Privacy Policy

1. Data Controller

DepositBack ("we", "our", or "us") is the data controller responsible for your personal data. We are based in England and Wales. If you have questions about how we handle your data, contact us at [email protected] or via our contact form.

2. What Data We Collect

We collect the following categories of personal data:

• Identity data: Your name, as provided in the dispute form or contact form.
• Contact data: Your email address, provided when using the Free Deposit Checker, dispute form, email course signup, contact form, or footer newsletter.
• Tenancy data: Property address, tenancy dates, landlord details, deposit amount, deduction details, and evidence information — provided only when you complete the dispute questionnaire.
• Technical data: IP address, browser type and version, pages visited, time and date of visit, time spent on pages, and other diagnostic data collected automatically via cookies and server logs.
• Transaction data: Details of payments made for our services, processed by Stripe. We do not see or store your card details.

3. Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following lawful bases:

• Contract: Processing your tenancy and dispute data is necessary to perform our contract with you (generating your dispute documents after purchase).
• Consent: We send marketing emails (including our free email course) only with your explicit consent. You can withdraw consent at any time by clicking "unsubscribe" in any email or contacting us.
• Legitimate interests: We use technical/usage data to improve our service, prevent fraud, and ensure website security. We have assessed that these interests do not override your rights and freedoms.
• Legal obligation: We may retain certain data where required by law (e.g. financial records for HMRC).

4. Email Communications

When you use our Free Deposit Checker, sign up for our email course, or subscribe via our footer newsletter, we collect your email address. We use this to send you your results and, with your consent, occasional updates about deposit dispute rights and our services. You can unsubscribe from marketing emails at any time using the link at the bottom of every email. We will never sell or share your email address with third parties for their marketing purposes.

5. Data Retention and Deletion

Document generation data: Your tenancy and dispute data is processed in your browser. We do not store this data on our servers after your documents have been generated. Email addresses: Retained until you unsubscribe or request deletion, whichever comes first. Transaction records: Payment records are retained for 7 years as required by UK tax law. Contact form messages: Retained for up to 12 months after your enquiry is resolved, then deleted.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your personal data (subject to legal retention requirements).
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email [email protected] or use our contact form (select "Privacy or data request"). We will respond within one month as required by UK GDPR.

7. Payment Information

Payment processing is handled by Stripe, a PCI-DSS compliant third-party payment processor. We do not have access to or store your credit card information. Stripe acts as an independent data controller for payment data. Please refer to Stripe's privacy policy for information on how they handle payment data.

8. Cookies

We use essential cookies to ensure the website functions correctly (e.g. session management). We may also use analytics cookies (such as privacy-focused analytics) to understand how visitors use our site. Analytics cookies are only set with your consent. You can control cookies through your browser settings.

9. Third-Party Services

We may share data with the following categories of third parties, solely to operate our service:

• Payment processor: Stripe (payment processing)
• Email service: Our chosen email provider (to deliver email courses and updates you have opted into)
• Hosting provider: Our website hosting service (server logs and technical data only)

We do not sell your data. We do not share data with advertisers. All third-party processors are UK GDPR compliant or operate under adequate safeguards.

10. International Transfers

Some of our third-party service providers may be located outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as UK GDPR-approved standard contractual clauses or adequacy decisions.

11. Security of Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

12. Children's Privacy

Our service is not directed at anyone under 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and where appropriate, notifying you by email. We encourage you to review this page periodically.

14. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected] or via our contact form.