GDPR & Data Protection

HomePassport is committed to protecting your personal data and respecting your privacy. We comply with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. This page summarises how we meet those obligations and how you can exercise your rights. It should be read together with our Privacy Policy.

We act as a controller for the personal data we decide the purposes and means of processing — for example your account and profile information. Where a Business Customer (such as a landlord or letting agency) uses HomePassport to manage properties and invites other users, that organisation is the controller for the data in its account, and we act as a processor on its behalf under a data processing agreement.

We handle personal data in line with the UK GDPR principles:

• Lawfulness, fairness, and transparency.
• Purpose limitation — collected for specified, legitimate purposes.
• Data minimisation — only what we need.
• Accuracy — kept accurate and up to date.
• Storage limitation — kept no longer than necessary.
• Integrity and confidentiality — kept secure.
• Accountability — we can demonstrate our compliance.

We only process personal data where we have a lawful basis to do so: performance of a contract, legitimate interests, consent, or legal obligation. More detail on which basis applies to which processing is set out in our Privacy Policy.

Under the UK GDPR you have the right to:

• Be informed about how your data is used.
• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data in certain circumstances (the “right to be forgotten”).
• Restrict processing in certain circumstances.
• Data portability — receive your data in a portable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Rights relating to automated decision-making and profiling — we do not make decisions with legal or similarly significant effects based solely on automated processing.

To exercise any of your rights, contact us using the details in section 13. We will respond within one month, as required by law, though we may extend this by up to two further months for complex requests, in which case we will let you know. Exercising your rights is normally free of charge. We may ask you to verify your identity before acting on a request.

If you use HomePassport as a Business Customer and we process personal data on your behalf, we will enter into a data processing agreement (DPA) that reflects the requirements of Article 28 of the UK GDPR, including obligations of confidentiality, security, and assistance. To request a DPA, contact us using the details below.

We use carefully selected service providers (sub-processors) to help deliver the Services, such as cloud hosting and storage, payment processing, email delivery, and document scanning. We put appropriate contracts in place with each of them, and they may only process personal data on our instructions. A current list of sub-processors is available on request.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as a UK adequacy decision or the International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.

We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law. See the retention section of our Privacy Policy for more detail.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, secure password storage, and access controls. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and notify affected individuals where the risk is high.

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.

For any data protection matter, or to exercise your rights, please contact us: