Privacy notice
How LetDesk handles your data
LetDesk keeps rent records for landlords in England. That means we hold information about you, about your properties and tenancies, and about the tenants named in those records. This notice explains what we hold, why, and what you can ask us to do about it.
Two different roles. When you keep records about your own tenants, you are the data controller for that information and LetDesk is your processor — we hold it and process it on your instructions. When you open an account and use the app yourself, LetDesk is the controller of your account data. This notice covers both, and it says which is which as it goes.
Who we are
- Data controller
- [LEGAL ENTITY NAME]
- Company number
- [COMPANY NUMBER], registered in England and Wales
- Registered office
- [REGISTERED OFFICE ADDRESS]
- ICO registration
- [ICO REGISTRATION NUMBER]
- Privacy contact
- [PRIVACY EMAIL]
What we hold
Your account
When you sign in with Google or Apple we receive your name, your email address and, if you have one, your profile picture, together with an account identifier from that provider. We never receive your password — the sign-in happens with your provider, not with us.
Your session
We set a single cookie when you sign in. It holds a random session
identifier so we know which workspace is yours, it is marked
HttpOnly so scripts cannot read it, and it expires after 14
days. We do not use advertising or analytics cookies, and there is
nothing on this site for you to consent to or switch off.
The records you keep
Everything you enter: properties, tenancies, rent amounts and rent changes, payments and receipts, how payments were allocated, notes, and the history of changes you have made. This is the substance of the product and it is stored against your account.
Documents you attach
If you attach a file — a tenancy agreement, a certificate, evidence for a rent change — we store the file itself along with its name, type, size and a hash of its contents. Files are served back to you only through your own signed-in session.
Bank statements you import
Statement files you import are read in your browser. The text is extracted and interpreted on your own device, and only the transactions you accept are saved as records. The statement file itself is not uploaded to our servers unless you deliberately attach it as evidence.
Optional open banking
If you connect a bank account, we receive account and transaction information for the accounts you choose, from our open banking provider. We store an encrypted token so the connection keeps working, and never your bank login details — those are entered with your bank or the provider, never here. You can disconnect at any time from within the app.
Technical logs
Our hosting provider records standard server information such as IP address, request time and browser type. We use this to keep the service running and to investigate faults and abuse.
What we do not collect
- Your bank username, password or security codes.
- Advertising or analytics identifiers. We run no trackers.
- Special category data. We do not ask for health, ethnicity, religion, biometric or political information, and you should not put it into notes.
Why we are allowed to hold it
- To run your account
- Performance of a contract — Article 6(1)(b) UK GDPR. We cannot give you a workspace without an account and without storing what you put in it.
- Security and service integrity
- Legitimate interests — Article 6(1)(f). Keeping the service available, diagnosing faults and preventing abuse.
- Open banking
- Consent — Article 6(1)(a). You can withdraw it at any time by disconnecting the account, without losing the rest of your records.
Who else is involved
We use a small number of providers to run the service: a hosting provider to run the application and database, an authentication provider (Google or Apple) to sign you in, and — only if you choose to connect a bank — an open banking provider to retrieve transactions. Our providers act on our instructions and are bound to protect your information.
We do not sell your information, we do not share it for advertising, and we do not disclose it to anyone else unless the law requires it or you ask us to.
Where it is held
Your records are stored on servers in the United Kingdom. Where a provider processes information outside the UK, we rely on the appropriate safeguards under UK data protection law — the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses.
How long we keep it
- Sign-in sessions expire after 14 days.
- Account and record data is kept while your account is open, and deleted when you delete it or close your account.
- Deleted records may remain in encrypted backups for a short period before those backups are rotated out.
- Server logs are kept for a limited period for security and fault diagnosis.
If you are a tenant
Your landlord controls the records they keep about you. If you want to see, correct or delete information held about you in LetDesk, ask your landlord first — they decide what is held and for how long. If you have asked them and you are not satisfied, you can contact us and we will help them respond.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- have inaccurate information corrected;
- ask us to delete information we no longer need;
- ask us to restrict what we do with it;
- receive it in a portable format;
- object to processing based on legitimate interests.
Contact [PRIVACY EMAIL] and we will respond within one month. If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Traffic is encrypted in transit. Sessions are stored server-side and
marked HttpOnly. Account identifiers are hashed before they
are used as storage keys. Access to production systems is limited to the
people who run the service.
No system is perfect. If we ever become aware of a breach that is likely to affect your rights, we will tell you and the Information Commissioner's Office as the law requires.
Changes to this notice
If we change how we handle information we will update this page and change the version date at the top. If the change is significant we will tell you in the app.