:

• Pay the ICO data protection fee unless an exemption applies. Most landlords and all letting agencies who hold tenant information electronically need to. You can check at ico.org.uk.
• Have a lawful basis for each type of data you enter: usually taking steps to enter into or perform a tenancy, your legal obligations (such as Right to Rent and deposit protection), or your legitimate interests.
• Tell people how you use their data, including that you use LandlordHub and its sub-processors. This includes tenants, applicants, people who book viewings, guarantors, contractors and (for agencies) landlords and your own staff.
• Only enter what is necessary, keep it accurate, and delete it when you no longer need it, for example viewing records for people who didn't go on to rent. Avoid health, criminal or other sensitive information unless it is genuinely necessary and you have a lawful basis. Right to Rent evidence must be kept only as long as the law requires.
• Invite the right person to the right property, and remove access when a tenancy ends or a team member leaves.
• Agencies: give each team member the lowest role they need, make sure you have the landlord's authority before taking over (or handing back) a property's records, and have your own written agreement with each landlord covering how you both handle personal data.
• Respond to rights requests from your tenants, applicants and others, such as requests for a copy of their data. We will help where the request concerns data held in LandlordHub.
• Keep your account secure, and make sure anyone who uses it follows data protection law.
• Deal with breaches on your side (for example a shared login, or documents downloaded to an insecure device), including reporting to the ICO where required.
• Handle complaints about data you control through your own complaints process.

LandlordHub cannot do these things for you. We provide the tools and process data on your instructions, but we don't decide what data you collect, why, or how long you keep it, and we are not responsible for your compliance as a controller.

5. What LandlordHub does

As processor, and as set out in our Data Processing Terms, we:

• process personal data only on the Customer's documented instructions, which are our Terms and the way the Customer uses the service;
• make sure anyone who handles the data is bound by confidentiality;
• apply appropriate security measures (see section 7);
• use only the sub-processors listed below, under written contracts, and give notice of changes;
• help Customers with rights requests, breach notifications and data protection impact assessments, taking into account the nature of the processing;
• tell Customers without undue delay about any personal data breach affecting their data;
• delete Customer data when their account is closed, subject to legal retention and backup expiry;
• make available the information needed to show we comply.

As controller of our own data, we meet our obligations as described in our Privacy Notice.

6. Sub-processors

These providers process personal data on our behalf. We will update this list at least 14 days before adding or replacing a sub-processor and tell Customers by email.

Provider	What it does	Where	Transfer safeguard
Supabase Inc	Database, sign-in, file storage and server functions	European Union (Ireland); support access may be from the US	UK adequacy regulations (EU); IDTA or UK Addendum for US support access
Fasthosts Internet Ltd	Website hosting	UK	Not needed
Resend	Sending service emails	United States	IDTA or UK Addendum
Twilio	Text message alerts for landlords and tenants (only if switched on)	United States	UK–US data bridge, IDTA or UK Addendum
OpenAI	AI inventory drafting, reading certificate dates, and the "Ask LandlordHub" assistant	United States	IDTA or UK Addendum
Stripe	Card payments, subscriptions, saved agency cards and agency credit top-ups	UK, EEA and United States	UK–US data bridge, IDTA or UK Addendum
GoCardless Ltd	Direct Debit payments	UK and EEA	UK adequacy regulations (EEA)
Google (Google Analytics 4)	Website analytics, only if you accept analytics	United States and elsewhere	UK–US data bridge
Apple, Google and Mozilla notification services	Delivering app notifications, only if you allow them	Worldwide	Provider's standard terms
Google Fonts, jsDelivr, Cloudflare (cdnjs)	Delivering fonts and code libraries to your browser (they receive your IP address)	Worldwide	Provider's standard terms

These organisations are not sub-processors, because they decide how to use the data for their own service: Vorensys (tenant referencing), our contractor-matching partner MyJobQuote (contractor requests a user chooses to send), and any partner a user asks to be introduced to. The council finder sends only the postcode you type to the public service postcodes.io. Where we look up public information for you, such as an EPC on the official government register, we only send what's needed to find it, such as the postcode.

We don't use Customer Personal Data to train AI models, and our AI provider doesn't use it to train its models under its business terms.

7. Security measures

• All connections encrypted in transit (HTTPS/TLS).
• Row-level security in the database, so each landlord, agency team member and tenant can only reach the data they are allowed to see. Agency team roles (owner, admin, manager, view-only) are enforced by the database, not just the screen.
• Documents, photos, videos and Right to Rent evidence kept in private storage and opened through time-limited links.
• Passwords stored in hashed form; we cannot see them.
• Administrative access restricted to authorised personnel and protected by multi-factor authentication.
• Card and bank details handled only by Stripe and GoCardless.
• Server keys held only on the server, never in the browser.
• Rate limits on public forms, guest purchases and AI features to prevent abuse.

8. Rights requests

About your LandlordHub account: contact us as set out in our Privacy Notice. We will respond within one month, which can be extended by up to two further months for complex requests. The time limit starts once we have what we reasonably need to confirm your identity and understand the request.

About data a landlord or letting agency controls (for example your tenancy, your viewing or your application): make your request to them. If you send it to us, we will forward it to them without undue delay and tell you we have done so. We will help them respond, for example by helping them find the relevant records.

Customers responding to a request can download documents, messages and repair history from the platform, or contact us for help.

9. Personal data breaches

We have a process for detecting, investigating and recording breaches. Where we are controller, we will tell the ICO within 72 hours of becoming aware of a reportable breach, and tell affected people without undue delay where there is a high risk to them. Where we are processor, we will tell the affected Customer without undue delay and give them the information they need to meet their own obligations.

If you think your account or data has been compromised, contact us straight away at [email protected].

10. Account deletion, handovers and data export

• You can delete your account in your account settings. This permanently deletes the account and its data, including stored files, except where we must keep records by law (such as payment records).
• When a landlord deletes their account, their properties, tenancies, documents, repairs and messages are deleted, and linked tenants lose access. Download anything you need to keep first.
• When a landlord hands a property to an agency, the whole property record moves to the agency, which becomes the Customer for it. When the landlord takes a property back, the record moves back to the landlord. Tenants of an agency-managed property deal only with the agency.
• When a free trial or plan ends, the landlord or agency account becomes read-only. If no plan is chosen, the account and everything in it may be permanently deleted 90 days after we first tell the account holder. Landlords receive email warnings when the account becomes read-only, 30 days before and 7 days before deletion. Download anything you are required to keep before then. Agencies should hand properties back to their landlords before their account is closed.
• Deleted data can remain in encrypted backups until they are overwritten, normally within 30 days.

11. Complaints

If you have a complaint about how LandlordHub has handled personal data, use our contact form or email [email protected]. We will acknowledge it within 30 days, investigate without undue delay, keep you updated and tell you the outcome.

You can also complain to the ICO: ico.org.uk/make-a-complaint or 0303 123 1113.

If your complaint is about data a landlord or letting agency controls, please raise it with them first.

12. Contact

Data protection enquiries: [email protected], marked "Data Protection", or by post to Gary Callaway trading as LandlordHub, Unit 173641, PO Box 7169, Poole, BH15 9EL.