Privacy policy

Privacy policy

Last updated: October 2026

Xeno Property Limited takes the privacy of your personal data seriously. This policy explains what personal data we collect, why we use it, who we share it with, how long we keep it and the rights you have. It applies to tenants, guarantors, landlords, applicants and anyone who uses our website or contacts us.

Who we are

Xeno Property Limited is a letting agent and property management company covering Bristol and Bath. We are the data controller for the personal data described in this policy.

  • Company number: 13408431, registered in England and Wales

  • Registered office: 195-197 Whiteladies Road, Bristol BS8 2SB

  • Registered with the Information Commissioner's Office (ICO): ZB321590

Our address is a registered and postal address only; we do not have a walk-in office.

Privacy contact: email info@xenoproperty.com, call 0117 990 4990 or write to Privacy, Xeno Property Limited, 195-197 Whiteladies Road, Bristol BS8 2SB.

What we collect and why

We collect personal data directly from you, for example through our website forms, application and referencing forms, email, phone and WhatsApp. Sometimes we receive it from others, such as a landlord, a referencing provider or a tenant who names you as their guarantor.

Tenants and applicants

  • What we collect: name, contact details, date of birth, current address, course or employer, proof of identity, proof of income, bank statements, credit report and guarantor details.

  • Why: to assess applications, prepare and manage your tenancy, collect rent and protect your deposit.

  • Legal basis: contract, or steps before entering a contract.

Right to Rent checks

  • What we collect: passport, visa or share code.

  • Why: Right to Rent checks required by the Immigration Act 2014.

  • Legal basis: legal obligation.

Guarantors

  • What we collect: name, contact details, address, proof of identity, proof of income and credit report.

  • Why: to reference you and prepare the guarantor agreement.

  • Legal basis: legitimate interests (securing the tenancy) and contract.

Landlords

  • What we collect: name, contact details, property details, bank details, and ownership and compliance documents.

  • Why: to value, let and manage your property and pay you rent.

  • Legal basis: contract.

Payments

  • What we collect: bank details and payment records.

  • Why: to take and make payments and keep accounts.

  • Legal basis: contract, and legal obligation (tax and accounting).

Website users

  • What we collect: what you type into our forms, and any photos you upload.

  • Why: to answer your enquiry, book viewings and valuations, and handle repairs.

  • Legal basis: legitimate interests, or steps before entering a contract.

Property alerts

  • What we collect: name, email and what you are looking for.

  • Why: to tell you about suitable properties.

  • Legal basis: consent, which you can withdraw at any time.

We do not make decisions about you using fully automated processes. We do not sell your personal data.

Our website and forms

  • Enquiry, valuation and alert forms. What you submit is emailed to our team so we can reply. Our website is hosted by Squarespace.

  • Repair reports. The details and photos you send through our repair form go to our property management system, Street.co.uk, through a Google service, so we can arrange the repair. We share the relevant details with the contractor and, where needed, your landlord.

  • Application and referencing forms. These are Google Forms, and responses are stored in our Google account.

  • Cookies. Our website uses cookies that it needs to work, and to understand how the site is used. You can control cookies through your browser settings and our cookie banner.

Who we share your data with

We only share what is needed for the service you have asked for, and we use providers who are bound to protect your data.

  • Landlords: tenant and guarantor details needed to agree and manage the tenancy.

  • Contractors: name, phone number, property and repair details to carry out repairs.

  • The Tenancy Deposit Scheme: to protect deposits and resolve deposit disputes.

  • Street.co.uk: our property management system.

  • Concurrent: our contract system, used to prepare and sign tenancy and guarantor agreements.

  • Squarespace: hosts our website and its forms.

  • Google (Workspace, Forms and Sheets): email, document storage, and application and referencing forms.

  • Fused, Notify and The Student Energy Group: bill providers, where your tenancy includes utilities or broadband.

  • UniHomes and Housr: student property platforms that list our homes and pass enquiries to us; they will also offer utility services

  • Local councils, HMRC, the police and other authorities: only where the law requires it, such as HMO licensing, council tax or a legal request.

  • Our professional advisers: accountants, insurers and solicitors, where needed.

Some of these providers may store data outside the UK. Where they do, they use legal safeguards approved under UK data protection law, such as the UK International Data Transfer Agreement.

How long we keep it

  • Tenancy files, including references and payment records: 6 years after the tenancy ends

  • Right to Rent documents: for the tenancy and 1 year after it ends, as the Home Office requires

  • Landlord records and accounts: 6 years after we stop working together

  • Enquiries and applications that don't lead to a tenancy: 12 months

How we protect it

We keep personal data in secure, password-protected systems, limit access to the team members who need it, and keep paper records locked away. We only ask for documents when we need them, and we ask you not to send identity or bank documents through unsecured channels such as social media.

Your rights

Under UK data protection law, you have the right to:

  • Access a copy of the personal data we hold about you

  • Correct data that is wrong or incomplete

  • Delete your data, where we no longer need to keep it by law or contract

  • Restrict how we use your data while a concern is looked into

  • Object to our use of your data based on legitimate interests, and to direct marketing at any time

  • Move data you gave us to another provider, in a common format

  • Withdraw consent at any time, where we rely on it

To use any of these rights, contact our privacy contact above. There is normally no charge, and we will reply within one month. If your request is complex, we may extend this by up to two more months and will tell you why.

Complaints

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We review this policy regularly and will update it when the law or the way we work changes. The date at the top shows when it was last updated.