Data Retention Policy

Approved By: Data Protection Officer

1. Purpose

At 99home, we are committed to protecting the privacy and security of your data. This policy outlines our approach to the collection, storage, and retention of data collected through our website, ensuring compliance with:

The UK General Data Protection Regulation (UK GDPR)
The Data Protection Act 2018
HMRC recordkeeping obligations
The Property Ombudsman (TPO) Code of Practice
Guidance issued by the Information Commissioner's Office (ICO)

2. Scope

This policy applies to all personal data held about:

Landlords
Tenants
Buyers
Sellers
Guarantors
Employees and Contractors

It covers both electronic and paper records

3. Categories of Data Held

Data Type	Examples
Personal Identification	Name, date of birth, ID documents, contact details
Property Information	Ownership records, tenancy agreements, sales/lettings data
Financial Records	Rent statements, invoices, bank details, commission records
Legal/Compliance	AML/KYC documents, right-to-rent checks, dispute records
Communications	Emails, call notes, letters, and complaints

4. Data Collected Through Automated Technical Means

When you use our website, we automatically collect certain technical data to ensure the proper functioning of our services, enhance user experience, and for security purposes. The information we collect includes:

Internet Protocol (IP) address: The IP address used to connect your computer or device to the internet. This is used for security, analytics, and to help identify your general location to avoid fraud
Login information: Your username and password for your 99home account
Browser and device information: The type and version of the browser you are using, browser plug-in types and versions, your operating system and platform. This information helps us ensure our website is compatible with various systems and can assist in troubleshooting
Time zone setting: This helps us display content and timestamps in your local time.
Identification numbers and online identifiers: Unique identifiers assigned to your device or browser for analytical purposes
Location data: General location data derived from your IP address
Website usage data: Information about your website visit, including which website pages are accessed, page response times, and the length of visits to pages. This data helps us understand how our website is used and allows us to improve our services and content

5. Retention Periods

Record Type	Retention Period	Legal Basis / Rationale
Client files (Landlord, Tenant, Buyer, Seller)	6 years from the end of the relationship	HMRC, ICO and TPO
Tenancy Agreements and Inventories	6 years from the end of the tenancy	TPO Code of Practice, Limitation Act 1980
Right to Rent checks	1 year after tenancy ends	Immigration Act 2014
AML/KYC identity checks	5 years from the transaction	Money Laundering Regulations 2017
Financial records (invoices, statements)	6 years	HMRC requirements
Complaint records	6 years	TPO and legal limitation periods
Marketing consent logs	As long as consent is valid or until withdrawn	UK GDPR Article 6(1)(a)
Employee records	6 years from the end of employment	Employment law, HMRC
IP addresses, location, and login information	2 years from your last login or until you close your account	Security and auditing purposes to avoid fraud

6. Secure Disposal

At the end of the retention period, records are securely destroyed:

Paper records: shredded using cross-cut shredders or confidential waste services
Electronic records: permanently deleted from systems and backups

7. Data Minimisation & Review

We regularly review the personal data we hold and ensure that:

It is still necessary for the purpose it was collected
Outdated or excessive data is securely removed
Access is restricted to authorised personnel only

8. Data Subject Rights

Data subjects have the right to:

Access their personal data (Subject Access Request)
Request rectification or erasure of data
Object to processing
Complain to the ICO

All requests will be handled under our Privacy Policy and UK GDPR

9. Review and Updates

This policy and our retention periods are reviewed regularly, annually, or sooner if required by changes in legislation, regulatory guidance, or operational needs. We securely delete or anonymise your data when it is no longer needed for the purposes for which it was collected.

10. Your Rights

Under the UK GDPR, you have the right to request access to the personal data we hold about you and to ask for it to be corrected, erased, or restricted. If you have any questions about this policy or wish to exercise your rights, please contact our Data Protection Officer at gdpr@99home.co.uk