Privacy Policy

The data controller for the personal data described in this policy (except Occupant Data, see section 3) is [RegalNest legal entity name] Ltd, registered in England and Wales under company number [company number], registered office [registered office address]. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

For any privacy query, or to exercise your rights, contact our data protection team at [privacy@regalnest.co.uk].

a. Account and contact data

• Name, email address, telephone number, business name and role;
• Login credentials and account preferences.

b. Billing data

• Billing name and address, Subscription plan, and transaction records. Card details are collected and processed directly by our payment provider; we do not store full card numbers.

c. Property and occupant data you upload

• Information about properties, tenancies, leases, payments and communications, which may include personal data about your tenants, guarantors, occupants, applicants and contractors ("Occupant Data").

d. Usage and technical data

• Device and browser type, operating system, IP address, and log data about how you interact with the Services, including pages visited and actions taken.

e. Cookies and similar technologies

• We use cookies and similar tools to operate the Services, remember your preferences and understand usage (see section 5).

We act as a data controller for the account, billing, usage and technical data we collect to provide and manage the Services and our relationship with you.

For Occupant Data that our customers upload and process using the Services, the customer is the data controller and RegalNest acts as a data processor. We process Occupant Data only on the customer's documented instructions and under a Data Processing Agreement. If you are a tenant or occupant and have questions about how your data is used, please contact the landlord or agent who manages your tenancy, as they control that data.

• To provide the Services (create and manage your account, deliver features, provide support) — legal basis: performance of a contract.
• To take payment and manage billing — legal basis: performance of a contract and compliance with legal obligations (e.g. tax and accounting records).
• To secure, maintain and improve the Services and prevent fraud or misuse — legal basis: our legitimate interests in running a safe, reliable platform.
• To communicate with you about service updates, security and administrative matters — legal basis: performance of a contract or legitimate interests.
• To send marketing about features and offers — legal basis: consent or legitimate interests, and you can opt out at any time.
• To comply with legal obligations and respond to lawful requests — legal basis: legal obligation.

We use strictly necessary cookies to run the Services and, with your consent where required, analytics and preference cookies to understand and improve how the Services are used. You can manage non-essential cookies through our cookie banner or your browser settings. Disabling some cookies may affect how the Services function.

We do not sell your personal data. We share it only with:

• Service providers (sub-processors) who help us run the Services, such as cloud hosting, payment processing, email delivery and analytics providers, under contracts that require them to protect your data;
• Professional advisers such as auditors and lawyers, where necessary;
• Authorities or third parties where required by law, to enforce our terms, or to protect our rights, users or the public; and
• A successor organisation in connection with a merger, acquisition or sale of assets, subject to this policy.

We aim to store and process personal data within the UK or European Economic Area. Where data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as a UK adequacy decision or the ICO's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), so that your data remains protected.

We keep personal data only for as long as necessary for the purposes described in this policy, including to provide the Services and to meet legal, accounting or reporting obligations. Account and Customer Data are retained for the duration of your Subscription and, following termination, for a limited export period before deletion or anonymisation, except where longer retention is required by law. Occupant Data is retained according to our customers' instructions.

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and monitoring. No system is completely secure, but we work to protect your data and will notify you and the ICO of any personal data breach where we are legally required to do so.

Under UK data protection law you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data in certain circumstances;
• Restrict or object to our processing in certain circumstances;
• Request portability of data you provided to us; and
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact us at [privacy@regalnest.co.uk]. If you are a tenant or occupant, please direct requests about Occupant Data to the landlord or agent who controls it. We will respond within the timeframes required by law.

The Services are intended for business users and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Where changes are material, we will provide notice through the Services or by email. The "last updated" date at the top of this page shows when it was last revised. Please review it periodically.

If you have a concern about how we handle your personal data, please contact us first at [privacy@regalnest.co.uk] so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113.