Privacy Notice for Applicants

Passref LTD — Tenant Referencing Privacy Notice

Last updated: 15 June 2026 · Version: 0.1

Drafting note (delete before publishing): This is a working draft. Fill in every [BRACKETED] item, resolve the drafting notes, and have it reviewed by a data protection specialist before you publish. It assumes you act as an independent controller for the referencing you carry out. It reflects UK GDPR / Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025.

Not yet included — credit referencing. This notice deliberately does not mention credit reference agency searches, because you don't currently carry them out. When you launch credit referencing you must add: a credit reference agency section (with the CRAIN and footprint type), the agencies as a data source and recipient, an updated lawful-basis table, and a refreshed DPIA and LIA.

1. Who we are

This notice explains how Passref LTD ("we", "us", "our") uses personal data about you when we carry out tenant referencing.

We provide referencing services to landlords and letting agents. When a landlord or letting agent asks us to reference you, we decide how and why we process your data for that referencing — which means we are a controller of your personal data and responsible to you for it. The landlord or agent who instructed us is a separate controller for their own decision about whether to let to you.

Company: Passref LTD, Registered company number 17056120, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Contact: joe@passref.com / Passref LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
ICO registration number: ZC179257
Data Protection Officer: Joe Alcorn, joe@passref.com

2. Who this notice is for

This notice applies to anyone we process data about as part of a reference, including prospective tenants, guarantors, and other named applicants.

3. The personal data we collect

Depending on the checks requested, we may process:

Identity data — name, date of birth, previous names, and information from your identity documents
Contact data — address and address history, email, phone
Right to Rent / immigration data — nationality, passport details, and (where relevant) your eVisa/Home Office share code and the right-to-rent status it returns (see §5)
Income & affordability data — your stated income, and the evidence you provide such as payslips or an employment contract
Employment data — employer, role, employment status
Tenancy data — current and previous landlords and rental references
Guarantor data — where a guarantor is provided
Financial history you declare — any County Court Judgments (CCJs), Individual Voluntary Arrangements (IVAs), or bankruptcies you tell us about, including dates, amounts, and whether they are satisfied or outstanding
Public records & financial data — County Court Judgments (CCJs) and similar court judgments we obtain from public registers (see §6)

Drafting note: list only what you genuinely collect. Over-listing is itself a data-minimisation problem.

4. Special category data

We do not seek to collect special category data (such as data about health, ethnicity, or religion). If such data reaches us incidentally, we will not use it for referencing and will delete it where appropriate.

Drafting note: nationality and immigration status are processed for Right to Rent but are not "special category" data under Article 9, so no Article 9 condition is needed for them. If you ever do process genuine special category data, replace this section with the Article 9 / DPA 2018 Schedule 1 condition you rely on, and maintain an Appropriate Policy Document.

5. Right to Rent checks

Where instructed, we help confirm your right to rent a property in England. How we do this depends on your circumstances:

British or Irish citizens — we verify your identity and confirm your right to rent using your passport.
Other applicants — we ask you to provide a Home Office share code. We use this, with your date of birth, on the Home Office online checking service to confirm your right to rent, and we obtain the result from that service.
In-person checks — where a right to rent check has to be carried out in person, we are not able to complete it. In that case your landlord or letting agent will carry out the check directly.

6. Where we get your data from

We collect personal data:

directly from you — you provide your information and documents to us yourself, and this is the main way we collect your data;
from the landlord or letting agent who refers you to us — they give us your email address so we can invite you to complete your reference;
from the Home Office, via the online right-to-rent checking service, where you provide a share code;
from your employer or current/previous landlords, where references are provided;
from public registers — we search the Register of Judgments, Orders and Fines for County Court Judgments and similar records via Registry Trust's TrustOnline service.

7. How and why we use your data, and our lawful basis

Purpose	Lawful basis
Carrying out referencing and producing a reference and recommendation	Legitimate interests — our interest, and the landlord's/agent's interest, in assessing tenant suitability
Verifying your identity	Legitimate interests
Confirming your right to rent	Legitimate interests — to enable the landlord to meet its statutory Right to Rent obligation
Verifying your income and assessing affordability	Legitimate interests
Checking public registers for County Court Judgments and similar records to assess tenancy risk	Legitimate interests — our interest, and the landlord's/agent's interest, in assessing tenant suitability
Keeping records to handle disputes and meet legal obligations	Legitimate interests / legal obligation

Where we rely on legitimate interests, you can ask us for a summary of the relevant assessment, and you have the right to object (see §10).

Drafting note (Right to Rent basis): the statutory Right to Rent duty sits with the landlord, not with you, so "legal obligation" doesn't sit cleanly with you as the controller doing the check on their behalf — which is why legitimate interests is used above. Confirm this framing with your adviser; some providers take a different view.

8. Automated processing

We use automated processing to carry out a number of the checks that go into your reference. These include checks such as confirming that the information you've given is consistent with your documents, and assessing the income you've reported against the evidence you've supplied (such as payslips or an employment contract) and against the affordability requirements set for the tenancy. We may carry out further automated checks of a similar nature as part of assessing a tenancy application.

Based on these checks we produce a reference and a recommendation. The decision about whether to offer you a tenancy is made by the landlord or letting agent — not by us. They are not required to follow our recommendation.

If you believe automated processing has significantly affected you, you can ask for a person to review the matter, express your point of view, and contest the outcome. Contact us at joe@passref.com.

Drafting note: describing the checks by category (as above) is the right level of detail — UK GDPR requires "meaningful information about the logic," not an exhaustive list of every rule, and a closed list would need republishing each time you add a check. Keep the full, current list internally in your DPIA and ROPA instead. Separately: because you produce a recommendation that the landlord or agent decides whether to follow, this likely sits outside the strict "solely automated decision" regime in Article 22 (as amended by the Data (Use and Access) Act 2025) — but only where the agent's review is genuine rather than a rubber-stamp. Assess and document this.

9. Who we share your data with

We share your data with:

the landlord or letting agent who instructed the reference (this is the purpose of the reference);
the Home Office, to the extent needed to run an online right-to-rent check;
Registry Trust Limited, operator of the public Register of Judgments, Orders and Fines, when we run a search for County Court Judgments;
our service providers (such as identity verification, hosting, email, and document-processing providers, as well as general IT providers) who process data on our instructions under contract;
authorities or regulators where we are legally required to.

10. International transfers

Some of our service providers process personal data outside the UK. Where this happens, we rely on a lawful transfer mechanism: for providers in the European Economic Area, the UK's adequacy regulations; and for providers elsewhere (including the United States), the International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum (and/or the UK extension to the EU–US Data Privacy Framework where the provider is certified). We keep a current list of these providers and can provide more detail on request.

11. How long we keep your data

We keep your personal data only as long as necessary for the purposes above, including to handle any dispute about a reference and to meet legal and accounting obligations.

Drafting note: insert your actual retention periods — do not leave this vague, and make sure each period is justifiable. A common structure is a short active-use period for the reference followed by a limited dispute/audit period, after which data is deleted or anonymised. Confirm against your retention policy.

While we are carrying out your reference, we keep your data for as long as we need it for that purpose. After that, we keep it for up to 6 years so we can handle any dispute about the reference and meet our legal and accounting obligations; this period reflects the time limit for bringing a related legal claim. We then delete or anonymise it.

12. Your rights

You have the right to:

access the personal data we hold about you;
ask us to correct inaccurate data;
ask us to erase data in certain circumstances;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests;
request portability of certain data.

To exercise any of these, contact us at joe@passref.com. We will respond within the time limits the law allows.

13. How to complain

If you're unhappy with how we've handled your personal data, you have the right to complain directly to us. Please contact us at support@passref.com and tell us what's wrong — there's no particular format to follow. We will acknowledge your complaint within 2 working days, look into it, and respond without undue delay. If a complaint will take longer to resolve, we'll keep you updated.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO). You can do this at any time, although we'd welcome the chance to put things right first:

Website: ico.org.uk
Helpline: 0303 123 1113

14. Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top. When we make changes, we update this notice and the "last updated" date; please review it from time to time.