Privacy Policy

1. Who we are — the Data Controller

The data controller responsible for your personal data is:

We are registered with the Information Commissioner's Office (ICO). This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What personal data we collect

We collect different data depending on which service you use:

Notice generation service (studenthmo.co.uk)

• Your email address
• Landlord name, address, postcode, phone number (optional)
• Tenant names, tenancy start date, agreement date
• Property address and postcode
• Monthly rent amount
• University name (optional)
• Payment transaction data processed by Stripe (we do not store card numbers)

Waitlist registration (all domains)

• Your name (optional)
• Your email address
• The source domain you signed up from

Automatically collected data

• IP address and general location (country/region), for security only
• Browser type and device type (via server logs, retained for 30 days)
• Cookies — see our Cookie Policy

3. Legal basis for processing

Under UK GDPR Article 6, we rely on the following lawful bases:

4. How we use your data

• To generate and deliver the legal document you requested
• To send you a receipt and enable you to retrieve your document
• To notify waitlist subscribers when a product launches (email only, no spam)
• To comply with accounting and legal obligations
• To monitor and improve service quality (analytics, only with your consent)

We will never sell, rent, or trade your personal data to third parties for marketing purposes.

5. Who we share your data with

We share data only where strictly necessary with these third-party processors, all under Data Processing Agreements (DPAs):

We may also disclose data where required by law, court order, or regulatory obligation.

6. Data retention

7. Data security

All data is transmitted over HTTPS. Databases are encrypted at rest. Access is restricted to authorised personnel only. We do not store payment card numbers. We apply appropriate technical and organisational measures in line with UK GDPR Article 32.

8. International data transfers

Some of our processors are based in the United States. Where we transfer your data outside the UK, we ensure the transfer is protected by Standard Contractual Clauses (SCCs) approved by the UK ICO (IDTA), or another appropriate safeguard under UK GDPR Chapter V.

9. Your rights under UK GDPR

You have the following rights over your personal data. Contact us at hello@validrent.co.uk to exercise any of them. We will respond within 1 calendar month.

• Right of access (Art. 15) — obtain a copy of your personal data we hold
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Right to restriction of processing (Art. 18) — limit how we use your data
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing

10. Cookies

We use strictly necessary cookies and, with your consent, optional analytics cookies. Full details are in our Cookie Policy.

11. Children's privacy

Our services are directed solely at adults (landlords and property managers). We do not knowingly collect data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK supervisory authority:

13. Contact us

For any data protection queries or to exercise your rights, contact our Data Controller: