Privacy Policy

HomePassport (“HomePassport”, “we”, “us”, or “our”) provides a digital platform that helps homeowners, landlords, tenants, letting agents, and tradespeople store, manage, and share property documents, compliance records, and job history in one secure place.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, HomePassport is the “data controller” responsible for your personal data when you use our website and services, except where we act as a “data processor” on behalf of a business customer (for example, a letting agency or landlord organisation using HomePassport to manage their portfolio).

HomePassport is a service operated in the United Kingdom. Our registered company details and Information Commissioner’s Office (ICO) registration number are available on request via the contact details in section 17.

This policy applies to personal data we collect through our marketing website, our web and mobile applications, and any related services, communications, or support we provide (together, the “Services”).

Where you access HomePassport through an account created or managed by a business (such as a landlord or letting agency), that organisation may be the controller of certain data, and their own privacy notice will also apply. In those cases we process the data under our agreement with them.

We collect and process the following categories of data:

Information you provide to us

• Account details — your first and last name, email address, password (stored only in encrypted/hashed form), and your role (for example homeowner, landlord, tenant, agent, or trader).
• Profile details — optional information such as a profile photo, phone number, and contact preferences.
• Property information — property addresses and details, and the documents and records you upload, including compliance certificates (such as EPCs, Gas Safety records, and EICRs), warranties, receipts, photos, notes, and job history.
• Tenancy, agent, and trade data — details of tenancies, invited agents or tenants, and job or quote information exchanged with tradespeople.
• Communications — messages, comments, and information you share within job rooms, share packs, or when you contact our support team.

Information collected automatically

• Technical data — IP address, device and browser type, operating system, and general location inferred from your IP.
• Usage data — pages viewed, features used, actions taken, and timestamps, which help us operate, secure, and improve the Services.
• Cookies and similar technologies — see section 12.

Information from third parties

• Payment confirmation and subscription status from our payment processor (we do not receive or store your full card details).
• Information from people who invite you to a property, tenancy, or job, or who share documents with you.

Documents you upload may contain personal data about other people (for example tenants, contractors, or previous owners). Where you upload such data, you are responsible for ensuring you have a lawful basis to do so, and we process it on your behalf to provide the Services.

We use your personal data to:

• Create and manage your account and authenticate you securely.
• Provide the core Services — storing, organising, retrieving, and sharing your property documents and records.
• Enable collaboration between homeowners, landlords, tenants, agents, and tradespeople, including invitations, job rooms, and share packs.
• Process subscriptions, payments, and billing through our payment processor.
• Provide features such as document scanning (OCR), automatic tagging, compliance reminders, and portfolio dashboards.
• Send service-related communications, including reminders, security alerts, and important notices about your account.
• Provide customer support and respond to your enquiries.
• Maintain the security, integrity, and performance of the Services, and detect and prevent fraud or misuse.
• Comply with our legal and regulatory obligations.
• With your consent where required, send you marketing about products and features that may interest you.

Under UK data protection law we must have a lawful basis for processing your personal data. We rely on the following:

• Performance of a contract — to provide the Services you have signed up for and to manage your account and subscription.
• Legitimate interests — to operate, secure, and improve the Services, prevent fraud, and communicate with you, provided our interests are not overridden by your rights.
• Consent — for optional cookies, certain marketing communications, and any features you specifically opt into. You can withdraw consent at any time.
• Legal obligation — where we are required to process data to comply with the law, including accounting, tax, and responding to lawful requests.

We do not sell your personal data. We share it only in the following circumstances:

• Service providers (processors) — trusted third parties who process data on our behalf under strict contractual obligations, including cloud hosting and storage, payment processing, email delivery, document scanning (OCR), and analytics providers.
• Other users you choose to share with — for example when you invite an agent or tenant, collaborate in a job room, or create a share pack (see section 7).
• Business customers — where you use HomePassport through an organisation, we share relevant data with that organisation as the controller.
• Legal and safety reasons — where required to comply with the law, enforce our terms, or protect the rights, safety, and property of HomePassport, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

HomePassport lets you share documents and records with other people, including through “share packs” accessible via a secure link. When you share content:

• You control what is shared and with whom. Only share information you have the right to disclose.
• Anyone with access to a valid share link may view the shared content, so treat share links as confidential.
• You are responsible for revoking access when it is no longer needed. Depending on the feature, links may expire automatically.
• Recipients’ use of any personal data within shared documents is their own responsibility as a separate controller.

We aim to store and process your personal data within the United Kingdom and the European Economic Area (EEA). Some of our service providers may process data outside the UK/EEA.

Where personal data is transferred outside the UK, we ensure an appropriate level of protection is in place, such as an adequacy decision by the UK Government or the use of the International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed.

We keep your personal data only for as long as necessary for the purposes set out in this policy:

• Account and property data — for as long as your account is active, and for a reasonable period afterwards so you can reactivate or recover it.
• Documents and records — until you delete them or close your account, subject to any legal retention requirements.
• Billing and transaction records — for the period required by tax and accounting law (typically at least six years).
• Support and communications — for as long as needed to handle your query and for our legitimate record-keeping.

When data is no longer needed, we securely delete or anonymise it. You can request deletion of your account at any time (see section 11).

We take the security of your data seriously and use appropriate technical and organisational measures, including:

• Encryption of data in transit and at rest.
• Secure storage of passwords using industry-standard hashing.
• Access controls, so staff and systems can only access data they need.
• Regular monitoring, logging, and review of our systems.

No method of transmission or storage is completely secure. If we ever become aware of a personal data breach that affects your rights, we will notify you and the ICO where required by law.

Under UK data protection law you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data in certain circumstances (the “right to be forgotten”).
• Restriction — ask us to limit how we use your data in certain circumstances.
• Portability — receive certain data in a structured, machine-readable format, or ask us to transfer it to another provider.
• Objection — object to processing based on our legitimate interests, or to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us using the details in section 17. We will respond within one month, as required by law. You will not usually have to pay a fee.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Services secure, and understand how they are used so we can improve them. For full details, see our Cookie Policy.

• Strictly necessary cookies — required for the Services to function, including authentication and security. These cannot be switched off.
• Functional cookies — remember your settings and preferences.
• Analytics cookies — help us understand usage and improve the Services. These are used only with your consent where required.

We will only send you marketing communications where you have asked to receive them or where permitted by law. You can opt out at any time by using the unsubscribe link in our emails or by contacting us. Opting out of marketing does not stop service-related messages about your account.

The Services are intended for users aged 18 and over and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

The Services may contain links to third-party websites or integrate with third-party services (such as payment providers). We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy notices.

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Please review this page periodically.

If you have any questions about this policy or how we handle your personal data, or if you wish to exercise your rights, please contact us: