Skip to content
Soteria Homes

Last updated: PLACEHOLDER — insert date after solicitor review

Privacy Policy

Template notice: This document is a template prepared for reference purposes. It must be reviewed and approved by a qualified solicitor familiar with UK GDPR and the Data Protection Act 2018 before publication. It does not constitute legal advice.

1. Who We Are

Soteria Homes Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are registered in England and Wales (Companies House number: [INSERT COMPANIES HOUSE NUMBER]).

Contact: [INSERT DATA CONTROLLER EMAIL]
Address: [INSERT REGISTERED ADDRESS]

We are committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

Depending on how you interact with our Site and services, we may collect the following categories of personal data:

2a. Data you provide directly

  • Enquiry forms: name, email address, telephone number, and the nature of your enquiry (e.g. property, landlord, or tenant enquiry).
  • Account registration: name, email address, and a securely hashed password for access to the Investor Hub.
  • Subscription and payment: billing name and email address. Payment card details are processed directly by our payment provider (Stripe) and are never stored on our systems.
  • Tenant applications: identity documents, employment and income details, credit check consent, and previous landlord references submitted as part of our vetting process.

2b. Data collected automatically

  • Technical data: IP address, browser type and version, device type, operating system, and pages visited, collected via server logs and Cloudflare infrastructure.
  • Cookies: see Section 9 (Cookies) below.

3. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

  • Contract: to provide services you have requested (e.g. Investor Hub access, processing a tenancy application).
  • Legitimate interests: to respond to enquiries, operate and improve the Site, detect fraud, and ensure security — where our interests are not overridden by your rights.
  • Legal obligation: to comply with our legal duties, including Right to Rent checks and financial record-keeping requirements.
  • Consent: for any direct marketing communications. You may withdraw consent at any time.

4. How We Use Your Data

  • To respond to your enquiries and provide customer support;
  • To process and manage your Investor Hub subscription;
  • To conduct tenant vetting, referencing, and Right to Rent checks;
  • To process payments and manage billing;
  • To send you transactional emails (e.g. account confirmations, subscription receipts);
  • To send marketing communications where you have consented;
  • To improve the Site and our services through analysis of usage data;
  • To comply with our legal and regulatory obligations.

5. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law:

  • Enquiry data: up to 12 months unless a tenancy or business relationship follows.
  • Tenant application data: in line with Right to Rent record-keeping requirements (currently a minimum of 1 year after tenancy end).
  • Account and subscription data: for the duration of your subscription plus 7 years for financial record-keeping purposes.
  • Technical logs: up to 90 days.

6. Sharing Your Data

We do not sell your personal data. We may share it with the following categories of third parties where necessary:

  • Cloudflare: our website infrastructure and security provider, which processes traffic data and server logs;
  • Stripe: our payment processor for Investor Hub subscriptions;
  • Resend: our transactional email provider;
  • Tenant referencing provider: for conducting credit checks and employment verification on applicants (with applicant consent);
  • Andrews Letting Agents / RG Property: our letting agent partners, where relevant to a specific tenancy;
  • Legal and regulatory authorities: where required by law (e.g. HMRC, local authority Right to Rent compliance).

All third-party processors are required to process data in accordance with UK GDPR and have appropriate contractual safeguards in place.

7. International Transfers

Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on the UK Government's list of adequate countries or Standard Contractual Clauses.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you;
  • Right to rectification: to request correction of inaccurate data;
  • Right to erasure: to request deletion of your data in certain circumstances;
  • Right to restriction: to request that we limit how we process your data;
  • Right to data portability: to receive your data in a structured, machine-readable format;
  • Right to object: to object to processing based on legitimate interests or for direct marketing;
  • Rights related to automated decision-making: we do not make solely automated decisions that significantly affect you.

To exercise any of these rights, contact us at [INSERT DATA CONTROLLER EMAIL]. We will respond within one month. You will not be charged for exercising your rights.

9. Cookies

Our Site uses cookies — small text files stored on your device — for the following purposes:

  • Strictly necessary cookies: required for the Site to function (e.g. session authentication for logged-in users). These cannot be disabled.
  • Analytics cookies: where used, to understand how visitors use the Site and improve our content. We will seek your consent before setting these.

You can control non-essential cookies through our cookie consent banner and through your browser settings. Disabling cookies may affect Site functionality.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted data transmission (HTTPS), access controls, and secure password storage. However, no internet transmission is completely secure and we cannot guarantee the security of data transmitted to the Site.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the updated policy on this page with a revised "Last updated" date. Continued use of the Site after any changes constitutes acceptance of the updated policy.

12. How to Complain

If you have concerns about how we handle your personal data, please contact us in the first instance at [INSERT DATA CONTROLLER EMAIL]. If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO):