Livin Residential Lettings Ltd | Version 2.0 | Last updated: June 2026 | Next review: June 2027

Who we are

Livin Residential Lettings Ltd, Jock Sergisons Business Centre, Hyde Park Industrial Estate, Nelson Street, Doncaster DN4 5AB, is the data controller for the personal data described in this policy.

ICO registration: ZA264907 | Data Protection Lead: Louise Smyth |
Email: contact@livinlets.co.uk

How we collect information

• From your application for accommodation
• From your guarantor, employer or accountant (if applicable)
• From any previous landlord
• From the UK Government Right to Rent service
• From referencing and credit-reference agencies

Where we obtain your information from someone other than you (for example a guarantor, employer, previous landlord or referencing agency), we will provide you with this privacy information in line with Article 14 of the UK GDPR within a reasonable period and, in any event, when we first contact you or use the data.

What information we collect

Tenants and applicants:

• Names, email, phone, date of birth, address history
• Employment status, National Insurance number
• Right to Rent and identification documents
• Tenancy details (property, rent, deposit, term)

Guarantors:

• Name, contact, date of birth, address history, marital status, NI number

Employment and financial:

• Employer/accountant details, payroll, length of employment, salary, income, Self Assessment / P60

Legal and compliance:

• Right to Rent share codes, visa details, passport
• Welfare-benefit information where relevant to affordability

Lawful basis (Article 6)

• Performance of a contract
• Legal obligation (Right to Rent, financial sanctions, tax)
• Legitimate interests (business, tenancy and property management) — balanced against your rights
• Consent (where specifically required)

Special category and criminal-offence data (Articles 9 and 10)

Some information we handle needs extra protection. Where welfare-benefit or affordability information indirectly reveals health information, that is special category data under Article 9. Where we carry out financial-sanctions screening, that can involve criminal-offence-related data under Article 10.

Where we process special category data we rely on Article 9(2) of the UK GDPR (principally substantial public interest, and where relevant the establishment, exercise or defence of legal claims), together with the corresponding condition in Schedule 1 to the Data Protection Act 2018. Where we process criminal-offence or sanctions data we do so under Article 10 and the relevant Schedule 1 condition (including the prevention or detection of unlawful acts and compliance with regulatory requirements).

We hold an Appropriate Policy Document explaining how we comply with the data-protection principles and our retention and erasure policy for this data. It is available on request. We collect this data only where necessary and keep it to a minimum.

Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Tenant referencing may use automated checks, but a person reviews the outcome before any decision, and you can ask us to explain or reconsider it.

Why we need this information

• To perform our contractual obligations
• To manage tenancies and properties
• To carry out referencing and due diligence
• To conduct financial-sanctions screening as required by law
• To comply with legal and regulatory requirements

Sharing your information

We may share data with: landlords; referencing and credit agencies; the Deposit Protection Service; local authorities and government bodies; utility providers; contractors and managing agents; debt-recovery agents (rent arrears); professional advisers; and OFSI (where required by law). We do not sell your personal data.

Transfers outside the UK

Most of our processing takes place in the UK. However, a member of our team works remotely from outside the UK (currently the Philippines) and accesses our systems (including Arthur, Xero and Microsoft 365), and some of our cloud providers may process data on servers outside the UK. The Philippines is not currently covered by UK ‘adequacy’ regulations.

Where this involves a restricted transfer of personal data outside the UK, we put an appropriate safeguard in place — in particular the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — and we carry out a transfer risk assessment. We also apply strict access controls, encryption and confidentiality obligations. You can ask us for details of the safeguards we use.

Security

• Password-protected systems with multi-factor authentication
• Secure cloud software (Arthur, Xero, Microsoft 365)
• Access restricted on a need-to-know basis

Retention periods

• Tenant/landlord records: 6 years after the end of the relationship
• Right to Rent: for the duration of the tenancy and one year after it ends
• Financial records: 6 years
• Contractor records: 6 years
• Unsuccessful applications: 6–12 months

Cookies

Our website uses cookies. Non-essential cookies are only set with your consent, which you can give or withdraw via the cookie banner / settings on the site. Full details are in the cookie section of the privacy information on our website.

Your rights

You have the right to access, rectification, erasure, restriction, objection and portability, and to withdraw consent where we rely on it. To exercise any right, contact contact@livinlets.co.uk.

Complaints

Please contact us first. You can also complain to the ICO: Wycliffe House, Water Lane, Wilmslow SK9 5AF | 0303 123 1113 | www.ico.org.uk

Changes

The latest version of this policy is always available on our website and on request.