Privacy Notice
Last updated: 30 March 2026
1. Who we are
Lettle.co is a trading style of Urban Nests Ltd, a company registered in England and Wales under Company No. 12230092. We are registered with the Information Commissioner's Office (“ICO”) under registration number ZB423979.
Urban Nests Ltd is the data controller for the personal data we collect and process through the Lettle.co platform (“Platform”), except where landlords use the Platform to process tenant data, in which case the landlord is the data controller and we act as data processor on their behalf.
If you have any questions about this Privacy Notice or how we handle your personal data, you can contact us:
- By email: hello@lettle.co
- By post: Urban Nests Ltd, registered in England and Wales, Company No. 12230092
2. What data we collect
We collect and process the following categories of personal data depending on how you use the Platform:
2.1 Account and identity data
- Full name
- Email address
- Phone number (if provided)
- Account role(s) (landlord, tenant, trade)
- Password (stored in hashed form only)
2.2 Property and tenancy data (landlords)
- Property addresses
- Tenancy details (start dates, end dates, rent amounts)
- Compliance documents (gas safety certificates, EICRs, EPCs and other certificates)
- Tenancy agreements and prescribed information
- ICO registration details
2.3 Application and identity data (tenants)
- Full name, date of birth and contact details
- Identity documents (passport, driving licence or other government-issued ID)
- Right to rent documentation
- Employment and income details
- Previous address history
- References (employer and previous landlord)
- Credit check data (where you consent to a credit check as part of a tenancy application)
2.4 Trade data (tradespeople)
- Business name, trade category and contact details
- Qualifications, certifications and trade body memberships
- Insurance details
- Reviews and ratings
2.5 Communications data
- Messages sent and received through the Platform
- Support enquiries and correspondence
- Email delivery and open status (for compliance-related communications)
2.6 Technical and usage data
- IP address
- Browser type and version
- Device information
- Pages visited and actions taken on the Platform
- Login timestamps
- Session cookies and authentication tokens
3. Lawful basis for processing
We process your personal data on the following lawful bases under Article 6 of the UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Providing and managing your account | Contract (Art. 6(1)(b)) |
| Processing tenancy applications | Contract (Art. 6(1)(b)) |
| Facilitating communications between users | Contract (Art. 6(1)(b)) |
| Compliance document storage and reminders | Contract (Art. 6(1)(b)) |
| Email delivery tracking for served documents | Legitimate interests (Art. 6(1)(f)) — providing proof of delivery for compliance purposes |
| Credit checks (tenant applications) | Consent (Art. 6(1)(a)) |
| AI-assisted document review | Legitimate interests (Art. 6(1)(f)) — improving accuracy and efficiency of application processing |
| Sending service-related emails | Contract (Art. 6(1)(b)) |
| Responding to support enquiries | Contract (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f)) |
| Maintaining security and preventing fraud | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have carried out a balancing test to ensure that our interests do not override your fundamental rights and freedoms.
Where we process special category data (for example, right to rent documentation that may reveal racial or ethnic origin), we do so on the basis of substantial public interest under Article 9(2)(g) of the UK GDPR, read with Schedule 1 of the Data Protection Act 2018, or with your explicit consent.
4. How we use your data
We use your personal data to:
- Create and manage your account.
- Provide the Platform's core services, including property management, tenancy applications, communications, maintenance job management and compliance tracking.
- Send transactional emails (such as application updates, document notifications and maintenance alerts).
- Track delivery and opening of compliance-critical communications to provide landlords with proof of service.
- Process tenancy applications, including AI-assisted review of uploaded identity documents (see section 10 below).
- Facilitate credit reference checks where consent has been given.
- Connect landlords with tradespeople for maintenance and repair work.
- Respond to your support enquiries.
- Maintain the security and integrity of the Platform.
- Comply with our legal and regulatory obligations.
We do not use your personal data for marketing purposes without your consent. We do not sell your personal data to third parties.
5. Who we share your data with
We may share your personal data with the following categories of recipient:
5.1 Other Platform users
By design, certain information is shared between users as part of the Platform's core functionality. For example, landlords can see tenant application data; tenants can see landlord contact details and compliance documents served to them; tradespeople can see job details and landlord contact information for assigned jobs.
5.2 Service providers
- Postmark (ActiveCampaign LLC) — we use Postmark as our transactional email service provider. Postmark processes email addresses, names and email content in order to deliver emails on our behalf. Postmark may also place a tracking pixel in emails to track delivery and open status, which is necessary for compliance-related proof of service.
- Hosting and infrastructure providers — our Platform is hosted on servers located in the United Kingdom and/or the European Economic Area.
- Credit reference agencies — where a tenant consents to a credit check, we share necessary personal data with the relevant credit reference agency.
5.3 Legal and regulatory disclosures
We may disclose your personal data where required to do so by law, by a court order, or by a regulatory authority, or where disclosure is necessary to protect our rights, property or safety, or the rights, property or safety of others.
We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes.
6. Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.
| Data type | Retention period |
|---|---|
| Account data | Duration of account plus 6 years after account closure |
| Tenancy application data | 6 years from the end of the application process (whether successful or not) |
| Compliance documents and certificates | Duration of the tenancy plus 6 years (to reflect limitation periods) |
| Tenancy agreements and prescribed information | Duration of the tenancy plus 6 years |
| Messages and communications | Duration of the tenancy plus 6 years |
| Credit check results | 6 months from the date of the check, unless the application proceeds to tenancy |
| Identity documents (right to rent) | Duration of the tenancy plus 12 months, as required by the Immigration, Asylum and Nationality Act 2006 |
| Support enquiries | 2 years from resolution |
| Technical logs (IP addresses, login times) | 12 months |
When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.
7. International transfers
We primarily store and process personal data within the United Kingdom and the European Economic Area.
Our email service provider, Postmark (operated by ActiveCampaign LLC), is based in the United States. Where personal data is transferred to the United States, it is protected by the UK International Data Transfer Agreement and/or the EU-US Data Privacy Framework, as applicable.
We will not transfer your personal data to any country outside the UK unless appropriate safeguards are in place, in accordance with Chapter V of the UK GDPR.
8. Your rights
Under the UK GDPR, you have the following rights in relation to your personal data:
8.1 Right of access (Article 15)
You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month.
8.2 Right to rectification (Article 16)
You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data.
8.3 Right to erasure (Article 17)
You have the right to request that we delete your personal data where there is no compelling reason for us to continue processing it. This right is not absolute and may be subject to legal retention obligations (for example, we may need to retain compliance documents for the periods specified in section 6).
8.4 Right to restriction of processing (Article 18)
You have the right to request that we restrict the processing of your personal data in certain circumstances, for example, where you contest the accuracy of the data or where you have objected to processing.
8.5 Right to data portability (Article 20)
You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to request that we transmit that data to another controller, where technically feasible.
8.6 Right to object (Article 21)
You have the right to object to processing based on legitimate interests. Where you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
8.7 Rights relating to automated decision-making (Article 22)
See section 10 below for details of automated processing and your related rights.
8.8 Right to withdraw consent
Where we process your data based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact us at hello@lettle.co. We will respond within one month. In complex cases, we may extend this by a further two months, but we will inform you of any extension within the initial one-month period.
9. Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include:
- Encryption of data in transit using TLS.
- Hashing of passwords using industry-standard algorithms.
- Access controls limiting who can access personal data to authorised personnel only.
- Regular security reviews and updates.
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.
10. Automated decision-making and AI
The Platform uses AI-assisted document review as part of the tenancy application process. This includes automated analysis of uploaded identity documents and supporting materials to check for consistency, completeness and potential issues.
Important: AI document review is used as a tool to assist landlords. It does not make final decisions about tenancy applications. All application decisions are made by the landlord (a human being), who reviews the AI-generated analysis alongside the original documents before making any decision.
No solely automated decision-making (as defined in Article 22 of the UK GDPR) that produces legal effects or similarly significantly affects you takes place on the Platform. AI analysis is always subject to human oversight and review.
If you have concerns about how AI-assisted review has been applied to your application, you have the right to:
- Request human review of any AI-generated analysis.
- Express your point of view regarding the analysis.
- Contest any decision made on the basis of (or influenced by) AI analysis.
To exercise these rights, contact your landlord directly or contact us at hello@lettle.co.
11. Cookies
We use cookies and similar technologies on the Platform. Full details of the cookies we use and how to manage them are set out in our Cookie Policy.
12. Children's data
The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children under 18. If you are under 18, you must not use the Platform or provide any personal data to us.
If we become aware that we have collected personal data from a child under 18, we will take steps to delete that data as soon as reasonably practicable. If you believe that we may have collected data from a child under 18, please contact us immediately at hello@lettle.co.
13. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, technology or legal requirements. Where changes are material, we will notify you by email or by displaying a prominent notice on the Platform.
We encourage you to review this Privacy Notice periodically. The “Last updated” date at the top of this page indicates when this Privacy Notice was last revised.
14. How to complain
If you are unhappy with how we have handled your personal data, we would like the opportunity to resolve your concern. Please contact us in the first instance at hello@lettle.co.
If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (“ICO”):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15. Contact
If you have any questions about this Privacy Notice or wish to exercise your data protection rights, please contact us:
- By email: hello@lettle.co
- By post: Urban Nests Ltd, registered in England and Wales, Company No. 12230092
- ICO Registration: ZB423979