PRIVACY POLICY
This policy applies to helloletio.com and Letio’s letting, property and related enquiry services. It should be read with the Cookie Policy at https://helloletio.com/cookie-policy/.
1. Who we are
Letio Ltd (company number 14475177) is the controller of personal data described in this notice, except where another organisation determines its own purposes and means of processing.
Registered address: 123 Buckingham Palace Road, London, England, SW1W 9SH. Privacy enquiries: privacy@helloletio.com. Website: https://helloletio.com/.
2. Personal data we collect
- Identification and contact details: names, addresses, telephone numbers, email addresses and correspondence.
- Property and customer records: enquiries, viewing requests, landlord and tenant details, property preferences, tenancy and management correspondence.
- Application and verification information where relevant: identity documents, Right to Rent information, referencing outcomes, affordability or financial information, guarantor details and related documentation.
- Accessibility, disability or health information where necessary to accommodate individual needs. Such information is subject to additional protections.
- Technical and website data: IP address, browser/device details, website interactions, consent preferences and related security records.
- Marketing preferences and communications, including subscription status, objections and opt-outs.
- Payments, rent, invoices, complaints and service records where applicable.
3. Where information comes from
We collect information directly from you through our website, emails, calls, property enquiries, forms and services; from landlords, tenants and other participants in property transactions; and, where appropriate, from referencing providers, professional advisers, suppliers and lawful public sources. We use Goodlord for tenant referencing and may use other providers on an ad hoc basis; relevant provider information will be given when that service is used.
4. Purposes and lawful bases
The lawful basis depends on the activity. We use the following bases, as applicable:
| Purpose | Lawful basis |
| Responding to property enquiries and arranging viewings | Legitimate interests in responding to requests, or steps before a contract at your request |
| Providing tenancy, property management or client services | Contract or steps before entering into a contract |
| Right to Rent and other mandatory checks | Legal obligation where applicable |
| Referencing and applicant assessment | Contract/pre-contract steps or legitimate interests depending on the circumstances; additional conditions assessed for sensitive data |
| Customer and landlord relationship administration | Contract or legitimate interests |
| Security, fraud prevention and resolving disputes | Legitimate interests or legal obligation |
| Financial, tax and accounting records | Legal obligation or legitimate interests |
| Optional website analytics, advertising cookies and tracking | Consent where required under PECR |
| Electronic direct marketing | Consent or a properly applicable PECR exception, with a corresponding UK GDPR lawful basis |
| Answering rights requests and regulator enquiries | Legal obligation |
Legitimate interests include responding to enquiries, maintaining customer relationships, protecting operations and pursuing or defending legal claims. We assess whether those interests are overridden by individuals’ rights. Where consent is relied on, it may be withdrawn without affecting earlier lawful processing.
5. Enquiries, CRM and tenant referencing
Letio uses HubSpot to manage customer enquiries and communications, and Microsoft 365 for business communication and document handling. Website enquiries may enter our CRM through connected forms. The processing needed to respond to a property enquiry is separate from optional marketing consent. Tenant referencing may involve Goodlord and, occasionally, other third-party referencing services. Those providers may independently determine some of their processing and provide their own privacy notices.
6. Marketing and advertising
Where lawful, we may send details of properties, services, business news and promotions. A property enquiry does not itself subscribe you to unrelated marketing. When electronic marketing requires consent, we will seek a specific, affirmative choice; any applicable existing-customer exception is subject to its legal conditions. You can unsubscribe or object at any time by using the message’s unsubscribe mechanism or emailing privacy@helloletio.com.
Letio is considering using Meta Custom Audiences but has not yet implemented customer-list uploads for that purpose. If introduced, we will assess the lawful basis, provide any required notice and choice, update our records and this notice, and apply the relevant retention controls before use.
7. Cookies, analytics and website services
Our site uses Complianz for cookie preferences. Essential technologies support operation and security; optional analytics and marketing technologies are subject to applicable consent rules. Tools used or integrated on the site include Google Analytics (via MonsterInsights), Microsoft Clarity, HubSpot tracking, Google reCAPTCHA and potentially advertising technologies. Not every listed technology is used on every page or for every visitor.
Visitors can Accept All, Reject All or customise consent and revisit choices using Cookie Settings. Consent-dependent tracking is configured to respond to these choices. Cookies already stored on a device may remain after withdrawal; visitors can remove them with browser controls. Details of providers, cookies and their durations are in the Cookie Policy: https://helloletio.com/cookie-policy/.
8. Recipients and service providers
We share information only where appropriate with hosting, IT and security providers; HubSpot and Microsoft 365; Goodlord and other referencing providers when used; property and tenancy administration partners; accountants and legal advisers; payment or banking partners where relevant; and public authorities where lawfully required. Providers acting for us are subject to applicable data-processing and confidentiality safeguards. Some third parties act as independent controllers.
9. International transfers
Cloud and other service providers may process or access data outside the United Kingdom. Where a transfer is restricted under UK GDPR, we use an appropriate transfer mechanism, such as UK adequacy regulations, an applicable UK-US data-bridge certification, an International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or a valid exception, as appropriate. Specific supplier transfer arrangements are reviewed as part of supplier governance; further information can be requested using the contact details above.
10. Retention periods
We apply Letio’s Data Retention Schedule. Periods may be extended where a record is needed for a live dispute, claim, complaint or regulator enquiry. Six-year periods below are Letio’s retention policy informed by applicable legal and limitation considerations and do not mean every category has a statutory six-year minimum.
| Record | Retention |
| Enquiries not proceeding (HubSpot contact and enquiry notes) | 2 years after last engagement |
| Unsuccessful tenant applications, referencing and ID checks | 6 months after decision |
| Right to Rent check copies | Throughout tenancy plus 1 year after its end |
| Tenancy agreements, guarantees, occupant details and correspondence | 6 years after tenancy ends |
| Deposit records, inventories, check-in/out photographs | 6 years after tenancy ends |
| Health, disability and accessibility information | Until tenancy ends, subject to any necessary legal hold |
| Landlord client agreements, property details and correspondence | 6 years after client relationship ends |
| Rent ledgers, client money, invoices and accounting records | 6 years after financial year ends |
| Maintenance, repairs, inspections and safety certificates | 6 years after management of property ends |
| Supplier and contractor records | 6 years after contract ends |
| Complaints, data protection complaints and subject access requests | 3 years after case closes |
| Marketing prospects including third-party lists | 2 years after last engagement |
| Marketing suppression list (minimum contact information) | Retained as needed to honour opt-outs, potentially indefinitely |
| Meta Custom Audiences source files (if feature introduced) | Delete source after upload; rebuild audiences every 6 months |
| Website cookies and analytics | See Cookie Policy and applicable provider settings |
Letio’s data owner reviews retention at least annually across CRM, email, shared storage and property-management systems. Expired information is securely deleted or anonymised, subject to legal holds and routine backup lifecycles.
11. Security
We use appropriate organisational and technical measures designed to limit unauthorised access, loss, alteration and disclosure, including access management, authentication, contractual safeguards and relevant monitoring. No online system can be guaranteed fully secure.
12. Your rights
Subject to applicable conditions and exemptions, you may request access, rectification, erasure, restriction, portability, object to processing, withdraw consent, and exercise rights relating to solely automated decisions with legal or similarly significant effects. You may object to direct marketing at any time. To make a request contact privacy@helloletio.com. We may verify identity and respond within the applicable statutory timeframe.
13. Automated decision-making
Letio does not currently use solely automated decision-making to approve or reject tenants or applicants where the decision has legal or similarly significant effects. Routine CRM organisation or analytics does not, by itself, constitute such a decision. We will update this notice before introducing relevant automated decision-making.
14. Children and other people
Our website is not aimed at children. Where a tenancy or property service requires information about children, occupants or people needing accessibility adjustments, we process it only where necessary and with appropriate safeguards.
15. Complaints
Contact privacy@helloletio.com if you have concerns. You may also complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/; telephone 0303 123 1113.
16. Updates and contact
We review this notice when our services, suppliers, technology or legal requirements change and will give further notice where required. For questions or rights requests contact Letio Ltd, 123 Buckingham Palace Road, London SW1W 9SH, or privacy@helloletio.com.
