Privacy notice

1. Who we are

• Righto Landlord is a trading name of NJG Consultancy Ltd, registered in England and Wales, company number 16095900.
• Registered office: Jubilee House, East Beach, Lytham St Annes, FY8 5FT.
• We are the controller of the personal data described here, except where section 13 says otherwise. If Righto Landlord moves to another NJG company, that company becomes the controller instead (section 15).
• Contact for anything about your data: hello@rightolandlord.co.uk, or write to the registered office, marked "Privacy".
• Our director is responsible for data protection. We have not appointed a data protection officer, because the law does not require one for a business of our type and size.
• Registered with the Information Commission (ICO): ZC279161.

2. Who this notice is about

• People who visit our website or use our free tools (the MTD checker, the register-deadline checker, calculators).
• People who join our waitlist or sign up for emails.
• Clients of our tax services (Trades Tax, Landlord Tax, the VAT add-on, the one-off tax return).
• Landlord Compliance and free-tier users.
• Anyone who contacts us: support, complaints, journalists and business contacts.

3. What we collect, and where it comes from

Do you have to give us this? For tax clients:

• The identity and screening information is required by law (the Money Laundering Regulations 2017). Without it, we cannot act for you.
• The tax and bank information is required by our contract. Without it, we cannot prepare or file anything.

Everything else is up to you.

4. Money-laundering checks — how we use that information

The law requires this statement before we start working with you.

We are supervised by HMRC under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Those Regulations require us to:

• check your identity;
• screen you against PEP and sanctions lists;
• understand the purpose of our work for you;
• keep monitoring our relationship.

Personal data we obtain for those purposes will be used only to prevent money laundering, terrorist financing or proliferation financing, unless another law allows us to use it for something else, or you agree to the other use.

• Lawful basis: UK GDPR Article 6(1)(c) (legal obligation) and Article 6(1)(e). The Regulations make this processing a task carried out in the public interest (reg 41(7)).
• Criminal-offence information. If screening reveals information about criminal offences, we rely on DPA 2018 Schedule 1 paragraph 12 (regulatory requirements relating to unlawful acts). Our appropriate policy document is available on request.
• Retention. We keep these records for 5 years after our relationship ends, then delete them, as the Regulations require. We keep them longer only where a law, court proceedings or your consent requires it (section 9).
• Reports. The law may require us to report concerns to the National Crime Agency, or to the Treasury's Office of Financial Sanctions Implementation. The law may also stop us telling you about it.

5. Why we use your data, and our lawful basis

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details.

6. The identity check, the selfie, and automated decisions

The selfie. Our identity check is run by Stripe Identity:

• you photograph your ID and take a live selfie;
• Stripe compares your face with the photo on the ID. This creates biometric data;
• we ask for your explicit consent before you start. You can withdraw it before the check begins.

If you don't want a selfie check: tell us at hello@rightolandlord.co.uk. Where we can, we will offer another way to verify your identity that meets the law. It may take longer and include extra checks.

What Stripe keeps. Stripe holds the images and results for us, as our processor. We copy the result to our own secure records, then ask Stripe to delete its copy. Stripe also creates biometric identifiers for its own fraud prevention, as an independent controller. Stripe says it fully removes them within one year. The privacy policy is at stripe.com/privacy, and you can contact Stripe at privacy@stripe.com.

The decision is automatic. If the check does not pass after the permitted attempts, our system declines the application. No person reviews the result first. This is a decision based solely on automated processing, and it significantly affects you. The law gives you these safeguards (UK GDPR Article 22C):

• we will tell you that the decision was made automatically;
• you can make representations to us;
• you can ask for a person to review it: our director;
• you can contest the decision.

Email hello@rightolandlord.co.uk within 30 days of the decision. On review:

• If the check failed because of a technical problem, we offer a fresh check.
• If you have no suitable ID, we offer another compliant route where one exists.
• The law does not allow anyone to mark a failed check as passed without a successful check.

Other automation. Our software sorts your bank transactions into categories and prepares your figures. You check and confirm every figure before anything is sent to HMRC. Those steps are not decisions about you. Some of our tools use AI, provided by Anthropic. Section 7 covers the protections for that.

7. Who we share your data with

People we must or may share with:

Suppliers who process data for us (our "processors"). Each is bound by a contract that meets UK GDPR Article 28:

Stripe and your bank-data provider are also controllers of some data for their own legal duties. Their privacy notices explain how.

We never sell your data. We never give it to anyone for their own marketing.

8. Transfers outside the UK

Some suppliers process data in the US or the EU. When data leaves the UK, we make sure it is protected by one of these:

• UK adequacy regulations — for the EU and EEA, and for US companies certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge", The Data Protection (Adequacy) (United States of America) Regulations 2023);
• the ICO's International Data Transfer Agreement or Addendum.

You can ask us for a copy of the safeguards.

9. How long we keep it

We keep a record longer only if a law requires it, or we need it for actual or likely legal proceedings.

10. Your rights

You have the right to:

• access your data: ask for a copy;
• correct it;
• delete it;
• restrict our use of it;
• object to our use of it, where we rely on legitimate interests or public task;
• take it with you in a machine-readable format (portability);
• withdraw consent at any time, for marketing, research or the selfie check. This does not affect what we did before.

How to use them. Email hello@rightolandlord.co.uk. We reply within one month. For complex requests, the law allows up to two more months, and we will tell you if we need it. We may ask you to confirm your identity first.

Limits.

• Deletion. We cannot delete records that the law requires us to keep, such as money-laundering records or tax records, until the retention period ends.
• Access. The law sometimes stops us disclosing information, for example where disclosure would harm the prevention or detection of crime, or the assessment or collection of tax (DPA 2018 Schedule 2 paragraph 2).

11. Complaints

Please tell us first.

• Email hello@rightolandlord.co.uk with "Data complaint" in the subject, or use the form at rightolandlord.co.uk/complaints.
• We acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

You can also complain to the Information Commission (ICO) at ico.org.uk/make-a-complaint.

12. Marketing and research

• Marketing. We only send marketing emails if you have ticked the marketing box. Every email has a one-click unsubscribe link.
• Research. We only use your answers in research if you have ticked the research box. Our published data is anonymised and aggregated, and groups smaller than 10 people are never shown.
• Service emails. These are emails we must send to run your account, such as deadline reminders and requests to confirm figures. They are not marketing.
• Refer a friend. When you confirm your email address after joining our waitlist or signing up for emails, we store a referral code for you, which makes your own referral link. If you joined through someone else's link, we also store their code, so we can credit them with their free month. We never ask for your friends' details and never email them. Both codes are kept for as long as your sign-up (section 9).
  • If you sign up with us, your waitlist referral code becomes your code in our app, so your link keeps working. If you joined the waitlist through someone else's link and then sign up for Trades Tax, that referral is carried into your account.
  • If a friend signs up for Trades Tax through your link before you have signed up with us, we copy your email address and your referral code from the waitlist into our client records, so the free month you earn can wait for you. We use them only for this and never email you because of it.
  • If your waitlist sign-up is deleted before you have signed up with us, at your request or after it expires, we delete your email address from our client records too, within a day of it being deleted (section 9). Your code is kept only as part of your friends' records, linked to nobody, and the friends who joined through your link keep their own free months.

13. Tenants' data in a landlord's records

If you are a tenant and your landlord's Landlord Compliance records include your details (for example on a certificate copy they attach):

• your landlord is the controller, and we process the data only on their instructions;
• please contact your landlord about your data;
• if you contact us, we will pass your request to them.

14. Cookies

See our cookie notice at rightolandlord.co.uk/cookies.

15. If Righto Landlord moves to another NJG company

We may move Righto Landlord to another company in the NJG group (as defined in section 15 of our Terms of Service). If we do:

• We pass your data to that company, so it can carry on the service without you signing up again.
• From the date your service moves, that company is the controller of your data instead of NJG Consultancy Ltd. For a tax service, that is once you have authorised the new company with HMRC (Terms of Service section 15), or at the end of the 14-day period described below, whichever is later. Until then, NJG Consultancy Ltd stays the controller and keeps acting for you. It uses your data only for the purposes in this notice, on the same lawful bases, and keeps it for the same periods. Your rights stay the same. Where we rely on your consent (marketing emails or research), the notice email asks you to confirm it for the new company. If you don't, the new company stops relying on it.
• We tell you at least 30 days before the move. Clients and people on our waitlist or email list get an email. We also publish the change here. We tell you the new controller's name, contact details and the date of the move, and its company number, registered office and ICO registration number. If any of these have not been issued yet because the company is still being set up, we send them as soon as they are, and at least 14 days before your data moves, so you still have time to object or leave first. If we cannot, your data moves 14 days after we send them instead. If the company's name changes when it is registered, we tell you, ask you to confirm any consent again in the new name, and your data moves no sooner than 30 days after we tell you.
• Money-laundering records. The new company gets a copy of your identity and screening records, so it can meet its own legal duties without checking you again. NJG Consultancy Ltd keeps its own copy for 5 years after its own relationship with you ends, as the law requires. Both copies are used only as section 4 says. The new company gives you the statement in section 4 in its own name before the move.
• Our suppliers (section 7) carry on, under contracts with the new company.
• If you don't want your data to move, close your account, or leave our waitlist or email list, before the move (Terms of Service section 15 explains the refund). You can also object (section 10). If you object, we don't pass your data on. Because the new company cannot serve you without it, your account then closes on the date of the move, on the same refund terms. NJG Consultancy Ltd keeps only the records the law requires it to keep, until they are due for deletion (section 9).

16. Changes to this notice

We will update this notice when our practices change. We will email clients about any important change before it applies.

Last updated: 20 October 2026.