Privacy Notice

Last updated: 14 August 2026

1. Data Controller

MAR Property Investments Ltd is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact the data controller at jonescarrltd@yahoo.co.uk.

ICO registration: ZC218884

This notice covers everyone whose personal data the service processes: tenants using the tenant portal, landlord account holders, and accountants given portal access.

2. Data We Collect

We collect and process the following categories of personal data:

  • Identity data: name, email address
  • Contact data: phone number, postal address
  • Financial data: bank account details, sort code, rent payment history, deposit information
  • Tenancy data: lease dates, tenancy type, property details
  • Communications: messages sent through the tenant portal, maintenance requests
  • Technical data: IP address, login timestamps, browser type
  • Fraud prevention data: technical details about the device and connection used when tax returns are submitted to HMRC — see "Data Sharing" below for exactly what is sent and why we are legally required to send it

3. Landlord Account Holders

If you use the service as a landlord, we process additional categories of your personal data as the account holder:

  • Identity and contact data: name, email address, phone number
  • Tax identifiers: your National Insurance number and Unique Taxpayer Reference (UTR), stored encrypted at rest and used solely for preparing and submitting your tax returns
  • Tax submission data: the income, expense and adjustment figures in your Making Tax Digital (MTD) quarterly updates and annual returns, shared with HMRC when you submit
  • Bank transaction data: if you connect a bank account through Open Banking, transaction data is retrieved via our provider TrueLayer under your explicit consent, which you can withdraw at any time by disconnecting the account — see "Open Banking bank connections" below for full details

As a landlord you exercise your data protection rights (described below) by contacting MAR Property Investments Ltd directly at jonescarrltd@yahoo.co.uk.

Open Banking bank connections

Bank connections are provided through TrueLayer, an Account Information Service Provider authorised by the Financial Conduct Authority. When you choose to connect a bank account:

  • You authorise access with your bank directly on TrueLayer's consent screen. We never see, ask for, or store your online banking credentials.
  • Access is read-only: we retrieve account details (account name, sort code and the last four digits of the account number), balances, and transaction lines (date, amount, description or reference, and merchant name) solely for bookkeeping and tax reporting. Neither we nor TrueLayer can move money or make any change to your account, and full account numbers are not stored.
  • The access tokens that keep the connection alive are stored encrypted (AES-256-GCM) and are never shared with any other party.
  • Your consent lasts up to 90 days, after which the connection pauses until you renew it. You can disconnect at any time from the Banking page: disconnecting stops all further access and deletes the connection and its imported transaction feed. Bookkeeping and tax records already created from those transactions are retained as financial records (see "Data Retention").
  • TrueLayer processes your data under its own privacy policy and end user terms of service.

4. Lawful Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance: processing necessary for the tenancy agreement (rent collection, deposit management, property maintenance)
  • Legal obligation: tax reporting to HMRC, deposit protection compliance, health and safety records (gas/electrical certificates)
  • Legitimate interests: property management, communications about your tenancy, fraud prevention
  • Consent: optional communications such as newsletters or non-essential notifications (you may withdraw consent at any time)

5. How We Use Your Data

  • Managing your tenancy and processing rent payments
  • Handling maintenance requests and property repairs
  • Communicating about your tenancy
  • Meeting legal and regulatory obligations (HMRC, deposit protection, safety compliance)
  • Document signing and management
  • Security and fraud prevention

6. Cookies and Local Storage

We use only strictly-necessary cookies — the ones the service cannot work without:

  • property_session: keeps landlord users signed in
  • tenant_session: keeps tenant portal users signed in
  • accountant_session: keeps accountant portal users signed in

Session cookies are deleted in line with the session retention period in the retention table below. Your browser's local storage holds device preferences and the device identifier used for HMRC fraud prevention headers (see "Data Sharing").

We use no analytics or tracking cookies. Because every cookie we set is strictly necessary for the service you have asked for, no cookie consent banner is required (the strictly-necessary exemption under the Privacy and Electronic Communications Regulations, PECR).

7. Data Sharing

We may share your data with:

  • Contractors and tradespeople (name and contact details only, for maintenance purposes)
  • Deposit protection schemes (as required by law)
  • HMRC (financial data for tax compliance). In addition, when Making Tax Digital (MTD) returns are submitted, this software is legally required — under HMRC's transaction monitoring rules made under section 125 of the Finance Act 2019 — to send fraud prevention header data to HMRC with each submission. This includes: a device identifier, your IP address and port information, your browser's user agent, screen and window dimensions, your timezone, a user identifier, and whether multi-factor authentication was used for the session. This data helps HMRC detect fraudulent submissions and is sent only when a return or update is submitted.
  • Document signing providers (for electronic signatures)
  • TrueLayer (our FCA-authorised Open Banking provider), where a landlord has connected a bank account

We do not sell your personal data to third parties.

8. Data Retention

  • Tenancy data: retained for the duration of the tenancy plus 12 months, then anonymised
  • Financial records: retained for 7 years after the relevant tax year (HMRC requirement)
  • Safety certificates: retained for the validity period plus 2 years
  • Audit logs: retained for 3 years, then deleted
  • Session data: automatically purged when expired

9. Data Security

We protect your data with:

  • Encrypted connections (HTTPS/TLS)
  • Field-level encryption for sensitive financial data (bank accounts, sort codes)
  • Password hashing (bcrypt)
  • Session-based authentication with automatic expiry
  • Two-factor authentication (TOTP) available on administrator accounts
  • Rate limiting on login attempts
  • Audit logging of data access and changes

10. Your Rights

Under UK GDPR, you have the right to:

  • Access: request a copy of your personal data (Article 15)
  • Rectification: request correction of inaccurate data (Article 16)
  • Erasure: request deletion of your data where there is no legal obligation to retain it (Article 17)
  • Restriction: request we limit processing of your data (Article 18)
  • Portability: receive your data in a structured, machine-readable format (Article 20)
  • Object: object to processing based on legitimate interests (Article 21)
  • Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights: tenants can contact their landlord directly or use the data export feature in the tenant portal; landlords and accountant users should contact the data controller, MAR Property Investments Ltd, at jonescarrltd@yahoo.co.uk.

11. Complaints

If you are unsatisfied with how your data is handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.