Privacy Policy

1. Who we are

Xenith Property Group Ltd (company no. 15898297), registered office c/o Rapinet & Co, 21a Sandygate Road, Sheffield S10 5NG ("Xenith", "we", "us") is the controller of the personal data described in this notice. We let and manage residential property in Sheffield and South Yorkshire and carry out repairs and maintenance.

Some viewings, marketing and lettings are handled by independent partner estate agents. Information you give to a partner estate agent directly is used by that agent under its own privacy notice. Information you give through this website comes to Xenith.

• Privacy contact: XenithPropertyGroup@icloud.com, or by post to the registered office above, marked "Data protection".

This notice explains how we use personal data under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Notice version 2026-09-v2.

2. Whose data we hold

Tenancy applicants, tenants and other occupiers, landlords, contractors, our own staff who use the staff portal, website visitors, and people who contact us.

3. What we collect, and where it comes from

Most of this information comes from you. Some comes from referees you name, from our staff and contractors (for example visit notes and photos), and from Stripe when you pay.

• Account details: your email address and password (held by our hosting platform, not visible to us), or your Google account email if you choose "Sign in with Google".
• Tenancy applications: name, email, phone, date of birth, current address and years there, preferred move-in date, other occupants and pets, employment status, employer, annual income, and the names and contact details of a landlord and/or employer referee.
• Right to rent and ID: the type of document, a Home Office share code if you give one, and an upload of your right to rent document and (optionally) photo ID. These can show your nationality and immigration status. They are not "special category" data in law, but we treat them as high-risk: they are stored privately and only authorised staff can open them, through links that expire after 5 minutes.
• Your acknowledgement of this notice: the date and time you ticked the box and the notice version shown to you.
• Tenancies and payments: tenancy dates, rent and deposit amounts, payment references, amounts, due and paid dates, and payment status. Card details are entered on Stripe's own checkout page and are never seen or stored by us.
• Repair reports: your name, email, phone, the property, a description of the problem, up to a few photos you upload, whether we may enter when you are out, and preferred times. If you choose to tell us about a health condition, disability or vulnerability (for example to prioritise a repair), we record it.
• Visits to your home: the reason for the visit, when and how you were notified, arrival and departure times, staff who attended, staff work notes, and photos taken by staff. Photos are intended to show the condition of the property and the work done. If a photo shows people, documents or personal belongings, tell us and we will restrict or remove it. Staff decide whether each photo is shared with you in your portal.
• Visit sign-off sheets: if you sign a record of work on screen we store your drawn signature, typed name, the date and time, your email, the IP address and browser/device description ("user agent") of the device used, and a fingerprint (hash) of the text you signed, so the record can be shown to be unaltered. If you decline to sign we store your reason.
• Tenancy pack acknowledgements: which documents you were given and when you confirmed receipt.
• Landlords and contractors: names, contact details, trade, and our internal notes and ratings of contractors.
• Staff users: login details, one-time sign-in codes (stored only as a scrambled hash), sign-in session times, and an audit log of actions taken on records, including the staff member's email and IP address.
• Emails: when you submit an application or repair report we email our staff with a summary and send you an acknowledgement. We keep a log that each email was sent.
• Website use and portal activity: see section 9 (including 9A, "Website analytics") and our Cookie Policy.

We do not ask for criminal offence information through this website.

4. Why we use it and our lawful bases

Ticking the box on our application form confirms you have read this notice. It is not the lawful basis we rely on for processing your application, and you can still exercise the rights in section 11.

Health or disability information (special category data) is used only where you give it to us to help us respond to you, for example prioritising a repair. We rely on your explicit consent (Article 9(2)(a)), which you can withdraw at any time, or, where someone may be at risk, the "safeguarding of individuals at risk" condition in Schedule 1 of the Data Protection Act 2018.

Where we rely on legitimate interests, you can object (section 11).

5. Who we share it with

We do not sell personal data. We share it only as needed with:

• Base44 (our website, database and file-storage platform, part of the Wix.com group), which also sends our system emails and provides "Sign in with Google" – as our processor.
• Stripe – to take payments. Stripe is responsible for its own use of payment data for fraud prevention and legal compliance.
• NVIDIA – AI text drafting (section 6) – as our processor.
• Google – only if you choose to sign in with Google, and to deliver the website font (section 9).
• Landlords of the property concerned, contractors carrying out repairs (only what they need, such as your name, contact details and access arrangements), and partner estate agents where they are handling the letting of the property you are interested in.
• Your referees, to take up the references you have named.
• The tenancy deposit scheme we use, which is named in your tenancy paperwork.
• The Home Office (for right to rent checks), HMRC, local authorities, courts, police, regulators and our professional advisers and insurers, where the law requires or allows it.

6. AI-assisted drafting of visit records

After a visit, staff can ask an AI model provided through NVIDIA's API service to draft the plain-English "description of work carried out" from their notes. We send the staff notes and work log, the visit purpose, the property address, the visit date and times and the names of staff who attended. We do not send your name, email, phone, photos or signature. The AI does not make any decision about you. Every draft is reviewed and, if necessary, corrected by a member of staff before it is sent to you, and you can decline to sign it and tell us why. We record which AI model and prompt version were used.

7. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Tenancy applications are assessed by our staff.

8. International transfers

Some of our providers (Base44, Stripe, NVIDIA and Google) are based outside the UK or may process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on a safeguard permitted by the UK GDPR, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or the UK International Data Transfer Agreement or Addendum. You can ask us for details of the safeguard used for a particular provider.

9. Website data and third-party requests

When you visit the site, your browser also contacts:

• Google Fonts (fonts.googleapis.com and fonts.gstatic.com) to load our typeface. Google receives your IP address and browser details.
• Wix image hosting (static.wixstatic.com), which serves some of our images. Its servers receive your IP address and browser details.
• OpenStreetMap (openstreetmap.org), only on property pages with a map. The map is loaded from OpenStreetMap's servers, which receive your IP address and browser details and may set their own cookies under the OpenStreetMap Foundation's privacy policy.
• Esri (arcgis.com), only if you choose the Satellite view of a map. Satellite images are loaded from Esri's servers, which receive your IP address and browser details under Esri's privacy statement.
• Google (google.com/maps), only if you open Street View. The Street View panorama is loaded from Google's servers, which receive your IP address and browser details and may set cookies under Google's privacy policy. We do not load Street View until you ask for it.

Our hosting platform records which pages are viewed and, through a random session identifier stored on your device, how long visits last and where visitors came from, linked to your account ID if you are signed in. It also logs the name of the first section of the page address you open (for example "properties"), used only to understand how the site is used. Full details, and how to object, are in our Cookie Policy.

Bus stop and route information on property pages is stored on our own system; your browser does not contact bustimes.org.

9A. Website analytics (what we record about visits)

We run our own analytics on our own system. It is separate from the platform statistics described in section 9.

If you are signed in (tenant, applicant, contractor, landlord or staff), we record, linked to your account email:

• when you signed in and signed out, and when each visit ended;
• each page you opened (the page address without anything after a question mark or #, with record numbers and secret links replaced by a placeholder), the page title, and how long the page was open and visible on your screen;
• documents you opened or downloaded (document type, reference number and title) and forms you submitted (form name only);
• total active time on the site for the visit;
• device type (desktop, mobile or tablet), browser, operating system, the name of the website you came from, and a country code where our host provides it;
• a scrambled (salted, one-way hash) form of your IP address, which lets us spot unusual sign-ins without keeping the address itself. We do not store your IP address in this analytics data.

For staff pages we record the page address only, not page titles or the details of records opened. We use this to run and secure the portal, to check that documents were made available to the right person, to fix faults and to understand how the portal is used. We do not use it for advertising, we do not sell it, and we do not use it to make automated decisions about you. Only authorised staff who have passed two-step sign-in can see it, viewing an individual's activity is recorded in our audit log, and exports are recorded too.

If you are not signed in: we only count page views (the page address and time), with no identifier, no cookie, no IP address and no device details stored. If you use the choice shown on your first visit to accept analytics, we also record a random ID that exists only for that browser tab, the pages you view and for how long, device type, browser, operating system, the site you came from, a country code and a hashed IP address. This is not linked to your name or email unless you then sign in in the same tab. If you reject, or your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all about your visit. You can change your choice by clearing this site's data in your browser, which shows the choice again.

How long we keep it: analytics records are kept for 12 months and then deleted. Deletion is run by a member of staff using a tool in the staff area; it is not yet automatic, so records may occasionally remain a little longer.

Your rights in section 11 apply to this data. You can ask for a copy of the analytics held about your account, and you can object to it being recorded about you while signed in; contact us using the details in section 1 and we will consider your objection, taking account of the security and record-keeping reasons above.

10. How long we keep it

Our systems do not yet delete records automatically at the end of these periods. We review and delete or anonymise records manually. If you think we are holding something for longer than we should, please ask us.

11. Your rights

You have the right to:

• be told how we use your data (this notice);
• get a copy of your data (subject access);
• have inaccurate data corrected;
• have data erased in some circumstances;
• restrict how we use it in some circumstances;
• data portability, where we rely on contract or consent;
• object to processing based on legitimate interests, and to any direct marketing (we do not currently send marketing);
• withdraw consent at any time, where we rely on consent.

Some rights do not apply in every case, for example we must keep right to rent records for the period set by the Home Office. To use a right, contact us using the details in section 1. We will respond within one month; for complex or numerous requests this can be extended by up to two further months and we will tell you why. We may need to confirm your identity first. There is normally no charge.

12. Data protection complaints

If you are unhappy with how we have used your personal data, please complain to us first using the contact details in section 1. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.

If you are not satisfied, you can complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113. You can also go to the ICO at any time, but the ICO will usually expect you to have raised the matter with us first.

13. Security

We use access controls by role, two-step sign-in for staff, private file storage with short-lived access links, encryption in transit (HTTPS) and an audit log that cannot be edited or deleted through the app. No system is completely secure. If a breach is likely to result in a risk to you, we will report it to the ICO within 72 hours, and where the risk is high we will tell you without undue delay.

14. Children

Our services are for adults. Where children live in a property we collect only what is needed about them (for example as occupants), from the adult applying.

15. Changes

We will update this notice when our use of data changes. The version number and date above show the current version.