Tenancy Agreement Service (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights under UK data protection law.
We are the data controller for the personal data we process. Our principal place of business is in the United Kingdom, and our processing is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What data we collect
Data you provide to us
When you contact us through the contact form, we collect: your name, your email address, the content of your message, and any other information you choose to include in your message. When you join the waitlist for legal document templates, we collect: your email address and (optionally) your name. When you purchase a legal document template (after launch), we collect: your name, billing address, and payment information processed by our payment provider (Stripe). We do not store full payment card details on our servers.
Data collected automatically
When you visit the site, our hosting provider and analytics tools collect technical information including: your IP address, browser type and version, device type, operating system, pages visited, time spent on pages, referring URL, and approximate location based on IP geolocation. This data is used in aggregated form to understand site usage and improve content.
Cookies
We use a small number of cookies to make the site work and to understand how it is used. See our Cookies Policy for the full list and how to manage cookie preferences.
How we use your data
We use the data we collect for the following purposes, each on the legal basis indicated:
- To respond to your enquiries — legal basis: legitimate interest in providing customer service.
- To send you the templates and updates you have asked for — legal basis: consent (which you can withdraw at any time).
- To process payments and deliver legal document templates — legal basis: performance of a contract with you.
- To improve the site and our service — legal basis: legitimate interest in business improvement.
- To comply with legal obligations — legal basis: legal obligation (e.g. tax records, accounting requirements).
Who we share your data with
We share data with the following categories of recipients:
- Hosting and technical providers — our website hosting provider (SiteGround) and email delivery provider, who process data on our instructions and have entered into appropriate data processing agreements.
- Payment processor — Stripe, who processes payment information when you purchase a legal document template. Stripe’s privacy policy is at stripe.com/privacy.
- Analytics providers — we use Google Analytics in a privacy-respecting configuration with IP anonymisation enabled.
- Legal authorities — where required by law, court order, or to protect our legal rights.
We do not sell, rent, or otherwise commercially share your personal data with third parties for their own marketing purposes.
How long we keep your data
We retain personal data only for as long as necessary for the purposes for which it was collected, plus any retention period required by law:
- Contact form messages: 2 years from the date of your last contact, then deleted.
- Waitlist email addresses: until you unsubscribe, plus a short reasonable period for record-keeping.
- Customer records (post-launch): 6 years from the end of the calendar year of the transaction (HMRC accounting requirement).
- Analytics data: retained in aggregated form indefinitely; individual identifiers deleted after 26 months in line with Google Analytics defaults.
International transfers
Some of our service providers (notably Stripe and Google Analytics) are based in the United States. Where data is transferred outside the UK, the transfer is protected by appropriate safeguards including the UK Addendum to the EU Standard Contractual Clauses or the Data Privacy Framework, depending on the recipient.
Your rights
Under UK data protection law you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure — in defined circumstances, you can ask us to delete your data.
- Right to restrict processing — in defined circumstances, you can ask us to pause processing.
- Right to data portability — for data we process by automated means, you can ask for it in a portable format.
- Right to object — you can object to processing based on our legitimate interests.
- Right to withdraw consent — where processing is based on consent, you can withdraw consent at any time.
- Right to complain to the ICO — you can complain to the Information Commissioner’s Office about our handling of your data. The ICO’s contact details are at ico.org.uk.
To exercise any of these rights, contact us through the contact form or by email. We respond to subject access requests within one month of receipt.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These include encrypted data transmission (HTTPS), secure password authentication for our admin systems, restricted access to personal data on a need-to-know basis, and regular review of our security practices. No data transmission over the internet is completely secure, but we take all reasonable steps to protect your data.
Changes to this policy
We review and update this Privacy Policy as our practices change. The “last reviewed” date at the top of the page shows when this policy was most recently updated. Significant changes will be communicated to waitlist subscribers and customers by email; minor changes will be reflected in the updated date.
Contact us about this policy
If you have questions about this Privacy Policy, the data we hold about you, or how to exercise your rights, contact us through the contact form. We aim to respond to privacy enquiries within 5 working days.