Data processing terms, for the data you put in.

Last updated 6 October 2026

About these terms

These terms form part of the agreement in our terms, and you accept them together when you create an organisation in Latchkey. They meet Article 28 of the UK GDPR. In them, “you” is the landlord or letting business that holds the account and is the controller, and “we” is Bright Web Limited, the processor. Where they conflict with the terms, these terms win for personal data.

What we process for you

Subject matter

Running Latchkey for you: holding and working on the property, tenancy and money records you keep in it.

Duration

For as long as your account is open, and then until the data is deleted as set out under “When the agreement ends”.

Nature and purpose

Storing, organising, displaying, calculating with, sending and deleting personal data, only to provide the features you use.

People it is about

Your tenants and other occupiers, applicants, guarantors, property owners, contractors and suppliers, and your team.

Kinds of personal data

Names and contact details; tenancy, rent and payment records; bank details for payees; documents and photos; messages; repair reports; Right to Rent evidence and identity documents; references, including income and employment; meter readings; and, for owners whose tax you prepare, National Insurance numbers.

Sensitive data

Latchkey does not ask for special category data. Messages and repair reports can contain it, for example about a tenant’s health. Where they do, you are responsible for having a lawful condition to hold it.

Acting on your instructions

We process the personal data only on your documented instructions. Using Latchkey’s features, and the settings you choose in it, are your instructions, along with anything else you ask of us in writing. We don’t use it for our own purposes. If the law requires us to process it in another way, we will tell you first unless the law forbids that. If we think an instruction breaks data protection law, we will tell you.

Our people

Everyone at Latchkey who can reach the personal data is bound to keep it confidential, and only reaches it when needed to run the service or when you ask us to look into a problem.

Security

We keep technical and organisational measures in place to protect the personal data, including:

• Data held in London, encrypted in transit and at rest.
• Each organisation’s data separated from every other’s by the database itself, and tested on every change.
• Bank and HMRC connection details, account numbers and National Insurance numbers encrypted again before they are saved, with keys the database never sees.
• Files kept private and opened only through links that expire after a minute.
• Sign-in by email link or passkey, with no passwords to steal, and an optional second factor.
• Roles that limit what each person on your team can see and change.
• A record of every change that moves money or alters a tenancy, with who made it and when.
• Limits on repeated attempts at sign-in and public forms.

We review these measures as Latchkey changes. Security and data describes them in more detail.

Sub-processors

You give us general permission to use other companies to help run Latchkey. The ones we use today are listed in our privacy notice. Before we add or replace one, we will email the account owner at least 30 days ahead. If you object on reasonable data protection grounds, tell us; if we can’t meet your objection, you can close your account before the change. We put the same data protection obligations on each sub-processor as these terms put on us, and we remain responsible to you for what they do.

Transfers outside the UK

Your database and files are held in London. Where a sub-processor handles personal data outside the UK, we make sure it is protected by UK adequacy regulations, such as the UK’s data bridge with the United States, or by the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Requests from data subjects

Latchkey gives you the tools to answer most requests yourself: you can correct a tenant’s details, download a copy of their data, or erase their personal details from their record while keeping the payments your books need. If a request comes to us instead, we pass it to you without delay and don’t answer it ourselves unless you ask us to. We help with anything the tools don’t cover.

Breaches

If we become aware of a breach affecting personal data we process for you, we will tell you without undue delay, with what we know about what happened, the data and people affected, the likely consequences and what we are doing about it, and keep you updated as we learn more. We will help you decide whether to report it to the Information Commissioner or tell the people affected.

Other help we give you

Taking into account what we can see as your processor, we help you meet your own obligations on security, breach reporting, data protection impact assessments and consulting the Information Commissioner.

When the agreement ends

Before you close your account, you can download all of your data as one file. When the account is closed, we delete the personal data straight away. Copies in our backups are overwritten within 30 days. We keep nothing unless the law requires us to, and anything we must keep stays protected under these terms.

Information and audits

We will give you the information you reasonably need to show that these terms are being met. If that is not enough, you or an independent auditor you appoint may audit our compliance once a year, on 30 days’ written notice, under a duty of confidentiality and at your cost. We will tell you straight away if we believe a request would break the law.

What you agree to

• You have a lawful basis for the personal data you put into Latchkey and for asking us to process it.
• You have told the people it is about how their data is used, as the law requires.
• Your instructions to us comply with data protection law.

General

The limits on liability in our terms apply to these terms too, except where the law does not allow it. These terms are governed by the law of England and Wales. Questions about them go to hello@latchkey.co.uk.