Version 1.2 · Effective 1 October 2026
Letfold (formerly Estate-HQ) is a trading name of ONE CONNECT LONDON LTD. ONE CONNECT LONDON LTD is registered in England and Wales under company number 16952075. Registered office: 77 Auriel Avenue, Dagenham, England, RM10 8BU, United Kingdom. ICO registration reference: ZC258914. Not VAT registered.
Until 28 September 2026 the service was operated by UNIVERSALHOMEANDTECH LTD (company 16534780); from 29 September 2026 it is operated by ONE CONNECT LONDON LTD.
Letfold is a CRM platform for UK letting agents. This Privacy Policy explains how ONE CONNECT LONDON LTD collects and uses personal data when someone visits letfold.com, signs up for a trial, subscribes to a plan, uses the platform, or contacts us. We do not sell personal data. We do not use advertising or tracking cookies.
For data we collect about our own users — letting agents, their staff, and visitors to letfold.com — ONE CONNECT LONDON LTD is the data controller.
For personal data that letting agents enter into the platform about their tenants, landlords and contractors — ONE CONNECT LONDON LTD is the data processor acting on behalf of the letting agent (the data controller). That relationship is governed by our Data Processing Agreement (DPA).
| Category | Examples |
|---|---|
| Account information | Agency name, company number, contact name, email address, password hash |
| Billing information | Email address for invoices, Revolut or PayPal payment reference. No card or bank data stored by us. |
| Usage data | Login times, features used, pages visited, error logs |
| Support correspondence | Messages sent to [email protected] or via the support ticket system |
| Technical data | IP address, browser type, device type, session tokens |
This data is entered by letting agents using the platform. We process it as a data processor on their behalf. For tenants who submit a Tenant Passport directly, see the Tenant Passport Privacy Notice.
| Data subject | Data we store on behalf of the letting agent |
|---|---|
| Tenants | Name, contact details, tenancy records, rent history, right-to-rent status, deposit records, maintenance requests, e-signature records |
| Landlords | Name, contact number, email address, property ownership records, statement history |
| Contractors | Name, contact number, email address, job records |
| Purpose | Lawful basis |
|---|---|
| Providing the Letfold platform and its features | Contract (Terms of Service) |
| Account creation and management | Contract |
| Billing and payment processing via Revolut or PayPal | Contract and legal obligation |
| Customer support and responding to enquiries | Contract and legitimate interests |
| Platform security, fraud prevention and abuse detection | Legitimate interests |
| Sending service emails (invoices, alerts, compliance reminders) | Contract |
| Improving the platform through aggregate usage analytics | Legitimate interests |
| Complying with legal obligations (tax, company law, ICO) | Legal obligation |
| Processing tenant, landlord and contractor data entered by agents | Data processor — governed by the DPA |
We share personal data only where necessary. Recipients include our hosting provider (Contabo GmbH), Revolut and PayPal for payment processing, email delivery providers for service emails, and professional advisers (accountants, legal) where required. We do not share data with advertising networks. Full details are in the Sub-processor List.
Platform data is hosted in the European Economic Area (EEA). Transfers from the UK to the EEA are covered by the UK's adequacy regulations. Where any other sub-processor operates outside the UK and the EEA, we ensure an appropriate safeguard is in place under UK data protection law (International Data Transfer Agreement, or UK Addendum to EU Standard Contractual Clauses).
| Record type | Retention |
|---|---|
| Active account data | Held while the subscription is active |
| Data after cancellation | 90 days from end of subscription, then securely deleted unless export requested |
| Billing and invoice records | 6 years from the relevant accounting period (legal obligation) |
| Support correspondence | Kept long enough to resolve the issue plus 12 months |
| Security and access logs | Up to 90 days for operational security |
| Tenant Passport data | Governed by the DPA and the letting agent's retention policy |
We do not make automated decisions about individuals that have legal effects or similarly significant effects (within the meaning of Article 22 UK GDPR). Letfold provides tools that letting agents use to make their own decisions about tenancies; any decision affecting a tenant, landlord or contractor is made by the human letting agent, not by the platform.
Our internal AI Operations Agent (DeepSeek) analyses pseudonymised aggregated system-health metrics to surface operational alerts to the Letfold admin team. It does not make decisions about any individual data subject and does not process Tenant Passport data or other personal data of tenants, landlords or contractors. See Sub-processor List for full data-minimisation details.
Personal data is hosted in the EEA (Contabo GmbH), with encrypted backups stored in Western Europe (Cloudflare R2). Limited operational metadata is transferred to sub-processors in the US (Cloudflare for routing; Google for marketing image generation) and China (DeepSeek, for the internal AI Operations Agent). In every case an appropriate safeguard is in place under UK data protection law (International Data Transfer Agreement, UK Addendum to EU SCCs, or recognised adequacy). The DeepSeek transfer involves only pseudonymised system metrics — no Tenant Passport data, no tenant/landlord/contractor personal data, no document contents, no communications. Full details: Sub-processor List.
Under UK data protection law you have the right to access, correct, erase, restrict, object to, and port your personal data. You may also withdraw consent where processing is based on consent. To exercise any right, email [email protected]. We respond within the statutory period (normally one calendar month). You may also complain to the Information Commissioner's Office at ico.org.uk.
Data is encrypted at rest and in transit. Access is controlled by role-based permissions. Daily encrypted backups are stored off-server in Western Europe. We operate a responsible disclosure process — report security concerns to [email protected].
Privacy enquiries: [email protected]. Formal post: ONE CONNECT LONDON LTD, 77 Auriel Avenue, Dagenham, England, RM10 8BU, United Kingdom.
