1. Who we are
Newjay Ltd ("we", "us", "our") is a private company registered in England & Wales (Company No. 16752778). We operate the letting agency service at newjaylettings.co.uk. For the purposes of the UK GDPR and the Data Protection Act 2018 we are the data controller of the personal information you share with us.
- Trading address: Manchester, United Kingdom
- Contact for data queries: shimmy@newjaylettings.co.uk
- ICO registration: To be confirmed
2. What we collect and why
We collect only what we need to run the letting service you've asked us to provide:
- Landlord enquiries — name, email, phone, property address. Used to give you a valuation and quote.
- Tenant applications — name, email, phone, employment info, current address, guarantor details (if applicable). Used to reference and place you into a tenancy.
- Tenancy agreements & deeds of guarantee — full name, address, signature, IP address and timestamp captured at signing. Kept for the life of the tenancy and for six years afterwards (limitation period under the Limitation Act 1980).
- Invoicing — billing name, address, email. Kept for six years for HMRC.
- Website analytics — page views and rough usage patterns via PostHog, but only if you accept the cookie banner. Sign pages are never recorded.
3. Lawful bases
- Contract — to deliver the letting service you engaged us for (Art. 6(1)(b)).
- Legal obligation — HMRC record-keeping, right-to-rent checks, anti-money-laundering (Art. 6(1)(c)).
- Legitimate interests — website security, fraud prevention, occasional marketing to past landlords (Art. 6(1)(f)).
- Consent — website analytics only (Art. 6(1)(a)), collected via the cookie banner.
4. Who we share it with
- The landlord / letting agent named on your tenancy (if you're a tenant), or the tenant you're letting to (if you're a landlord).
- Payment / email delivery providers strictly for the purpose of running the service (Resend for email; MongoDB Atlas for encrypted storage; Emergent for hosting).
- HMRC, local authorities, deposit-protection schemes, right-to-rent checkers, our Client Money Protection scheme provider — where legally required.
- We never sell your data.
5. How long we keep it
- Enquiries with no follow-through: 12 months
- Signed tenancies + deeds: life of the tenancy + 6 years (Limitation Act)
- Invoices / financial records: 6 years (HMRC)
- Analytics data (if you consented): 12 months, then anonymised
6. Your rights
Under UK GDPR you can, at any time, ask us to:
- See what we hold about you (Subject Access Request — free, within 30 days)
- Correct anything that's wrong
- Delete your data (where we're not legally required to keep it)
- Object to marketing
- Port your data to another provider
Email shimmy@newjaylettings.co.uk with the words "Data request" in the subject line. If you're not happy with how we handle it, you can complain to the ICO at ico.org.uk.
7. Security
All traffic is served over TLS 1.3 (HTTPS). Passwords are salted + hashed with bcrypt. Signed documents are stored in an encrypted database, accessible only via authenticated admin sessions with two-factor authentication. IP addresses and user-agents are recorded for every signature to form part of the audit trail under the Electronic Communications Act 2000.
8. Cookies
See our dedicated cookie policy for full detail.
9. Changes to this policy
We'll update this page when things change and note the date at the top. Material changes will be highlighted in the cookie banner or via email if you're an existing client.
Any queries — contact us.