Privacy Policy
KasaRokk Privacy Policy (UK)
Last updated: Oct 11, 2026 · KasaRokk
Draft for review. Bracketed items are placeholders that need confirmation before this policy is published.
Who we are and what this policy covers
This policy explains how [COMPANY NAME LTD] ("KasaRokk", "we", "us" or "our") collects, uses, shares and protects your personal information when you visit [WEBSITE URL], contact us, book a viewing, or use any of our property services. We are the "controller" of your personal information, which means we decide how and why it is used. Our details are:
- Company: [COMPANY NAME LTD], registered in [England and Wales] under company number [NUMBER]
- Registered office: [REGISTERED ADDRESS]
- ICO registration number: [ZA000000]
- Privacy contact: [privacy@YOURDOMAIN]
We handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025, as they apply to us. When we handle information about a property, a landlord or a seller on their behalf, we may act as their agent or processor. This policy is about information relating to you as a visitor, enquirer, buyer, tenant, landlord, seller or other contact.
Information we collect
We collect only what we need to run the website and provide our services. It comes from you, from your device, and sometimes from third parties.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, phone or WhatsApp number, postal address | You, when you enquire, register or book |
| Property and search details | Areas, budget, bedrooms, saved listings, viewing requests, notes from calls | You, and our agents' notes |
| Account details | Email, hashed password, preferences | You, when you create an account |
| Messages | Emails, web form messages, WhatsApp or SMS conversations, call notes | You and us |
| Transaction and verification information | Proof of identity, proof of address, right-to-rent and anti-money-laundering checks, referencing results, payment records [DELETE IF NOT APPLICABLE] | You, referencing and ID-check providers, banks |
| Technical information | IP address, browser, device type, pages viewed, referring site, approximate location from IP | Your device, through cookies and server logs |
| Marketing preferences | Newsletter sign-ups, consent records, emails opened and links clicked | You and our email tools |
We do not ask for "special category" information such as health, religion, ethnicity or political views. Please do not include it in free-text boxes or messages unless it is essential, for example an accessibility requirement for a viewing. If you do, we will only use it for that purpose. If you give us someone else's details, for example a co-tenant or guarantor, please make sure they know and are happy for you to do so.
How we use your information and our lawful bases
UK GDPR requires us to have a lawful basis for each use of your information. This table shows what we do and why.
| What we do | Lawful basis |
|---|---|
| Respond to enquiries, arrange and manage viewings, match you with properties | Contract (steps you ask us to take before entering one) and legitimate interests (running our business efficiently) |
| Create and manage your account and saved searches | Contract |
| Carry out referencing, identity, right-to-rent and anti-money-laundering checks, and keep related records [DELETE IF NOT APPLICABLE] | Legal obligation |
| Manage tenancy, sale or letting transactions, invoices and payments | Contract and legal obligation (tax and accounting records) |
| Send you newsletters and property alerts by email, SMS or WhatsApp | Consent, or legitimate interests for existing customers under the "soft opt-in" rule in PECR; you can opt out at any time |
| Understand how the site is used and improve it | Consent for non-essential cookies; legitimate interests for basic server logs |
| Keep the website and our systems secure, prevent fraud and misuse | Legitimate interests and legal obligation |
| Handle complaints, disputes and legal claims | Legitimate interests and legal obligation |
| Comply with requests from regulators, courts or the police | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time without affecting what we did before.
Cookies and similar technologies
We use cookies and similar technologies to make the site work, remember your choices and, with your consent, measure how it is used. Strictly necessary cookies are set automatically. All others are only set after you opt in through our cookie banner, and you can change your choice at any time. Our separate Cookie Policy lists the cookies we use, what each one does and how long it lasts, and explains how to manage them.
Who we share your information with
We do not sell your personal information. We share it only where needed, and only with:
- Property owners, landlords, sellers and their agents, so they can arrange viewings and progress an offer or tenancy you have asked about.
- Service providers acting on our instructions, such as website hosting, email and messaging tools, customer relationship management (CRM) systems, analytics, cloud storage, referencing and ID-check providers, and payment processors. They may only use your information to provide their service to us.
- Professional advisers, including solicitors, conveyancers, accountants, auditors and insurers.
- Regulators, courts, law enforcement and other authorities, where the law requires it or to protect rights, safety or property.
- Other businesses in a sale or reorganisation, if we sell or merge all or part of our business. We would tell you and they would be bound by this policy or an equivalent one.
- Anyone else you ask us to share with, or that you have agreed to.
We have contracts with our service providers that meet UK GDPR requirements.
International transfers
Some of our providers are based outside the UK, for example cloud, email and analytics services in the European Economic Area or the United States. When your information leaves the UK, we make sure it is protected by at least one of the following:
- The country or organisation is covered by UK "adequacy regulations", including the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) for certified US companies.
- We use the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses approved by the ICO.
- Another safeguard allowed by UK data protection law applies.
You can contact us for more detail on the safeguards used for a particular transfer.
How long we keep your information
We keep personal information only as long as needed for the purposes in this policy, including legal, accounting and reporting requirements. These are our typical periods; adjust them to match your own retention schedule.
| Information | How long we keep it |
|---|---|
| General enquiries and messages | [12] months after our last contact |
| Accounts and saved searches | Until you delete the account or it has been inactive for [24] months |
| Viewing records and agent notes | [24] months after the viewing |
| Transaction, invoice and payment records | [6] years after the end of the financial year, for tax and accounting law |
| Identity, right-to-rent and anti-money-laundering records [DELETE IF NOT APPLICABLE] | As required by law, usually at least [5] years after the relationship ends |
| Marketing preferences | Until you unsubscribe, plus a minimal record that you did |
| Website server logs | [12] months |
When we no longer need information, we delete it or anonymise it so it can no longer identify you.
Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your information (this policy).
- Access a copy of your personal information and details of how we use it.
- Correct information that is inaccurate or incomplete.
- Erase your information in certain circumstances, sometimes called the right to be forgotten.
- Restrict how we use your information in certain circumstances.
- Data portability, meaning receive information you gave us in a portable format or have it sent to another organisation, where we use it under contract or consent.
- Object to uses based on legitimate interests, and to direct marketing at any time.
- Withdraw consent where we rely on it.
- Not be subject to solely automated decisions with legal or similarly significant effects.
To use any of these rights, email [privacy@YOURDOMAIN] or write to us at the address in section 15. We may need to confirm your identity first. We aim to reply within one month; if your request is complex we may extend that by up to two further months and will tell you why. There is normally no fee. Some rights have exceptions, and we will explain if one applies.
Marketing and communications
We will only send you marketing by email, SMS or WhatsApp if you have agreed to it, or if you are an existing customer and we are promoting similar services, in which case you were offered an easy way to opt out when we collected your details and you can opt out in every message. We do not share your details with other companies for their own marketing. To stop marketing, click "unsubscribe" in any email, reply STOP to a text or message, update your preferences in your account, or contact us. We will still send service messages that you need, such as viewing confirmations and tenancy or sale updates. If we call you for marketing, we will check the Telephone Preference Service (TPS) and Corporate TPS first.
Security
We use appropriate technical and organisational measures to protect your information, including encryption in transit (HTTPS), access controls limited to staff who need the information, secure hosting, regular software updates and staff training. No online service is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been compromised. If a personal data breach is likely to put your rights and freedoms at risk, we will tell you and the Information Commissioner's Office as the law requires.
Children
Our website and services are for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you think a child has given us information, contact us and we will delete it.
Third-party links and services
Our site may link to other websites, maps, social media pages or messaging apps such as WhatsApp. They have their own privacy policies and we are not responsible for how they use your information. Please read their policies before sharing personal details.
Automated decisions, analytics and AI tools
We do not make decisions about you based solely on automated processing that has a legal or similarly significant effect. We use analytics tools, only with your consent, to understand how visitors use the site in aggregate. [DELETE IF NOT USED: We use AI-powered tools, such as a website chat assistant or listing recommendations, to help answer questions and suggest properties. A person can review or override any outcome, and you can ask to speak to one of our team at any time. Please do not enter sensitive personal information into these tools.]
Changes to this policy
We may update this policy from time to time. The "as of" date at the top shows when it was last revised. If we make a significant change, we will tell you, for example by a notice on the website or by email, before it takes effect where we reasonably can.
Contact us and complaints
If you have a question about this policy or want to use your rights, contact us first:
- Email: [privacy@YOURDOMAIN]
- Post: Privacy, [COMPANY NAME LTD], [REGISTERED ADDRESS]
- Phone: [PHONE]
We will try to resolve any complaint quickly and tell you the outcome. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first, but you do not have to contact us before the ICO.