Privacy Policy

1. Introduction

Tenant 2 Owner Limited, trading as tenant2owner ("we", "our", or "us"), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you visit our website, interact with us, or use our services.

Tenant 2 Owner Limited (company number 16727310) is the data controller for the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We may collect and process the following personal information:

• Contact details: Name, email address, telephone number (if provided).
• Website usage data: IP address, browser type, operating system, referral source, pages visited, and time spent on site.
• Form submissions: Information you provide when signing up for updates, requesting resources, or contacting us.
• Booking and payment details: what you bought, when, and the payment reference. Card details are entered on Stripe's own checkout and we never see or hold them.
• Programme and session participation: your Zoom display name and attendance, and anything you choose to share in a group.
• Tool and calculator answers: our readiness check, buyer personality, rent versus buy, deposit and cost calculators score your answers in your browser. We do not save those answers to our servers. If you ask us to email a result or report, we keep the name and email you give us and the report we produced.
• Event RSVPs and feedback: your name, email and any comments you send us.
• Cookies and tracking technologies: See Section 8.

We do not knowingly collect special category data (e.g. health, political opinions) or information from children under 16.

3. How We Use Your Information

We use personal data only where lawful and necessary, including:

• To respond to your enquiries and provide requested information.
• To send newsletters, resources, or updates (if you opt in).
• To improve website performance, user experience, and content.
• To comply with legal and regulatory requirements.
• To protect against fraud, misuse, or unauthorised access.

4. Legal Bases for Processing

We rely on the following lawful bases:

• Consent – when you subscribe to updates or request resources.
• Contract – when providing information or services you request.
• Legal obligation – where required by law.
• Legitimate interests – for website analytics, security, and improvements (balanced against your rights).

5. Sharing Your Information

We do not sell or rent your data. We use the following processors, and only for the purposes shown:

• Supabase – hosting, our database, accounts and stored reports.
• Stripe – taking payments and handling refunds. Stripe is a controller in its own right for fraud prevention.
• MailerLite – sending the newsletter and programme emails, and recording opens and clicks.
• Zoom – running webinars, group sessions and Bridge calls.
• WhatsApp (Meta) – optional programme group chats.
• Google Analytics, Google Tag Manager and Google Ads – measurement and advertising, only after you consent in the cookie notice.
• Google reCAPTCHA – spam protection on our forms.
• OpenAI – generating the spoken narration for our guide audio. We do not send your personal data to it.

We also share data with legal or regulatory bodies where the law requires it, and with our professional advisers where necessary. All processors are bound by written terms and must act in compliance with UK GDPR.

6. International Transfers

If data is transferred outside the UK (e.g. via cloud services), we ensure appropriate safeguards are in place, such as standard contractual clauses or UK adequacy decisions.

7. Data Retention

We keep personal data only as long as necessary:

• Contact enquiries: up to 12 months after the last message.
• Newsletter subscriptions: until you unsubscribe, then a suppression record so we do not email you again.
• Event RSVPs and feedback: 12 months, and feedback comments are anonymised after that if we keep them for reporting.
• Programme and Bridge accounts and course progress: for the programme, then 2 years so that you can come back to your materials, unless you ask us to delete them sooner.
• Generated reports stored for you: 12 months, then deleted.
• Payment, invoice and refund records: 6 years from the end of the relevant financial year, because HMRC and the Companies Act require us to keep financial records for that period. We cannot delete these earlier, even on request.
• Complaint records: 6 years, in case of a later claim.
• Analytics data: retained by Google for up to 14 months, in aggregated form.

When no longer needed, data will be securely deleted.

8. Cookies & Tracking

Our website uses cookies and similar technologies to:

• Improve site performance and functionality.
• Analyse visitor behaviour (e.g. Google Analytics).
• Store preferences where applicable.

Analytics and advertising cookies are set to denied until you choose. Our cookie notice appears on your first visit and you can choose "Essential only" or "Accept all". To change your mind later, clear this site's stored data in your browser and the notice will appear again. You can also manage or block cookies in your browser settings at any time.

9. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate information.
• Erase your data ("right to be forgotten").
• Restrict processing in certain circumstances.
• Object to processing for legitimate interests or marketing.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent at any time (does not affect prior lawful processing).

To exercise these rights, contact us at data@tenant2owner.co.uk.

10. Data Security

We implement appropriate security measures (encryption, access controls, backups) to protect your personal information against loss, misuse, or unauthorised access.

11. Complaints

If you have concerns, please contact us first at data@tenant2owner.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: Information Commissioner's Office (ico.org.uk)
• Telephone: 0303 123 1113

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date.