1. Who we are

rentflow.london ("Rent Flow", "we", "us", "our") operates an online marketplace that connects professional, verified estate agents with tenants and buyers across the United Kingdom. Our registered contact address is Hoe Street, Walthamstow, London E17 and our support email is support@rentflow.london. We are the controller of the personal data processed through the platform.

2. Scope

This policy applies to all visitors, registered users (tenants and buyers), agents (vendors) and any other person whose personal data is processed through rentflow.london. It does not apply to third-party services that may be reached through links on the platform and that operate under their own privacy policies.

3. What data we collect

• Account data. When you register we collect your name, email address and a password — stored exclusively as an irreversible cryptographic hash, never in readable form. Agents additionally provide business identity details.
• Verification data. Agents must pass verification (identity and business checks, together with the one-off trust deposit of 500 GBP) before publishing. The outcome of these checks and the related supporting evidence are retained to guarantee the accountability of who publishes on the platform.
• Listing and transaction data. The content of listings, enquiries, conversations, deposits and payments processed through the platform.
• Technical data. The minimum technical data strictly necessary to deliver the service: session and security identifiers, language preference, and security logs. We do not buy or enrich this data from external brokers.
• Communications. Messages exchanged through the platform's messaging system. They are stored so that conversations survive across devices and may be reviewed, where necessary, to resolve disputes, guarantee safety and enforce our Terms of Service.

4. Why we process data, and on what basis

• To provide the service (accounts, listings, messaging, payments): performance of a contract with you.
• To verify agents and protect the marketplace (verification, trust deposit, fraud prevention, abuse handling): legitimate interests, and compliance with legal obligations where applicable.
• To comply with the law (accounting, tax, lawful requests from authorities): legal obligation.
• To improve the platform (aggregated, non-identifying statistics, only if activated): legitimate interests, in a privacy-preserving form.

5. Who we share data with

We share personal data only with: (a) service providers strictly necessary to operate the platform (for example payment processing or identity verification), each bound to process data only on our instructions; (b) competent authorities where required by law; (c) a counterparty in a conversation or transaction, to the extent strictly necessary for that conversation or transaction. We never sell personal data, and we do not disclose it for third-party advertising.

6. International transfers

Where a service provider processes data outside the United Kingdom or the European Economic Area, we take steps to ensure an adequate level of protection, including appropriate contractual safeguards.

7. Retention

We retain personal data only as long as necessary for the purposes described above: account data for the life of the account; transaction and accounting records for the period required by law; verification records for as long as necessary to guarantee the safety and accountability of the marketplace; security logs for a limited period. Data that is no longer needed is deleted or anonymised.

8. Your rights

You may request access to your personal data, its correction, its deletion, restriction of its processing, or object to processing based on legitimate interests, and you may request a copy of data you provided to us in a portable format. To exercise any right, write to support@rentflow.london. We may retain the minimum records required by law or necessary to defend the platform against misuse. You also have the right to lodge a complaint with the competent supervisory authority.

9. Security

Passwords are stored as irreversible hashes. Administrative access is restricted and logged. Traffic is protected in transit. Payment card data is handled exclusively by our payment processor and never reaches our servers. No system can be guaranteed absolutely secure, but the protection of your data is treated as a core requirement of the service, and incidents are handled promptly and transparently.

10. Children

The platform is not directed to individuals under 18, and we do not knowingly process their personal data. If we become aware of such an account, it will be closed.

11. Automated decisions

We do not make decisions producing legal effects solely by automated means. Verification of agents, including the verification of the trust deposit, is performed manually by an operator of our team.

12. Changes

We may update this policy from time to time. The version published on this page is the one in force; continued use of the platform after an update constitutes acceptance.