Privacy notice: how we handle your data

Who is responsible for your data?

Landlord Address provides a verified correspondence address and mail handling service for private landlords in England. We decide why and how your personal data is used, which makes us the controller of that data under UK data protection law.

To contact us about your data, use our contact form and choose Data protection as the enquiry type.

Whose data does this notice cover?

This notice covers personal data about:

• people who visit this website or use one of our forms
• landlords who apply for an address, and our customers and their joint owners
• people and organisations who send post to our customers at our address
• anyone who contacts us or makes a complaint

What personal data do we collect?

We collect only what we need for the service. Most of it comes from you. Some comes from our identity check provider, our payment provider and the people who send you post.

Scans of your post may sometimes contain sensitive information, such as a tenant's health details in a letter sent to you. We handle it only to get your post to you and never use it for anything else.

Why do we use it and on what lawful basis?

The law says we must have a lawful basis for each way we use personal data. This table sets out each purpose and the basis we rely on.

Where we rely on legitimate interests we have weighed them against your rights and interests. You can ask us for more detail or object, as explained under your rights.

Emails about your account and your post, such as new post alerts and renewal reminders, are part of the service and are not marketing.

Who do we share it with?

We share personal data only with organisations that help us run the service, and only the data each one needs. They may use it only on our instructions.

• Our identity check provider, to confirm who you are.
• Our payment provider, to take payments. It handles your card details directly.
• Our email provider, to send post alerts, reminders and replies to your messages.
• Our hosting provider, which runs the servers that hold our website and systems.
• Google, for Google Analytics, only if you accept analytics cookies.
• Postal and courier services, when we forward originals to you or return post to the sender.
• Professional advisers such as our accountants, lawyers and insurers, where they need it to advise us.
• Courts, the police, regulators and other authorities, where the law requires or allows us to share it.
• A buyer of our business, if that ever happens, who would have to protect your data in the same way.

We do not name our providers here because they can change, but you can ask us for the current list at any time.

We do not sell your personal data. We will only share your details with another company for its own marketing if you have clearly agreed to it.

Will you give my home address to anyone?

Not to your tenants or anyone else who writes to you at our address. Keeping your home address private is the point of the service. We will only disclose it where the law requires us to, for example under a court order, or where the law allows us to share it to prevent or detect crime.

Private does not mean hidden from the law. If we end your service because it has been misused, we may return new post to the senders so they know you are no longer at our address. Our acceptable use policy explains what is not allowed.

How long do we keep it?

We keep personal data only for as long as we need it for the purposes above or the law requires. When that time ends we delete it or make it anonymous so it can no longer identify you.

Is your data sent outside the UK?

We keep your data in the UK where we can. Some providers, such as Google, may process data in other countries. When personal data leaves the UK we make sure it has appropriate protection, such as UK adequacy regulations or approved contract terms. You can ask us for details of the safeguards we use.

How do we keep it safe?

Identity documents and scans of your post are stored outside the public website and can only be opened through a checked access route that records every view. Passwords are stored only in hashed form. Only staff who need your data to do their job can see it. Our security page explains more.

What are your rights?

UK data protection law gives you these rights over your personal data:

• Access: you can ask for a copy of the personal data we hold about you.
• Correction: you can ask us to correct data that is wrong or incomplete.
• Deletion: you can ask us to delete your data. We may need to keep some of it, such as records the law requires us to keep or post we are still handling for you.
• Restriction: you can ask us to limit how we use your data, for example while we check a concern you have raised.
• Objection: you can object to our use of your data where we rely on legitimate interests. You can object to direct marketing at any time and we will stop.
• Portability: where we use data you gave us on the basis of consent or contract, you can ask for it in a common electronic format or ask us to send it to another organisation.
• Withdrawing consent: where we rely on consent, such as for marketing emails or analytics cookies, you can withdraw it at any time. This does not affect anything we did before.

Some rights apply only in certain situations. If a right does not apply to your request we will tell you why.

How do you make a request?

Send us a message through our contact form and choose Data protection as the enquiry type. Tell us which right you want to use and give us enough detail to find your data, such as your reference if you are a customer.

We may ask you to confirm your identity before we act, so we never give your data to the wrong person. There is usually no charge. We will reply within one month of receiving your request. If a request is complex or you make several, the law lets us extend this by up to two more months, and we will tell you within the first month if we need to.

How do you complain?

If you are unhappy with how we have handled your personal data, please tell us first through our complaints page so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk.

Does this website use cookies?

This website sets one cookie of its own to remember your cookie choice. Google Analytics cookies are only set if you accept them. Our cookie policy lists each cookie and explains how to change your choice.

Will this notice change?

We will update this notice when the way we handle personal data changes. The date at the top of the page shows when it last changed. If a change affects how we use data we already hold about you, we will tell you by email before it takes effect.