✓PassTenant

PassTenant — Privacy Notice

Pilot service — this notice takes effect on publication.

PassTenant is a service operated by Rent Paid Ltd, Company No. 14261817, Future Business Centre, Kings Hedges Road, Cambridge CB4 2HY. For the personal data described here, Rent Paid Ltd is the data controller. Contact: support@passtenant.com.

1. What we collect

  • Identity and contact data — name, date of birth, address history, email, phone, identity documents (for identity and right-to-rent checks).
  • Financial data — income and affordability information. If you choose open-banking verification, an FCA-authorised account information provider accesses your bank data read-only, with your explicit consent, and we receive a verified income figure and an affordability range — not your transactions.
  • Referencing data — credit-check results from a licensed credit reference agency, and references from landlords and employers you nominate.
  • Usage data — when your report and share links are created, viewed and revoked.

2. Why, and our lawful bases

  • Producing your PassTenant report and operating share links — contract (UK GDPR art. 6(1)(b)).
  • Open-banking income verification — consent (art. 6(1)(a)), withdrawable at any time.
  • Credit check — legitimate interests (art. 6(1)(f)): providing the verification you bought.
  • Fraud prevention, record-keeping, complaints — legitimate interests / legal obligation.

We do not sell your data, use it for marketing without separate consent, or share it with anyone except as described here.

3. Sharing — you are in control

Your report is private by default. It is disclosed only through share links you create. Anyone with an active link can view the report, so share links only with landlords and agents you are genuinely dealing with.

You can revoke any share link at any time from your report page. Revocation takes effect immediately: the link stops working and no further access is possible through it. (Revocation cannot un-see a report someone already viewed.) All links expire automatically when your report expires (3 months after issue).

4. Who processes your data for us

  • A specialist tenant-referencing provider — referencing checks. We will name the provider here before your checks begin.
  • An FCA-authorised account information service provider — open-banking income verification. Named at the point you give consent.
  • GoCardless — payment processing (pay by bank; we never see your bank login or account credentials).
  • Supabase — secure hosting of your report and account data.

Each acts under contract as our processor (or as an independent controller where the law requires, e.g. credit reference agencies).

5. How long we keep it

  • Your report: valid 3 months, then expired; deleted 12 months after issue.
  • Identity documents: deleted within 30 days of your report being issued.
  • Open-banking data: access is one-off; the derived income/affordability figures live in your report and follow its retention.
  • Payment and order records: 6 years (tax and legal obligations).

6. Your rights

You can ask us for access to, correction of, or deletion of your data; restrict or object to processing; withdraw consent (for consent-based processing); and receive your data in portable form. Email support@passtenant.com — we respond within one month. You can complain to the ICO (ico.org.uk), but we'd welcome the chance to sort it first.

7. Security and transfers

Data is stored in the UK/EEA. If a processor stores data elsewhere, we ensure UK-approved safeguards (e.g. the UK Addendum to Standard Contractual Clauses). Reports are served over encrypted connections; share links use unguessable tokens.