Tenant Application — Privacy Notice (Private Rented Sector)
Last updated: 3 May 2026.
This notice explains what we do with the information you give us when you apply to rent a private rented property managed through PropFlow. Please read it before you submit your application.
1. Who we are
PropFlow AI Ltd (“PropFlow”, “we”, “us”) provides software that helps landlords and letting agents manage rental properties.
When you apply for a property, two organisations are joint controllers of your information under UK GDPR:
- PropFlow AI Ltd — operates the software and stores your data.
- The landlord or letting agent advertising the property — uses your information to decide whether to offer you a tenancy. The advert page tells you who they are.
If we use a tenant referencing provider (such as Vouch), they act as a processor on the landlord's behalf — they only do what the landlord instructs and cannot use your data for their own purposes.
You can contact us at privacy@propflow.ai.
2. What we collect
We collect the following from you directly:
- Identity: full name, date of birth, email, mobile, National Insurance number (optional).
- Right to Rent: nationality, ID document type and image, or a Home Office Share Code (England properties only — different rules for Scotland, Wales, Northern Ireland).
- Address history: every address you've lived at over the past three years.
- Employment: current employer, job title, salary, contract type, employer contact for reference.
- Income: salary, benefits, self-employed income, other sources.
- Rental history: previous landlords/agents and their contact details for reference.
- Credit-check consent: explicit consent for us (or a referencing provider acting on the landlord's behalf) to run a soft credit check.
- Right to occupy: number of adults, children, and pets who would live at the property.
- Lifestyle: smoker/non-smoker, working from home, etc.
- Equality monitoring (optional): ethnicity, religion, disability, sexual orientation, gender identity. You can skip this entirely. If you provide it, it is stored separately and is never linked to a decision about your application.
If you give us consent, we may collect from third parties:
- Open Banking: if you connect your bank account through our referencing provider, we receive a verified income figure and affordability indicators — we do not see your transaction history.
- Credit reference agencies: a soft credit check (no impact on your credit score) returning a score band and any CCJs or bankruptcies.
- Home Office (Right to Rent): verification of your Share Code.
- Your previous employers and landlords: confirmation of the references you provided.
3. Why we collect it (lawful basis)
| Information | Why | UK GDPR lawful basis |
|---|---|---|
| Identity, address history, employment, income, rental history | To assess whether to offer you a tenancy | Necessary for entering into a contract (Art. 6(1)(b)) |
| Right to Rent | To comply with the Immigration Act 2014 | Legal obligation (Art. 6(1)(c)) |
| Credit and bank-account checks | To assess affordability and credit risk | Consent (Art. 6(1)(a)) — you can refuse, but the landlord may decide not to proceed |
| Equality monitoring | To monitor and improve fairness in tenant selection | Explicit consent (Art. 9(2)(a)) — fully optional |
| Audit log of your application activity | To meet our regulatory record-keeping obligations | Legitimate interest (Art. 6(1)(f)) |
4. Who we share it with
- The landlord or letting agent advertising the property — they see your full application.
- Tenant referencing provider (Vouch or equivalent), if used — they verify your information and return a Pass/Refer/Fail recommendation. The landlord chooses whether to use one.
- Credit reference agencies and the Home Office — for the checks listed above.
- Our service providers — Supabase (hosting, UK/EEA region), Resend (email), Twilio (SMS/WhatsApp), Stripe (if you pay a holding deposit). Each is contractually bound under UK GDPR Article 28.
- HMRC, courts, regulators — only if required by law.
We do not sell your data and we do not use it for advertising.
5. International transfers
Your data is stored in the United Kingdom or the European Economic Area. Some of our service providers (e.g. Stripe) process limited information in the United States under UK approved Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework.
6. How long we keep it
| Outcome | Retention |
|---|---|
| You started the form but did not submit | 14 days (then automatically deleted) |
| You submitted but the landlord declined | 6 months from the decision |
| You signed a tenancy with the landlord | Duration of the tenancy + 6 years (HMRC and limitation-period requirements) |
| Equality monitoring data | Aggregated annually; raw responses deleted after 12 months |
| Right to Rent records (England) | Tenancy duration + 1 year (statutory) |
7. Your rights
You can ask us to:
- See a copy of the information we hold about you.
- Correct anything that is wrong.
- Delete your data (subject to retention obligations above).
- Restrict or object to processing.
- Receive your data in a portable format.
- Withdraw consent (where consent was the lawful basis) — without affecting processing already done.
Email privacy@propflow.ai to exercise any of these. We respond within one calendar month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office: ico.org.uk / 0303 123 1113.
8. Automated decision-making
A tenant referencing provider may give the landlord a Pass / Refer / Fail recommendation based on the checks above. The landlord makes the final decision, not the algorithm. You have the right to ask for human review of any automated component, to express your point of view, and to contest the decision.
By submitting the application, you confirm you have read this notice and agree to the processing described.