Privacy Policy (UK GDPR)

Last updated: 27/04/2026

1. Who we are (the “controller”)

Rengen Lettings (“we”, “us”, “our”) provides residential lettings and property management services in the UK.

  • Legal entity: Rengen Lettings Ltd
  • Registered address: 34 Park St, Bristol BS1 5JG
  • Company number: 07750264
  • Contact for privacy matters: info@rengenlettings.co.uk

We decide how and why your personal data is used for our business purposes, so we’re a “controller” under the UK GDPR and the Data Protection Act 2018.

In some cases, your landlord will be a separate controller (e.g., their own insurance or legal claims). We’ll explain these roles where relevant.

2. What data we collect

  • Identity & contact – name, title, date of birth, phone, email, address, ID documents/share codes.
  • Tenancy & referencing – employment and income details, previous addresses/landlord references, guarantor details, credit history indicators from referencing partners.
  • Right to Rent – copies of identity documents, share codes, check dates.
  • Financial – bank details for rent payments/refunds, payment history.
  • Property management – maintenance requests, inspection notes, photos/videos relating to a property.
  • Compliance & disputes – correspondence, incident reports, claims information.
  • Marketing preferences – your choices on receiving updates.
  • Website/tech data – log data (IP, device/browser), cookie IDs, analytics. See our Cookies Policy.

If we ever need special category data (e.g., information about health to support reasonable adjustments for viewings or tenancy), we’ll only collect what’s necessary and rely on an appropriate legal condition (e.g., explicit consent or substantial public interest under UK law) and apply extra safeguards.

3. Where your data comes from

  • Directly from you (forms, emails, calls, website, meetings).
  • From third parties you authorise or that are required to progress a tenancy: referencing agencies/credit reference agencies, previous landlords, guarantors, employers, utility switching services, deposit schemes, maintenance contractors, insurers.
  • Public sources (e.g., Land Registry, electoral roll where applicable).
  • From our website/IT systems (logs, security tools, analytics and cookies under PECR).

4. Why we use your data and our lawful bases

We always need a lawful reason (“lawful basis”) for using personal data. Common ones for a lettings agent are contract, legal obligation, legitimate interests, and consent (for certain marketing/cookies).

5. Who we share data with

  • Landlords/tenants/guarantors (only what’s necessary to progress/perform the tenancy).
  • Referencing & credit reference agencies, identity verification services, deposit protection schemes (e.g., TDS/DPS/MyDeposits), utility providers and local authorities (council tax/CTAs), safety contractors and repairs suppliers, payment processors and banking, insurers and legal advisers, IT/hosting/CRM providers, and analytics/cookie vendors (per Cookies Policy).
  • Law enforcement/regulators/courts where required by law.

We require our processors to keep your data secure and act only on our instructions.

6. International transfers

If any partner or system stores data outside the UK (or outside the UK-EEA adequacy areas), we’ll use recognised safeguards such as the UK IDTA or International Data Transfer Addendum to the EU SCCs, and carry out transfer risk assessments where needed.

7. How long we keep your data (retention)

We keep personal data only as long as needed for the purpose collected, legal requirements, and limitation periods. Typical periods:

  • Tenancy file (core documents, correspondence): usually up to 6 years after the tenancy ends (standard limitation period for contractual claims).
  • Right to Rent check copies: until tenancy ends, then no longer than 12 months after.
  • Accounting/tax records: generally 6 years (or longer if HMRC rules require).
  • Marketing records: until you opt out or your consent is withdrawn (we’ll refresh consents as appropriate).
  • CCTV/visitor logs (if used): short periods unless needed for an incident.

We may keep limited information beyond these periods where necessary to establish, exercise, or defend legal claims.

8. Your rights

You have rights under the UK GDPR, including: to be informed, access, rectification, erasure, restriction, data portability, objection, and rights related to automated decision-making (including profiling). How to exercise them and when they apply is set out by the ICO. We’ll respond within one month (subject to extensions allowed by law).

To exercise your rights, contact us via privacy@rengenlettings.co.uk. You may need to verify your identity.

9. Automated decisions & profiling

Our referencing partners and credit reference agencies may use automated tools and scoring. We consider decisions that have legal or similarly significant effects on you and make sure your rights are protected; you can ask for a human review and to express your point of view.

10. Cookies, analytics and similar technologies

We use cookies and similar tech on our website. Non-essential cookies (e.g., analytics/ads) require opt-in consent under PECR; you can change your preferences at any time via our cookie banner/settings. For details (types, purposes, providers, durations), please read our Cookies Policy.

11. Keeping your data secure

We use reasonable technical and organisational measures (access controls, encryption in transit where appropriate, staff training, supplier due diligence, and retention controls) to protect your data. If we become aware of a personal data breach that risks your rights and freedoms, we’ll assess and, where required, notify the ICO and affected individuals.

12. Complaints

If you’re unhappy with how we handle your data, please contact us first so we can put it right: privacy@rengenlettings.co.uk.

You also have the right to complain to the Information Commissioner’s Office (ICO):

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

ico.org.uk / 0303 123 1113

13. Changes to this notice

We review this policy regularly and will post updates here with a new “Last updated” date. Significant changes may be notified by email where appropriate. Transparency is a core GDPR principle, so we aim to keep this clear and accessible.

14. Key documents you may also want on the site

  • Cookies Policy (with consent banner settings and a cookie table).
  • Tenant/Applicant Fair Processing Notice (short form used on enquiry/application forms).
  • Supplier Privacy Notice (for contractors).
  • CCTV/Visitor Privacy Notice (if used at offices/properties).
ANUK/Unipol National Code

Rengen Lettings is a member of the ANUK/Unipol National Code of Standards for Larger Developments. Code membership applies to our registered developments only — accredited properties are identified on their own property page.