Privacy Notice

Introduction

This Privacy Notice explains how VEYLO X® processes personal data in connection with its platform and services.

We are committed to processing data in accordance with the UK GDPR and Data Protection Act 2018.

Role of VEYLO X

VEYLO X is the data controller for the personal data processed through the platform. We decide what is collected, why, how long it is kept and who it is shared with.

A landlord or agent is a separate, independent controller for what they do with information once they have received it, for their own purposes and under their own responsibility. We are not joint controllers with them, and neither of us decides the other's purposes.

We are not responsible for what a landlord or agent does with information after they have received it, and they are not responsible for how we run the platform. If you have a question about their use of your information, you can raise it with them directly, and you can also raise it with us.

Nature of Data Processing

We process personal data necessary to:

• operate and maintain the platform
• enable account functionality
• support property and tenancy workflows
• generate system outputs (e.g. alerts, summaries)

We may also process technical and usage data for system performance and security.

The early-access list on veylox.uk

Our website at veylox.uk has a form for joining the early-access list. This section covers that form only. It is the sole personal information the marketing website collects, and it is separate from anything described elsewhere in this notice.

When you join the list we store:

• your email address, so we can write to you
• whether the page you signed up from was written for renters or for landlords, so that what we send is relevant
• the path of the page you were on, so we know which of our guides people find useful. The path only, never the query string
• the website you arrived from, if any, recorded as the site name alone. Any search terms in the link are discarded before it is stored
• the date you joined, and your browser's user agent string, for record keeping and to tell real sign-ups from automated ones

We do not ask for your name, your address, your telephone number or anything about your tenancy, and the marketing website has no other form.

Our lawful basis is consent, under Article 6(1)(a) of the UK GDPR, for everything in that list. The page you signed up from and the site you arrived from are held as part of the same single record, not separately and not for any other purpose, so one consent covers the whole entry. Giving us your email address is entirely optional; nothing on the website requires it, and the only consequence of not giving it is that we cannot write to you.

What we send. A short plain-English guide to what the Renters' Rights Act 2025 changed, sent as soon as you join. After that, the occasional short email while we get ready, and a message when VEYLO X opens. Every message carries a one-click way to stop receiving them, and we do not sell, rent or pass your address to anyone else for their own marketing.

Withdrawing consent. Email us and we will remove you. Withdrawal is as easy as joining, it does not affect anything done before you withdrew, and we delete the entire entry rather than keeping the rest of it.

How long we keep it. Until the earlier of two years from the day you joined, or the day you ask us to remove you. If VEYLO X opens and you do not go on to create an account, we delete the entry within six months of that announcement.

Where it is held. In the same infrastructure as the rest of the platform, described under Who handles your data and International transfers below. The marketing website itself sets no cookies of its own; page views are counted by Cloudflare Web Analytics, which is the only third party the website loads anything from.

Tenant and Applicant Data

Where tenant or applicant data is processed:

• where a landlord or agent gives us information about an applicant or tenant, we are the controller for what we then do with it on the platform, and we decide how long it is kept and who it goes to
• the landlord or agent remains separately responsible for what they do with that information for their own purposes, and for having been entitled to give it to us
• a named tenant's own legal name, which the tenant gives us directly, is covered under Your legal name when you join a tenancy below

We do not independently verify identity documents or legal eligibility.

Users remain responsible for:

• Right to Rent compliance
• identity verification
• lawful processing of personal data

Where you provide Right to Rent information through VEYLO X, we use it to keep a tenancy record and, where a follow-up check is legally required, to show your landlord a limited reminder that a Right to Rent re-check is due. We do not show your passport image, share code, document number, nationality, immigration route or visa/BRP class in the landlord dashboard.

If the date is wrong, contact us so it can be checked and corrected.

Your search preferences

When you use Find a place to rent, we ask what you are looking for so we can show you places that fit. Where you are looking, your budget, bedrooms, property type, move-in date, household size and lifestyle choices are used to produce those matches, and we need them to carry out the search you asked us for.

The same questionnaire also asks, optionally, about your income source, your income and your savings. We store your income source so that your preferences stay complete and you do not have to retype it. Where you give us an income or savings figure, we use that figure to show a rough comparison against the advertised rent, and to help order your matches. Leave them blank and we skip that comparison. We do not verify these figures and we make no approval decision.

Our lawful basis for your search preferences is UK GDPR Article 6(1)(b): processing necessary to take steps at your request before entering into a contract. That covers the optional income and savings figures only where you choose to give them as part of this matching feature.

We do not ask for your Right to Rent or immigration status when you search. We explain that a landlord has to carry out a Right to Rent check before a tenancy starts in England, so that you know what to expect, but we do not record an answer, and it plays no part in which properties you are shown.

Your answers are stored against your own account. A landlord or agent does not see them. Information reaches a landlord only when you choose to send it as part of an application. You can change or delete your answers at any time in More › AI Property Preferences.

Showing your name to your tenant

When you accept a prospective tenant's application, we show that person the name you have confirmed on your profile, so they know who their landlord is. If you let through a limited company, we show the company's registered name as it appears at Companies House, rather than a personal name.

We do not show your name earlier in the process. It is not shown while your property is listed, and it is not shown to people who only enquire about your property or attend a viewing.

You manage your own name in your profile. If you update it, we update the name shown on your accepted applications so it stays current. We store it on those applications and on the resulting tenancy record. We keep it for the life of the tenancy and for six years afterwards; where an application is accepted but does not go on to a tenancy, we keep it for six years from the application.

We do this to perform our agreement with you. A landlord also has their own legal duties to give their name to a tenant on a written request, and on any written rent demand (Landlord and Tenant Act 1985, sections 1 and 47). Those duties apply to you directly. VEYLO X records and displays the information you provide; it is not a letting agent, does not act on your behalf, and does not give legal advice.

You will see the landlord's name once the landlord accepts your application. If the landlord lets through a limited company, we show the company's registered name as it appears at Companies House.

Your legal name when you join a tenancy

If you join a tenancy as a named tenant, for example as a joint tenant with other people, we ask you for your full legal name. We ask for it because it goes on the tenancy agreement, alongside the other named tenants, and on the deposit protection record if a deposit is protected, so a deposit can be protected and registered as the law requires (Housing Act 2004). An account display name or nickname is not suitable for those formal records. You give us this name yourself, so for this information VEYLO X is the data controller.

We process your legal name to perform our agreement with you and to provide the tenancy platform, and, where a deposit is protected, so that your landlord can protect and register it as the law requires (Housing Act 2004).

We ask for your name as a single entry, rather than separate first and last name boxes, so that names in any script, single-word names, and names that include punctuation are all accepted, and your spelling and capitalisation are kept. Please enter it as it appears on your identity documents, including any middle names. VEYLO X records the name you provide. We do not verify your identity, and we do not check the name against any document.

When you add your name, you confirm that it is your full legal name, and we keep a dated record of that confirmation. You can choose to do this later if you are not ready, and we will ask again next time you sign in. If you do not provide it, we cannot add you as a named tenant on the tenancy agreement or on the deposit protection record.

Your name also appears on a transcript of your messages if you or the other party download one. That document can be given to a deposit adjudicator, the Property Ombudsman or a court.

Your legal name is used on your tenancy record and, where a deposit is protected, is sent to the deposit protection scheme so the deposit can be registered in your name. This is the statutory deposit protection described under Who handles your data below, where the scheme acts as an independent organisation responsible for the data in its own right. Where your name is also used for a referencing or identity check, that happens in the way described in that section: we ask your permission first, and the organisation runs its check under its own privacy notice.

When your name is locked

Once your tenancy agreement is signed, or your deposit is registered with the scheme, your legal name is fixed on those records. From that point you can no longer edit it yourself in the app, because it now sits on a signed agreement and, where relevant, on a statutory deposit record that VEYLO X does not change.

If a locked name is spelt wrong, or your legal name later changes, speak to your landlord. Your landlord holds your identity information and is responsible for the tenancy agreement and for the deposit registration, so a correction is made through them. Where your landlord confirms a correction, we update the name we hold to match, and we keep a record of the previous name, because your signed agreement and deposit record still carry it. We will tell you when the name we hold for you has been updated.

You can also ask us directly to correct your name at any time, whether or not your landlordhas acted. Contact us at privacy@veylox.uk and we will handle your request as set out under Your Rights below. We will not change a tenancy agreement or a deposit registration ourselves, and we cannot give you legal advice, but we can correct the name we hold, and where we have already shared it with an organisation such as the deposit protection scheme, we or your landlord will let them know where we are required to, so their record can be updated too.

We keep your legal name on your tenancy record for the life of the tenancy and for six years afterwards, as set out in the named-tenant legal name row in the retention table below. As a field on your account profile, your legal name is kept for the life of your account and for 12 months afterwards, in line with the account record row in the same table. We keep the dated record of your confirmation, and of any later correction, for seven years, as set out in the compliance attestations row.

VEYLO X records and displays the legal name you provide. We are not a letting agent, we do not act for you or for your landlord, we do not verify identity, and we do not give legal advice.

Council tax when you move in

When you move into a rented home, your local council needs to know who now lives there so that council tax can be billed to the right people. Your landlord can use VEYLO X to notify the council of the change of tenancy. Where they do, the notification includes your name and the date your tenancy starts. Your landlord types your name into the notification and sends it themselves, from their own council account, online form or email. VEYLO X provides the template and prepares the wording, but it does not fill your name in from your record, and it does not send anything to the council for your landlord or for you. VEYLO X is a neutral platform. It is not a letting agent, it does not act for your landlord or for you, and it does not give legal advice.

We do not ask for your consent to this, and it does not depend on your consent. Council tax, and keeping a council informed of who is liable to pay it, are set by law under the Local Government Finance Act 1992. Your landlord makes the notification to meet their responsibilities under that system, in their legitimate interests as the person letting the property to you, so that the council can bill the right people. We hold your name and your tenancy dates so that we can provide the tenancy platform to you under our agreement. Because the law provides for this, you are not asked to agree to it or to opt in.

The name used is the one your landlord types in. That is a separate thing from the legal name you give us directly when you join a tenancy, which is described under Your legal name when you join a tenancy above, and for which VEYLO X is the data controller. Once your landlord has notified the council, your landlord is separately responsible for what they have sent and for dealing with the council, as explained under Role of VEYLO X above.

The notification is about the move from the previous tenancy to yours. It shows your name and your tenancy start date, and, where your landlord provides them, the name and end date of the tenant who is moving out. Your landlord may also choose to add the number of adults living in the home, a forwarding address for the tenant who is moving out, and their own telephone number. Those extra details are optional and are the landlord's choice. VEYLO X does not add them, and it does not take them from your account.

If your name or your tenancy dates are shown incorrectly, the quickest way to put it right is usually through your landlord, who prepares and sends the notification and can send the council a correction. You can also contact us at privacy@veylox.uk, and we will deal with your request as set out under Your Rights below. We can correct the name and details we hold, but we cannot change what your landlord has already sent to the council, and we cannot give you legal advice. You can also contact your local council yourself to register for council tax, and VEYLO X can provide wording you can use for that. Either way, VEYLO X records and provides the wording only. It does not deal with the council for you and does not verify anything with the council.

Signing a document electronically

When you sign a tenancy agreement or a deed of guarantee on the Platform, we record what happened so that each party can later show that the document was signed. We record the time you signed, the email address on your VEYLO X account, the IP address your device was using at the time, the fingerprint of the terms you agreed, the wording you confirmed before signing, and the fact that you confirmed who you are again immediately before signing. We record the same facts for the other parties.

The other party can see this. Each party to the document can download a Certificate of Completion and can see the signing record on screen. Your name, your email address, the time you signed and the IP address you signed from appear on it, and you can see the same details for the other parties. Where more than one tenant signs the same agreement, a tenant does not see another tenant's email address or IP address.

We do this in our legitimate interests, and in the legitimate interests of both parties, in being able to evidence that an agreement was signed if it is ever questioned (UK GDPR Article 6(1)(f)). We record that the email address on the account was confirmed and that you signed in again immediately before signing. That is evidence of control of the account and the mailbox. It is not an identity check, and VEYLO X does not tell anyone that it has established who you are.

The Certificate of Completion is only ever downloaded by a party to the document, after signing in. We do not send it by email. How long we keep the signing record is set out under Data Retention below.

Lawful Basis

Processing is carried out on the basis of:

• contractual necessity
• legal obligations
• legitimate interests

Where required, consent will be obtained.

Data Sharing

We may share data with:

• infrastructure providers
• third-party integrations (e.g. referencing, payment, tenancy services)

We do not sell personal data.

Who handles your data

We work with three different kinds of organisation, and the law treats them differently. We set them out separately so it is clear what each one does and who is responsible.

These providers process personal data only on our instructions, under a written data-processing contract. We remain responsible for your data.

Our database and hosting are in the United Kingdom (London). Files you upload are currently stored in the United States, and we are moving that storage to the United Kingdom. Some providers may also need to access data from outside the United Kingdom for support, monitoring, or through their own sub-processors. Where that happens we rely on the transfer safeguards recorded against each provider in the table above, and on the safeguards described under International transfers below.

These organisations decide for themselves how they use your data and are responsible for it in their own right. What is listed here is their own use of your data, not work they carry out for us as our processor. Where we share your data for a credit or referencing check, we ask your permission first, and you should also read their own privacy notice. Those that carry out credit, referencing or identity checks run them under their own regulatory permissions.

A referral partner is an organisation we can introduce you to. You apply to them directly, under their own terms and their own privacy notice. We do not send them your application, your documents or your contact details. We may receive a referral fee if you take up their service.

E-signature of tenancy documents is handled on VEYLO X's own infrastructure, so it is not a third party. We update this list whenever an organisation is added or removed, and the version published here is always the current one.

International transfers

We intend to transfer personal data to countries outside the United Kingdom. Where we do, we make sure the transfer is protected in one of the ways the law allows.

Our database and hosting are in the United Kingdom (London). Personal data is transferred outside the United Kingdom in the following circumstances.

Files you upload. Documents, certificates and photographs you upload to the Platform are currently stored in the United States by our infrastructure provider, Google. That transfer is covered by the safeguard recorded against Google in the complete list of service providers above. We are moving this storage to the United Kingdom, and we will update this notice when we have.

Signing in to your account. When you create an account, sign in, or confirm who you are again immediately before you sign a document electronically, that sign-in data is processed in the United States by our authentication provider, Google. That transfer is covered by the Standard Contractual Clauses with the UK Addendum, plus Google LLC's EU-US Data Privacy Framework (UK Extension).

Security checks when you create an account. Our security check provider, Cloudflare, normally handles your connection at its UK data centre, but Cloudflare, Inc. is based in the United States and may access the information from there. That transfer is covered by the Standard Contractual Clauses with the UK Addendum, under Cloudflare's data processing addendum.

Live video viewings. When you take part in a live video viewing, the picture and sound travel from your device to our video provider, Daily, and usually straight between the two devices on the call. We set every viewing room to run on Daily servers in London. That is not the same as saying nothing leaves the United Kingdom, and we are not telling you that it is. Daily is a United States company and uses other United States companies to run its service. Two of those provide relay servers. When the two devices cannot reach each other directly, the picture and sound are carried through one of those relay servers instead, so part of a call can travel through the United States. Our contract is with Daily, Co., of San Francisco, California. That transfer is covered by the Standard Contractual Clauses with the UK Addendum, under our signed data processing agreement with them. We have not yet confirmed where Daily holds its own technical records about the call. We are establishing that with the provider and will update this notice as soon as we have. We do not receive or keep any picture, sound or chat from the call.

Transfers to the European Economic Area. Some of our providers process personal data on servers in the European Economic Area. The United Kingdom government has decided that the European Economic Area provides an adequate level of protection for personal data, so no further safeguard is required for those transfers.

Transfers to the United States and elsewhere. Some of our providers, and some of their own sub-processors, process personal data in the United States or in other countries. The United Kingdom has not made an adequacy decision covering those transfers generally. We therefore rely on the safeguards permitted by Article 46 of the UK GDPR. Depending on the provider, the safeguard is one or more of the following:

• the United Kingdom International Data Transfer Agreement;
• the European Commission's standard contractual clauses, together with the United Kingdom International Data Transfer Addendum;
• the provider's certification under the EU-US Data Privacy Framework, UK Extension.

The safeguard that applies to each provider is recorded against that provider in the complete list of service providers above.

You can ask us for a copy of the safeguard that applies to any transfer of your personal data. Contact us at privacy@veylox.uk and we will provide it, or tell you where it is published, within one month. Where a document contains commercially confidential terms, we will provide a copy with those terms removed.

Data Retention

We retain personal data only for as long as necessary to operate the service, meet legal obligations, and protect ourselves and our users from regulatory or contractual claims. The table below sets out our standard retention periods. Where a record is legally required for longer (e.g. tax, court evidence), the longer period applies.

For this table, the lifetime of a certificate means the period for which that certificate or report is treated by VEYLO X as current for the relevant property record, based on the certificate type, the inspection date and any stated next-inspection date.

Live video viewings. We keep a technical record of each live video viewing: who joined, when, and the room's settings. We delete that record automatically 90 days after the viewing. We do not record the call, so there is no picture or sound to delete.

You may request deletion at any time (see Your Rights). Where deletion would conflict with a statutory retention obligation, we keep only the legally required minimum and restrict further processing.

Cookies & similar technologies

We use a small number of cookies and similar technologies that are necessary to deliver the service you have asked for, and which do not require your consent. These keep you signed in, remember the cookie choice you make, remember your display theme once you have chosen one, and confirm that requests come from a genuine browser rather than an automated script. That last check is Firebase App Check, which uses Google reCAPTCHA Enterprise: it stores a value on your device and Google receives your IP address and technical information about your device and browser. We also keep a local copy of property listings on your device so that pages load faster.

Where you have opted in through the cookie banner, we also use anonymous analytics, which is processed on our behalf by PostHog on European Union servers. The analytics records which steps you reach and any errors, so we can improve the service. It is never linked to your name or email. We do not use advertising cookies, we do not sell your data, we do not use session recording, and we do not track you across other websites for marketing purposes. You can change your choice any time in Settings, then Cookie preferences.

The Cloudflare security check that protects our sign-up flow and certain secure areas of the service does not store anything on your device.

Artificial intelligence and automated processing

We use an artificial intelligence service provided by Google for the purposes set out below.

The assistant. Where you use the assistant in your message inbox, what you type is sent to Google so that a reply can be generated. Do not send the assistant anything you would not want processed in this way. The assistant provides general information about using the Platform. It does not give legal advice, it does not make any decision about you, your application or your tenancy, and nothing it says binds VEYLO X or your landlord.

Reading documents. Where you upload a compliance certificate or a similar property document, the document is sent to Google so that the dates, reference numbers and other details can be read out of it and filled in for you. You can always enter those details yourself instead, and you can correct anything that is read incorrectly. We do not treat what is read as verified, and it is recorded as your entry, not as a check we have carried out.

Writing a listing description. Where you ask us to draft a description for a property you are listing, the details you entered in the listing steps, including the address, are sent to Google so that a draft can be written for you. The draft is yours to edit or replace, and nothing goes on the listing until you publish it. You can always write the description yourself instead.

Checking listing wording. Where a listing description is being written, the text is sent to Google so that wording which conflicts with letting rules can be pointed out before the listing is published. What comes back is a prompt to the person writing the listing. It is not a decision about anyone, we do not treat it as a check we have carried out, and the landlord remains responsible for what they publish.

Translating text. Where you switch the Platform to a language other than English, text on screen is sent to Google to be translated. That text can include things you or another user has typed. Translations are kept on your device so the same text is not sent twice, and no translation is sent while you stay in English.

Google processes this content as our service provider, on our instructions, under a written contract. Your content is not used to train Google's models.

None of this processing produces a decision that has a legal effect on you, or that similarly significantly affects you, within the meaning of Articles 22A to 22D of the UK GDPR. If you would rather not use the assistant, do not use it; nothing on the Platform depends on it. If you would rather not have a document read automatically, enter the details yourself. If you would rather write your listing description yourself, do not ask us to draft one. If you would rather no text was sent for translation, stay in English. The check on listing wording is not optional, because it runs on the description whenever one is being written.

Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. The measures we take include the following.

Encryption. Personal data is encrypted while it is travelling between your device and the Platform, and while it is stored, by our infrastructure provider. In addition, we apply our own encryption to certain contact details before they are stored, so that they cannot be read from the underlying database.

Access control. Access to personal data is restricted by rule, at the level of each individual record. Our default position is that access is denied unless a rule expressly permits it, and we test those rules automatically. Certain sensitive operations additionally require the request to be verified as coming from our own application.

Audit records. Where a landlord, an agent or a member of our staff views a tenant's personal information through the Platform, we aim to record that access. Where a member of our staff looks up your contact details, our systems require them to give a written reason first, and that reason is recorded against their account before the details are shown to them. You can ask us for a copy of the record of who has accessed your information; see Your Rights below.

Two-factor authentication. You can turn on two-factor authentication for your account using an authenticator app. We do not currently require it.

Deletion. Where we delete personal data at your request, and a copy is held in an encrypted form, we destroy the key so that the copy cannot be read.

Personal data breaches. If a personal data breach occurs, we will assess it. Where the law requires it, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and where a breach is likely to result in a high risk to your rights and freedoms we will tell you without undue delay.

No system can be made completely secure, and we do not represent that ours is.

Insurance Alignment (Data Protection Context)

VEYLO X maintains cyber and data protection insurance.

This insurance:

• supports incident response
• does not guarantee prevention of breaches
• does not extend to user-controlled data risks

Users remain responsible for secure handling of their own data.

Data protection contact

We have a single point of contact for privacy queries and for requests about your rights. Contact us at:

VEYLO X has not designated a Data Protection Officer under Article 37 of the UK GDPR. We have assessed that we are not required to designate one. The contact above handles the same enquiries.

Your Rights

Under UK GDPR you have the following rights in respect of your personal data:

• Access: a copy of the personal data we hold about you (subject access request).
• Rectification: correction of inaccurate or incomplete data. You can usually correct your details yourself in your profile. Some information that sits on a formal record cannot be edited in the app once it is fixed there, for example your legal name once your tenancy is signed or your deposit is registered. You can still ask us to correct it, and we will action a valid request within one month, whether or not anyone else has acted. Where we have already shared the corrected information with an organisation such as the deposit protection scheme, we or your landlord will let them know where we are required to, so their record can be updated too, and you can ask us who we have shared your name with.
• Erasure: deletion of your data, subject to any overriding legal retention obligation listed in the retention table above.
• Restriction: limitation of how we process your data in certain circumstances. For example, if you dispute the accuracy of something we have recorded, you can ask us to restrict its use while we check it, or to note your disagreement alongside it.
• Portability: receipt of your data in a structured, machine-readable format.
• Objection: to processing carried out under legitimate interests or for direct marketing.
• Rights related to automated decision-making and profiling: under Articles 22A-22D of the UK GDPR (inserted by the Data (Use and Access) Act 2025). We use a deterministic, preference-based fit indicator that compares the search preferences you set against a landlord's declared listing fields, to show how well a property lines up with them. This does not make a decision about you, is not shared with landlords to screen you, and does not produce a legal or similarly significant effect on you. It runs under our legitimate interests; you can object at any time (see Objection above) or clear your saved preferences to switch it off.
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting prior lawfulness.

To exercise any right, contact us at privacy@veylox.uk.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to address your concern first.

Changes

This Notice may be updated from time to time.

11 August 2026: Updated the property-certificate retention wording to clarify that tenancy copies of certificates are retained on the tenancy-record retention clock; both tenancy parties can download the tenancy copy while the tenancy record is kept; and removing a certificate from the property record does not delete a tenancy copy still within its retention period. Also corrected the version/date metadata for this substantive update.

Metadata correction: a substantive certificate-retention update was published under privacy-v1.3-2026-08-09 on 11 August 2026 at 22:28. VEYLO X corrected the label to privacy-v1.4-2026-08-11 on 11 August 2026.

Contact

VEYLO X Limited
66 Paul Street, London, EC2A 4NA
info@veylox.uk
Company number: 17203848 · ICO registration: ZC156986