HOMESTEAD Website and Customer Portal Privacy Policy

1. Purpose and who we are

This policy explains how HOMESTEAD collects, uses, stores, shares and protects personal data when you visit our website, make contact with us, or use the customer Portal.

2. Controller and processor roles

[LEGAL ENTITY NAME] is controller for the HOMESTEAD website, Portal account, authentication, service security, direct support and our own business records.

A property company, landlord, letting agent or other organisation using HOMESTEAD (a Company) controls its property listings, enquiries, applications, letting decisions, tenancies, deposits, maintenance and communications. The Company is a separate data controller for the operational personal data it handles through HOMESTEAD.

We generally process a Company's operational data on its instructions as its processor. Read the relevant Company's privacy notice for its purposes and lawful bases.

3. Personal data we process

• identity, contact, profile, account and authentication information;
• property enquiries, form answers, attribution data, messages and viewing arrangements;
• application, tenancy, guarantor, employment, education and next-of-kin information;
• right-to-rent, identity-document references and related evidence;
• rent, deposit, payment schedule and other tenancy-related records controlled by a Company;
• maintenance reports, messages, photographs, documents and attachments;
• communication and marketing preferences;
• IP address, device, browser, session, login, security, diagnostic and audit data; and
• support requests and correspondence.

Free-text fields and uploads may contain sensitive or special-category data. Do not provide it unless it is necessary and you are entitled to do so.

4. How data is collected

We receive information from you, customer Companies, their authorised users, enquiry and application forms, Portal activity, security logs, service providers and publicly available or lawfully connected sources.

5. How and why data is used

• to create and secure accounts and provide requested Portal features;
• to connect you with the appropriate Company and maintain relationship records;
• to support enquiries, applications, viewings, tenancies and maintenance workflows;
• to send account, security and operational communications;
• to provide support, diagnose faults, prevent misuse and maintain audit records;
• to meet legal, regulatory, accounting and dispute-resolution requirements; and
• to improve the Services using aggregated or anonymised information where appropriate.

Our lawful bases may include performance of a contract, legitimate interests, legal obligation and consent. A Company determines the lawful bases for its own processing.

6. Cookies and similar technologies

We use essential cookies or equivalent technologies for authentication, session continuity, security and service delivery. Google reCAPTCHA may be used to prevent automated abuse. We do not use advertising cookies in the Portal. Our public website may use additional tools only where configured and lawfully enabled.

7. Communications and marketing

We send necessary service and security messages without marketing consent. Marketing is sent only where permitted by law and according to recorded preferences. Companies control their own property and relationship communications. Marketing eligibility is checked again when a scheduled message is sent. Every marketing email provides a preference and unsubscribe path, including separate choices for property brands where a person has relationships across more than one Domain.

8. Sharing and service providers

Data may be shared with the Company responsible for the relevant relationship, professional advisers, regulators, law enforcement, a purchaser of our business, and suppliers needed to operate the Services. Current provider functions include:

OpenAI receives content only when an authorised Control user invokes HOMESTEAD Scribe; it is not used to make letting or other legally significant decisions. Mailgun receives the addressing and message data needed to deliver email and returns delivery, bounce, complaint and, where enabled, open and click events so Companies can operate suppression lists and campaign reporting.

9. International transfers

Some providers may process data outside the United Kingdom. Where required, we use adequacy regulations, recognised contractual safeguards or another lawful transfer mechanism.

10. Security

We use proportionate technical and organisational measures including access controls, authentication, encryption where appropriate, malware scanning, logging, monitoring, backups, patching and incident procedures. Access is limited to those with a business need.

11. Retention

Full enquiry and applicant records are normally retained for six years from the later of the last meaningful activity or final outcome. Where an applicant becomes a tenant, those records and core tenant, tenancy, guarantor, identity, right-to-rent, document, payment, deposit and communication records are normally retained for six years after the tenancy ends. A legal hold pauses deletion without restarting the original period. Expired records are deleted or irreversibly anonymised, subject to protected backup cycles and any continuing legal requirement.

A minimal marketing profile may be kept while explicit consent remains valid. Consent must be reconfirmed after 36 months of inactivity; ordinary activity does not reset that period. An opt-out stops marketing immediately and only minimal suppression evidence is retained. These rules apply equally to demo, trial, free, paid and closed accounts.

12. Your rights

Depending on the circumstances, you may have the right to:

• request access to, correction of or erasure of your personal data;
• object to or restrict processing;
• receive portable data where the portability right applies;
• withdraw consent where processing relies on consent; and
• complain to the Information Commissioner's Office at ico.org.uk.

We may verify your identity before acting on a request. We normally respond within one month, subject to extensions permitted by law. Contact [PRIVACY EMAIL]. Requests about a Company's letting or property-management records should normally be sent to that Company first.

13. Automated decision-making and children

HOMESTEAD does not make solely automated decisions producing legal or similarly significant effects. Companies make their own letting decisions. The Portal is not intended for children under 16, although Companies may lawfully hold information about household members or dependants.

14. Changes to this policy

We may update this policy when the Services, suppliers, processing or law changes. The effective date above identifies the current published version.