Last updated 19 August 2026
UK GDPR Articles 13 and 14; Data Protection Act 2018; both as amended by the Data (Use and Access) Act 2025.

In short

• What we use your information for — letting and managing property: assessing applications, setting up and running tenancies, collecting rent, arranging repairs, and meeting our legal duties.
• Who we share it with — referencing agencies, the deposit scheme, landlords and tenants, contractors, the local authority, HMRC, our advisers, and the software providers we use to run the business. We do not sell your information, and we do not share it for other companies to market to you.
• How long we keep it — only as long as we need it. Most tenancy records go 6 years after the tenancy ends; Right to Rent documents are destroyed 12 months after it ends. Full table in section 11.
• Your rights — you can ask to see your information, correct it, delete it, restrict how we use it, move it, or object to our using it. See section 12.
• If you are unhappy — tell us and we will investigate: Ben Nicholls, benedict@kpa.co.uk. You can also complain to the Information Commissioner at any time. See section 16.

Which parts apply to you?

You do not need to read all of this. This table points you to the parts that concern you.

About this notice

We are a residential lettings and property management business, specialising in HMOs, family lettings and student lettings. We are not an estate agency and we do not sell property.

This notice explains what personal information we collect, why we use it, who we share it with, how long we keep it, and the rights you have. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. We have kept it as plain as we can — if anything is unclear, please just ask.

1. Who we are

KPA Property Management is the trading name of KPA Property Ltd. We are the "data controller" for the information described in this notice, which means we decide how and why it is used. In our lettings work we act as the agent for the property owner.

Your data protection contact

For anything in this notice — questions, a request about your information, or a complaint — contact Ben Nicholls, Director, at benedict@kpa.co.uk, or write to the Bristol address above.

Ben Nicholls is the director responsible for data protection and is your point of contact.

2. Who this notice is for

• Landlords and property owners who instruct us
• Tenants, occupiers and their guarantors
• People applying to rent a property through us, whether or not the application succeeds
• Contractors, tradespeople and suppliers who work with us
• Visitors to our website and people who contact us with an enquiry
• Anyone else whose information we handle while managing a property — for example someone who gives a reference, a named emergency contact, or a person who contacts us about one of our properties

3. The personal information we collect

Identity and contact details

• Your name, date of birth and any previous names
• Photographic identity documents such as a passport or driving licence, and your National Insurance number. We use these for two purposes: the Right to Rent check the law requires for a property in England, and confirming your identity
• For Landlords, we also see identity documents and proof that you own the property
• Current and previous addresses, email address and telephone number

Financial information

• Bank account details, income and employment details, and a guarantor’s financial details where there is one
• Credit history and the results of affordability and reference checks
• Rent payment records and any arrears history

Tenancy and property information

• References, tenancy agreements, inventories and property condition reports
• Correspondence with us, maintenance and repair reports, and any complaints
• Photographs and video — condition reports at the start and end of a tenancy and at inspections roughly every six months, marketing photography, and any images you send us when reporting a repair. Condition photography records the state of the property, including inside rooms that are lived in. We photograph the property, not people, and we do not open personal storage.
• A photograph of you, where you have given us one for your tenancy record. This is the photograph you supply yourself — we do not take it, and we do not use it for anything beyond identifying your record.
• For contractors: your trade, qualifications, insurance details and payment details

Right to Rent and immigration documents

The law requires a check that every adult aged 18 or over who will live in a property in England has the right to rent here. This is the Landlord’s legal duty; we carry the check out on their behalf. It means we see and record immigration or identity documents, or check a Home Office share code.

More sensitive information

Occasionally we handle information that needs extra protection — for example health or disability details where you need an adjustment to your home, or information about a criminal offence that comes up through referencing. Section 7 explains the basis on which we handle it. We keep access to it tightly limited and collect no more of it than we need.

What we do not collect

We do not operate CCTV, video door entry or recorded door-entry systems at the properties we manage, and we do not have access to any such system. A small number of Landlords operate their own CCTV at their property; where they do, the Landlord is responsible for it, not us, and you should ask them about it.

4. How we collect your information, and where it comes from

Most of this comes directly from you — when you enquire, apply for a property, sign a tenancy, report a repair, or instruct us to manage your property.

We also receive information about you from other people and organisations. The law requires us to be specific, so our sources are:

• FLS Referencing — our referencing and credit-check provider. From them we receive identity confirmation, credit history, affordability and employment verification, and previous-landlord references.
• Credit reference agencies — searched as part of referencing, through FLS Referencing. A credit search may leave a record on your credit file, and the agency keeps its own record of the search.
• Previous landlords, letting agents and employers — references about your tenancy history, conduct and employment.
• Property portals and enquiry forms — Rightmove, Zoopla and SpareRoom pass us your name and contact details when you enquire.
• Landlords, and previous managing agents — who may give us information about existing Tenants when we take over the management of a property. This is often how we come to hold contact details, including a mobile number, for a Tenant we have not yet met.
• Tenants — who give us Landlord contact details, and details of other occupiers, guarantors, referees and emergency contacts.
• Publicly available sources — the Land Registry and Companies House, where we need to confirm ownership or company details. These are publicly accessible registers.
• Facebook and Instagram lead adverts — if you fill in a form inside a Meta advert of ours, Meta passes us the name, telephone number and email address you gave. Meta is a separate controller for what it does with that information on its own account, and its own privacy policy covers that part.
• Our online valuation tool — the instant valuation tool at valuation.kpa.co.uk is operated for us by a third party under our branding. If you use it, we receive the property address and the contact details you entered. That provider runs its own privacy policy, and we are reviewing its position.

5. Do you have to give us your information?

• Required by law. Right to Rent documents must be provided by every adult who will occupy a property in England. Without them the property cannot lawfully be let to you. Some financial and tax information is also required by law.
• Needed for the arrangement to work. We need identity, contact, financial and referencing information to assess an application, set up and run a tenancy, or manage a property for a Landlord. Without it we cannot proceed with your application or your instruction.
• Optional. Anything we ask for on the basis of your consent — marketing emails, non-essential website cookies, or health information you choose to share so we can make an adjustment — is entirely your choice. Refusing has no effect on your tenancy or the service we give you, and you can change your mind at any time.

6. Why we use your information, and our lawful basis

Data protection law requires us to have a valid "lawful basis" for everything we do with your information. Because we act as the Landlord’s agent, most of what we do with a Tenant’s information rests on our legitimate interests rather than on a contract — a tenancy agreement is between the Landlord and the Tenant, and we are not a party to it. This matters, because it means you keep the right to object (see section 12).

A note on safety and compliance duties. Gas safety, electrical safety, fire safety, energy performance and licensing are the Landlord’s legal obligations, not ours. We advise on them and help arrange them under our management agreement, which is why that work appears under legitimate interests above rather than as a legal obligation of our own.

Using software to deliver our service. Like any modern lettings business we use third-party software to run the day-to-day management of a property — to hold tenancy records, and to receive, triage and track repair reports. Each of those providers has its own data protection policy, which we can supply to you on request. Section 9 sets out the categories of provider we use.

7. More sensitive information

Some information needs an additional condition under data protection law before we can handle it at all. We keep this deliberately narrow, and rely only on the following:

• Health or disability information — with your explicit consent. If you tell us about a health condition or disability so that we can make an adjustment, adapt the property, or take it into account in how we deal with you, we use it because you have expressly agreed that we may. You can withdraw that consent at any time and we will stop using it, although we may need to keep a record that the adjustment was made.
• In an emergency — to protect someone’s life. If there is an immediate risk to someone’s life or serious health, we may use or share health information without consent — for example telling the emergency services what they need to know.
• Where a legal claim is involved. If information of this kind is relevant to establishing, exercising or defending a legal claim, we may use it for that purpose.

Information we did not ask for. Sometimes information of this kind reaches us when we did not ask for it — a health condition mentioned in passing in a repair report, for example. We do not add health information to your tenancy file unless we need it there — usually we simply deal with whatever the message was about. We would rather hold less of this than find a reason to keep it.

Criminal offence information. We do not ask about criminal convictions and we do not carry out criminal record checks. Referencing looks at credit history, which may include county court judgments and other adverse credit — these are civil and financial matters, not criminal ones. If a Tenant or applicant chooses to tell us about a criminal matter, we record only what we need to manage the tenancy and we do not seek it out. Separately, if you tell us that somebody you live with has done something unlawful — racially abusing a housemate, harassment, threats, damage — we will record what you have told us and act on it, because we have to. Two conditions in the Data Protection Act 2018 allow us to: Schedule 1, Part 2, paragraph 10, preventing or detecting unlawful acts, and where somebody is being harmed, paragraph 18, safeguarding of individuals at risk. Our Appropriate Policy Document sets out how we handle information of that kind, and you can ask us for a copy.

Right to Rent documents. Immigration and identity documents are not in themselves the kind of information that needs an additional condition, so we handle them under the basis in section 6. We nonetheless treat them with the same care: restricted access, and destruction on the timetable in section 11.

8. How we contact you

We normally contact you by telephone, email or post, and through our maintenance portal for anything to do with repairs. Tell us if you would prefer a particular method and we will use it where we reasonably can.

Please keep an eye on portal emails. While you do not have to report repairs through our portal, we will use it to notify you of an appointment, to tell you that somebody is coming, and to update you on a job — so those emails do need watching. If email does not work for you, tell us and we will agree another way.

WhatsApp. For shared houses and HMOs we run a group for each property containing our team and the housemates, which we use for things that affect the whole house. Being in a group means the other members can see your telephone number, and your WhatsApp profile name and picture. If you would rather not be in one, tell us and we will keep you informed by email or text instead — you do not need to give a reason. We do not raise anything personal to you in a group: rent arrears, your conduct and your circumstances are discussed with you directly and privately.

Telephone calls are recorded. Calls to and from our office are recorded, so that we have an accurate record of what was agreed, so that we can look into a complaint properly, and to help train the team. Nobody listens to them routinely, and we do not use recordings to assess how an individual member of staff is performing. Recordings are kept for six months and then deleted automatically. You can ask us for a copy of a call you took part in. If you would rather a conversation was not recorded, tell us and we will deal with it by email instead.

Marketing. We only send marketing to people who have actively agreed to receive it. Every message has an unsubscribe link, or you can simply tell us to stop and we will. Choosing not to hear from us has no effect on your tenancy or the service we give you.

9. Who we share your information with

We share information only where we need to. We do not sell it, and we do not pass it to other organisations so that they can market their own products to you. We share for the purposes, and on the lawful bases, set out in section 6.

• The Landlord of your property — the tenancy information they need as the owner. Landlord contact details are given to Tenants where the tenancy requires it.
• Referencing and credit reference agencies — we use FLS Referencing. They, and the credit reference agencies they search, also use your information for their own purposes, so they are separate controllers, and a credit search may leave a record on your credit file.
• The Deposit Protection Service — the government-approved custodial scheme we use. We protect deposits and serve the prescribed information within 30 days.
• Contractors and tradespeople — so they can contact you, arrange access and carry out the work.
• Utility providers and the local authority — council tax notification, and HMO or selective licensing. Licensing can mean the council receives details of the property, its occupiers and the safety certificates, and may keep a public register.
• HMRC and other authorities — where the law requires it, including the Non-Resident Landlord Scheme where it applies.
• Our insurers, accountants and solicitors — where they need it to advise us. We do not instruct debt recovery agents and we do not bring court proceedings on a Landlord’s behalf.
• The Property Redress Scheme and Client Money Protect — our redress and client money protection providers, if a complaint or claim is made.
• The police, courts and regulators — where we are legally required to share information.
• The software providers who run our systems — property management, maintenance and repairs, inventories and inspections, out-of-hours cover, communications, marketing and accounting.

10. Sending information outside the UK

Some of the providers we use are based outside the UK, or store information outside it. Where that happens we only transfer your information if it will be protected to a standard that is not materially lower than under UK law. Depending on the provider, we rely on UK regulations recognising a country as providing equivalent protection, on the UK Extension to the EU–US Data Privacy Framework, or on contract terms approved for UK transfers.

You can ask us which of these applies to a particular provider, and for a copy of the relevant safeguard, using the contact details in section 1.

11. How long we keep your information

We keep information only as long as we need it — to provide our service, to meet our legal obligations, and to deal with a dispute that might arise afterwards. Where a period below is expressed as "after the tenancy ends", it runs from the end of the tenancy or of our management of the property, whichever is later.

12. Your rights

You have the following rights over your personal information. You can ask us to:

• Give you a copy of the information we hold about you — a "subject access request"
• Correct anything that is wrong or incomplete
• Delete information where there is no good reason for us to keep it
• Restrict how we use it — for example pausing our use of it while we look into a concern you have raised about its accuracy
• Transfer it to another organisation, in a portable form
• Stop using it where we rely on your consent, by withdrawing that consent
• Complain to us about how we have handled your information — a right in its own right, explained in section 16

Which rights apply, and when

Which rights apply depends on why we are using your information — and if you would like this explained for your own situation, just ask and we will talk it through with you. In summary:

So, for example, we cannot delete your Right to Rent records on request while we are still legally required to hold them — but we will destroy them as soon as that duty ends.

How to exercise your rights

Contact Ben Nicholls at benedict@kpa.co.uk, or write to our Bristol address. It is free. We will respond within one month. If a request is particularly complex, or you have made several, we may need up to two further months — we will tell you within the first month if that is the case, and explain why. We may need to confirm your identity before we can respond, and if we do, the month runs from the point we have what we need.

13. Automated decisions and AI

We do not make decisions about you by automated means alone. Referencing produces a report which may include a score, but the decision on whether to proceed with an application is always made by a person, be that a member of our team or the Landlord. They consider the circumstances, and you can talk to us about a decision at any time.

Our maintenance portal, Fixflo, uses an AI assistant called Aidenn to help diagnose and route repairs from what you describe and send us, including any photographs or video you choose to send. It does not decide anything about your tenancy, your rent or whether you can live in a property, and a member of our team reads the outcome before we act on it. If you would rather not use it, report repairs to us by email or post instead.

14. Cookies and our website

When you visit www.kpa.co.uk we use cookies and similar technologies. Some are essential — they make the site work, keep it secure and let our enquiry forms function. You can accept or refuse the rest through the banner and change your mind at any time; choose “Customize” to see exactly what we use, who provides it and how long it lasts.

15. Children’s information

We let property to adults, and our tenancy agreements are with people aged 18 or over. We do not market to children and our website is not directed at them.

We do sometimes hold limited information about children — for example the names and ages of children who will live in a family let, because that affects whether a property is suitable and how it is managed. We keep this to the minimum we need, hold it as part of the tenancy file, and apply the same retention periods in section 11. A parent or guardian can exercise the rights in section 12 on a child’s behalf, and an older child may exercise them personally.

16. How to complain

You have a right to complain to us. If you are unhappy with how we have handled your information, tell us and we would much rather put it right. Contact Ben Nicholls at benedict@kpa.co.uk or write to our Bristol address.

We will acknowledge your complaint within 30 days of receiving it, tell you who is dealing with it, investigate, and let you know the outcome. If we need longer to investigate we will keep you updated.

You can also complain to the Information Commissioner. The Information Commissioner’s Office is the UK regulator for data protection and you have the right to raise a concern with them:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

Complaints about our service more generally, rather than about your personal information, go to the Property Redress Scheme — see our terms of business for details.