Privacy Notice

Paul Keeling and Bron Keeling are the data controllers for the personal data described in this notice. That means we decide what is collected and why, and we are answerable for it. We are a family business: we own and manage the houses ourselves, and there is no separate agency between you and us.

Contact us about anything on this page by email to Paul at paulkeeling1@gmail.com or by phone on 07971 228465, or by email to Bron at bronkeeling@gmail.com or by phone on 07966 652042.

ICO registration: ZA603273.

The application form. For each applicant in the group we ask for: full name, email address, mobile number, permanent home address, year of study, and course. We use it to assess the application, to identify the group applying for a particular house, and to contact you about it.

Our lawful basis is Article 6(1)(b) UK GDPR — processing necessary for the performance of a contract with you, or to take steps at your request before entering into one. Applying for a house is exactly that: a step you have asked us to take towards a tenancy agreement. We are not asking for your consent, and there is no consent box on the form, because consent is not the right basis for it. Without these details we cannot process an application.

Guarantor details.The form also asks for the name, email address and home address of each applicant’s parental guarantor, so that we can approach them about guaranteeing the tenancy. We ask for the address at this stage, rather than later, because a guarantee is only useful to us if it can be enforced: we need to know the guarantor is based in the UK. If the person named is resident abroad we will tell you straight away and ask for a UK-based guarantor instead, which is much easier to sort out before a house is held than after. See If someone else has given us your details below.

The enquiry form. Name, email address, an optional phone number, the property you are asking about, and your message. We use it to answer you. The basis is Article 6(1)(f) — our legitimate interest in responding to people who contact us about our houses.

Technical data. Our host keeps standard server logs, which include your IP address, and both forms count submissions per IP address for a few minutes to block automated spam. The basis is Article 6(1)(f) — our legitimate interest in keeping the site available and free of abuse.

What we deliberately do not ask for. The application form does not collect date of birth, nationality, passport or ID documents, National Insurance numbers, bank details or income evidence. Right to Rent checks and referencing happen later, in person or through a separate secure process — never through a form on a public website.

If we take an application forward, later stages of the process involve personal data that this website never touches. In outline: a Right to Rent immigration status check, which the law requires us to carry out before granting a tenancy (Article 6(1)(c), legal obligation, under the Immigration Act 2014); referencing, and a guarantee for your guarantor (Article 6(1)(b)); and protection of your deposit, which we are required to do (Article 6(1)(c), Housing Act 2004). We will tell you what is needed at each stage.

We do our own referencing. We do not use a referencing agency, so your details are not passed to one and no credit reference search is carried out by us as part of it.

Your deposit is protected with mydeposits, one of the government-approved tenancy deposit protection schemes for England. We are required to protect it within 30 days of receiving it and to give you the scheme’s prescribed information, which tells you how to get it back and how to dispute a deduction. To do that, the scheme is given the tenants’ names and contact details and the deposit and tenancy details.

Your application or enquiry is seen by:

• Us — Paul Keeling and Bron Keeling, who own and manage the houses. We are the landlord as well as the letting agent, so there is no separate landlord to pass your details to.
• Your guarantor — we contact them directly about guaranteeing your tenancy, which means telling them which property and which applicant they are being asked to guarantee.
• The other applicants in your group, to the extent the tenancy is a joint one — a joint tenancy names every tenant on the same agreement.
• Our suppliers, who process data on our instructions only: our website host, our email delivery service, and our email provider. They are listed in the next section.
• mydeposits, the deposit protection scheme, once a tenancy starts and a deposit is taken — and, where it applies, utility companies and the local authority. Only if your application proceeds. We reference applicants ourselves, so no referencing agency sees your details.

We do not share your details with anyone else, and we never sell them or use them for marketing.

The website is hosted by Cloudflare, which serves the pages and keeps standard server logs. Form submissions are delivered by Resend, an email delivery service, which we have set to process in its Ireland (EU) region, and are read in mailboxes provided by Google — the two of us each receive a copy. Property tour videos are hosted by Vimeoand are not loaded at all unless you press play on one; if you do, Vimeo receives your IP address and may set cookies under its own policy. We ask it not to track (its “do not track” setting).

Nothing you submit is written to our property database — the forms are emailed and not stored on the website.

Cloudflare and Googleare US companies and may process data outside the UK. Where they do, the transfer is covered by the safeguards UK law recognises: the UK Extension to the EU–US Data Privacy Framework, or the ICO’s International Data Transfer Agreement or Addendum to the standard contractual clauses.

Resendis a US company too, but we have chosen its Ireland region, so the delivery step itself happens inside the EEA rather than in the United States. The mailbox that finally receives your message is still Google’s, so those same safeguards keep applying to it.

We set no cookies on this website and store nothing in your browser. There is no analytics, no advertising and no tracking, which is why you are not asked to accept anything. Two exceptions, both narrow: a Vimeo video you choose to play may set its own cookies, and the private area we use to update property availability sets a session cookie for us, not for visitors.

Unsuccessful or withdrawn applications are deleted ten months after we tell you the outcome. Student lettings run a long way ahead: people often approach us in October for the following August or September, so if a letting falls through we may come back to the groups who asked about that house and offer it again. Ten months covers one such cycle. It also lets us answer a question about the decision if you have one.

Successful applications become part of the tenancy file. We keep those for the duration of the tenancy and for six years after it ends, which matches the period in which a claim under the agreement could still be brought (Limitation Act 1980) and the period HMRC expects business records to be kept.

Enquiries that go nowhere are deleted within twelve months. Server logs are kept for a short period by our host under its own retention policy.

If you are named on an application as a guarantor, we received your name, email address and home address from the applicant rather than from you. We use them to ask you whether you will act as guarantor, to check that you are based in the UK so the guarantee could be enforced if it ever had to be, and if you agree, to prepare the guarantee. Until you agree, our basis is Article 6(1)(f)— our legitimate interest, and the applicant’s, in arranging a tenancy that needs a guarantor. Once you agree, it is Article 6(1)(b), the guarantee agreement itself.

Applicants are asked to tell their guarantor before naming them. We will also send you a link to this notice when we first make contact. Everything in it applies to you — including the right to object to us holding your details, which you can exercise by replying to us at paulkeeling1@gmail.com.

We make no decisions about you by automated means, and we do not profile you. A person reads every application.

Under UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have anything inaccurate corrected, or anything incomplete filled in.
• Erasure — ask us to delete your data, where we have no continuing reason to hold it.
• Restriction — ask us to pause our use of it while a query about it is resolved.
• Objection — object to processing we carry out under our legitimate interests, including anything described above under Article 6(1)(f).
• Portability — receive the data you gave us in a common, machine-readable format, or have us send it to someone else.

To exercise any of them, email paulkeeling1@gmail.com and say what you want. It costs nothing, and we will respond within one month. We may ask you to confirm who you are first, so that we do not disclose your details to someone else.

If you think we have got something wrong, tell us first — it is usually the quickest fix. You also have the right to complain to the UK’s data protection regulator at any time:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint (opens in a new tab)

If this notice changes, the updated version appears on this page with a new date at the top.