Privacy Policy

Last updated: 27 July 2026

This policy explains how NotifyLandlord (“NotifyLandlord”, “we”, “us”), operated by Merseyside Property Ltd, collects, uses, shares and protects personal data when you use our property-management application at notifylandlord.co.uk (the “Service”). We are the data controller for the personal data described here and are committed to handling it in line with the UK GDPR and the Data Protection Act 2018.

1. Who this policy is for

NotifyLandlord is used by landlords and letting businesses (“customers”) to manage their properties. It covers personal data about our customers and their staff, and about the tenants, applicants, guarantors and contacts our customers manage using the Service.

2. Information we collect

• Account and contact details — names, email addresses, usernames, phone numbers and the company you belong to.
• Property and tenancy data — property addresses, tenancy details, safety certificates, documents and related records.
• Tenant and applicant data — names, contact details and, where provided by our customers, dates of birth and identity documents for Right to Rent and referencing.
• Financial data — rent charges, payments, invoices, and bank transaction data retrieved via Open Banking (see section 4) to reconcile incoming payments.
• Usage and technical data — information generated when you use the Service, such as activity logs, and essential cookies used to keep you signed in.

3. How we use your information and our legal bases

• To provide the Service (performance of a contract) — managing properties, tenancies, rent ledgers, documents and communications.
• To reconcile payments and run the business (legitimate interests) — matching bank transactions to tenancies, and keeping the Service secure and reliable.
• To meet legal obligations — for example retaining financial records for the periods required by law.
• With consent — where you connect a bank account through Plaid, that access is based on your explicit consent, which you can withdraw at any time by disconnecting the bank.

4. Bank account information and Plaid

Where you choose to connect a bank account, we use Plaidto retrieve read-only transaction information via Open Banking, so we can reconcile incoming payments against tenancies. You authenticate directly with your bank through Plaid; we never see or store your online banking credentials. By connecting an account you also agree to Plaid's handling of your data as described in the Plaid End User Privacy Policy. You can revoke this access at any time by disconnecting the bank within the Service.

5. Who we share information with

We do not sell your personal data. We share it only with service providers who help us run the Service:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Plaid — Open Banking access to bank transaction data (see section 4).
• Google — sending and receiving email through your connected Gmail account.
• DocuSign — electronic signature of tenancy documents.

These providers act as our processors under contract, and only process personal data on our instructions. We may also disclose data where required by law.

6. International transfers

Some of our providers are based outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

7. How long we keep your information

We keep personal data only for as long as necessary for the purposes above. Financial records are retained for the periods required by UK tax and accounting law (generally up to six years). Bank transaction data is retained only as needed to reconcile payments, and access is removed when you disconnect the bank or close your account. When an account is closed, associated records are deleted, subject to any legal retention obligation.

8. How we protect your information

Access to data is restricted by role and isolated per company, all traffic is encrypted in transit (TLS 1.2 or higher), and data is encrypted at rest. Connecting a bank account requires multi-factor authentication. Further detail is set out in our internal Information Security Policy.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where no legal obligation requires us to keep it;
• restrict or object to processing;
• data portability;
• withdraw consent, where processing is based on consent.

To exercise any of these rights, contact us using the details below. If you are a tenant or applicant whose data was provided by a landlord using NotifyLandlord, that landlord is the controller of your data and you should contact them in the first instance; we will assist them in responding.

10. Cookies

We use essential cookies only, to keep you signed in and to operate the Service securely. We do not use advertising or third-party tracking cookies.

11. Children

The Service is intended for business use and is not directed at children.

12. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, where changes are significant, take reasonable steps to notify you.

13. Contact us

For any privacy question or to exercise your rights, contact us at privacy@notifylandlord.co.uk. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.