Privacy Notice

This service is operated by Full Cart Solutions Limited, trading as RentCompliant (“RentCompliant”, “we”, “us”).

• Registered company name: Full Cart Solutions Limited
• Company number: 16026497
• Registered office: The George, St. John's Road, Buxton, United Kingdom, SK17 6XY
• Trading name: RentCompliant
• Website: rentcompliant.co.uk
• ICO registration: Full Cart Solutions Limited is registered with the Information Commissioner's Office as a data controller. ICO registration reference: ZB932146.

We are the data controller for personal data processed through this service. Contact our data protection contact at: privacy@rentcompliant.co.uk

We collect the following categories of personal data when you use our service:

• Landlord data: full name, email address, postal address, phone number (optional)
• Tenant data: full name, email address
• Property data: full property address
• Tenancy data: start date, rent amount and frequency, deposit details, bills arrangements
• Acceptance data: IP address, timestamp, and a hash of the submitted data at the point of terms acceptance
• Payment data: Stripe session identifiers (we do not store card details — these are handled directly by Stripe)
• Cookie and device data: where you have given consent, Google's advertising cookies collect a cookie identifier, conversion event data, and related device/browser signals to measure advertising effectiveness. We do not have direct access to the underlying raw data collected by Google.

The landlord's phone number is optional and is collected solely for inclusion in the Written Statement where the landlord chooses to provide it. It is subject to the same retention schedule as other personal data.

We process your personal data for the following purposes:

We do not use your service data (name, address, tenancy details) for marketing or profiling. We do not carry out automated decision-making within the meaning of Art. 22 UK GDPR. Where we rely on legitimate interests as our lawful basis, we have considered the balance of our interests against your rights and freedoms. Advertising cookies (where consented) are processed by Google as set out above and in Section 10.

When a landlord uses our service, they provide us with the tenant's name and email address. We received this information from your landlord, who provided it to us for the sole purpose of delivering the Written Statement of Tenancy Terms to you. You will receive this privacy notice at the time the Written Statement is delivered to you. The tenant's email address is used only once to send the document and is not used for any other purpose. We do not contact tenants for marketing purposes.

If you are a tenant and have questions about how your data has been processed, please contact us at privacy@rentcompliant.co.uk.

We use the following third-party processors to deliver our service. Where data is transferred outside the UK, we have identified the lawful transfer mechanism below:

• Supabase— database hosting (EU region, Frankfurt). Supabase processes data under a Data Processing Agreement. Data remains within the EEA and the UK adequacy decision for EEA transfers applies.
• Stripe— payment processing. Stripe Inc. is certified under the UK–US Data Bridge (UK Extension to the EU–US Data Privacy Framework). We have executed Stripe's Data Processing Agreement.
• Resend— transactional email delivery. We have executed Resend's Data Processing Agreement. Transfers to the US are covered by standard contractual clauses (SCCs) approved under UK law (the International Data Transfer Agreement / IDTA).
• Vercel— application hosting. We have executed Vercel's Data Processing Agreement. Transfers to the US are covered by standard contractual clauses (SCCs) under the IDTA. Vercel's edge network may route requests globally; personal data at rest is stored in the EU region.
• Google LLC — Google Ads conversion tracking. Where you have given consent to advertising cookies, Google processes cookie and conversion event data as an independent controller for its own advertising services. Google LLC is certified under the UK–US Data Bridge. You can review Google's privacy policy at policies.google.com/privacy and manage your Google ad settings at adssettings.google.com.

We do not sell, rent, or share your personal data with any third party for their own marketing purposes.

We retain delivery records (including personal data) for 7 years from the date of delivery, in line with HMRC record-keeping requirements and to support any legal claims that may arise from the tenancy.

After the 7-year retention period, personal identifying data (tenant email address, landlord phone number) is automatically anonymised. The anonymised record is retained for a further 3 years for aggregate compliance reporting, then deleted.

Pending delivery records where no payment was completed are automatically deleted after 30 days. Where a pending delivery is deleted, any associated acceptance audit record (including the IP address and timestamp recorded at the point of terms acceptance) is also deleted.

IP addresses captured at point of terms acceptance are retained for the same 7-year period as the delivery record to support the legal validity of the acceptance audit trail, and are anonymised alongside other personal data at the end of that period.

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access (Art. 15) — you can request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — you can ask us to correct inaccurate data
• Right to erasure (Art. 17) — in certain circumstances you can ask us to delete your data; note that erasure may be restricted where we have a legal obligation to retain records
• Right to restrict processing (Art. 18) — you can ask us to pause processing of your data
• Right to data portability (Art. 20) — where processing is based on a contract, you can ask for data you provided to us in a portable format
• Right to object (Art. 21) — you can object to processing based on legitimate interests
• Automated decision-making (Art. 22) — we do not carry out automated decision-making or profiling; this right does not apply to our processing

To exercise any of these rights, contact us at privacy@rentcompliant.co.uk. We will respond within one calendar month. We may need to verify your identity before processing your request.

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with our obligations under Art. 34 UK GDPR. We will also notify the Information Commissioner's Office within 72 hours where required under Art. 33 UK GDPR.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

We would welcome the opportunity to resolve any concern directly before you contact the ICO. Please email us at privacy@rentcompliant.co.uk in the first instance.

We use session storage (a browser-based storage mechanism) to preserve your form progress if you are redirected during payment. This data is stored only on your device and is not transmitted to us.

We also use the following cookies, subject to your consent:

Advertising cookies require your consent under PECR. These cookies will only be set after you have given explicit consent via our cookie consent banner. You may withdraw consent at any time by updating your cookie preferences or visiting adssettings.google.com.

We do not use analytics cookies or any other non-essential cookies beyond those listed above.

We may update this notice from time to time. When we do, we will update the “Last updated” date at the top of this page. Material changes will be notified via the service where appropriate.