Kamma Platform User Privacy Notice
Who we are
Kamma Limited, a company registered in England and Wales with company number 09546202, whose registered office is at Unit 207, Elementa Workspace, 1 Giltspur Street, London EC1A 9DD.
We are the data controller of the personal data described in this notice. That means we decide why and how it is used.
If you have any question about this notice, or want to exercise any of the rights described below, contact Gary Gale, Chief Technology Officer, at hello@kammadata.com.
Who this notice is for
This notice is for people who use the Kamma Platform, our online software for property licensing compliance, including Kamma Suite and Kamma Quick Check. You are most likely using it as an employee or contractor of one of our customers, usually a letting agent, property manager or landlord business, or on a free trial.
It also covers people at our customers who deal with us about the account: administrators, finance contacts who receive invoices, and anyone who signs a contract with us on their organisation's behalf.
What this notice does not cover. Information about landlords, tenants and properties that you or your organisation upload to the Kamma Platform is processed by us on your organisation's behalf, as its processor, under clause 28 of our Subscriber Terms, and your organisation is responsible for telling those people how their information is used. Where we prepare licence applications, we use landlords' information as a controller, as explained in the Kamma Landlord Privacy Notice. How we use information collected through our websites is covered by our Website Privacy and Cookie Policy.
What we hold
| Category | What it includes |
|---|---|
| Account details | Your name, work email address, job title, employer and phone number; your user role and permissions |
| Login and security information | Your authentication information, including single sign-on and multi-factor authentication details, and records of logins and security events |
| Usage information | What you do in the Kamma Platform and when, such as searches, reports and changes; your IP address, browser and device type |
| Integration information | Identifiers and access tokens for connections your organisation sets up between the Kamma Platform and other systems, such as Reapit or other CRM platforms, and the API keys issued to your organisation |
| Support and training records | Your messages to our support team, notes of calls, and records of training sessions you attend |
| Contract and billing records | Contracts you sign on your organisation's behalf, including your electronic signature and its audit trail, and invoices and correspondence about payment |
| Communication preferences | Whether you have chosen to receive product updates and news from us |
We do not ask for special category data, such as health information, and you should not enter it in the Kamma Platform.
Where we get it
Most of this information comes from you, or from your organisation when it sets up your account or adds you as a user. Usage and security information is generated automatically as you use the Kamma Platform. Integration information comes from the systems your organisation connects.
Why we use your information, and our legal basis
| What we do | Our legal basis |
|---|---|
| Set up and manage your account, let you log in, and provide the Kamma Platform to your organisation | Our legitimate interests in providing the service your organisation has contracted for. Where you contract with us yourself, for example as a sole trader, performance of our contract with you. |
| Keep the Kamma Platform secure, detect misuse, and keep audit logs | Our legitimate interests in protecting our systems and our customers' data, and our legal obligation to keep personal data secure |
| Provide support and training | Our legitimate interests in helping customers use the service |
| Send you service messages, such as changes to the service, maintenance and changes to our terms | Our legitimate interests in running the service and keeping customers informed |
| Understand how the Kamma Platform is used, so we can improve it | Our legitimate interests in developing our products. |
| Manage contracts, billing and payment | Our legitimate interests in running our business, and our legal obligations to keep financial records |
| Check that use of the platform complies with your organisation's agreement with us, including the number of users | Our legitimate interests in enforcing our contracts |
| Send you product updates and news | Our legitimate interests in telling business customers about our services. You can opt out at any time using the link in every email or by contacting us |
| Comply with the law and establish, exercise or defend legal claims | Legal obligation; our legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against yours, and you can ask us for more detail. We do not make any decision about you by automated means that has legal or similarly significant effects on you, and we do not sell your personal data.
Who we share it with
Your organisation. Administrators at your organisation can see your account details and, through audit features, what you have done in the Kamma Platform.
Our service providers, who process information only on our instructions. These are Google, who host the Kamma Platform and handle our email; HubSpot, who host our customer records; and DocuSign and Qwilr, through which contracts are signed.
Integration partners. When your organisation connects the Kamma Platform to another system, such as Reapit, information passes between the two systems as your organisation has set up. The operator of that system handles it under its own privacy notice.
Others where necessary: our professional advisers and insurers; regulators, law enforcement and courts where the law requires it; and a buyer or investor if we sell or restructure our business, who would have to use your information in line with this notice.
Where your information is held
The Kamma Platform is hosted on Google Cloud in the Netherlands and London, and our backups are held in the same two places. The Netherlands is recognised under UK law as providing an adequate level of data protection.
Some of our service providers hold information outside the UK and Europe. Qwilr, which we use to prepare and sign some contracts, holds information in Australia, protected by UK-approved safeguards in our contract with it. You can ask us for a copy of these safeguards.
How long we keep it
| Information | How long |
|---|---|
| Account details | While your account is active, and for 12 months after it is closed or your organisation's contract ends |
| Usage and security logs | 12 months from the date of the activity |
| Support and training records | 2 years from the last contact |
| Contract and billing records | 6 years after the end of the financial year to which they relate, to meet our legal obligations |
| Communication preferences | Until you change them; if you opt out, we keep a record so that we do not contact you again |
Your rights
You have the right to:
- Be told what we do with your information, which is what this notice is for.
- Ask for a copy of the personal data we hold about you. We will respond within one month, or tell you if we need longer because your request is complex.
- Have it corrected if it is wrong. You can update most account details yourself in the Kamma Platform.
- Ask us to delete it, though we may not be able to while your organisation's account is active, or where we need it to meet a legal obligation or defend a claim.
- Ask us to restrict how we use it while a question about it is resolved.
- Object to us using it where we rely on legitimate interests, and to stop receiving product updates and news at any time.
- Receive it in a portable format, where we rely on a contract with you.
To exercise any of these rights, contact us at hello@kammadata.com. If your request is about information your organisation controls, we may refer you to your organisation's administrator.
Complaints
If you are unhappy with how we have handled your personal data, tell us at hello@kammadata.com. We will acknowledge your complaint within 30 days and investigate it without undue delay.
You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would prefer the chance to resolve it first, but you do not have to come to us before going to the ICO.
Changes to this notice
We review this notice at least annually. This version was published on 16th October 2026. Where we make a material change we will update the version date and, where the change affects you significantly, we will tell you through the Kamma Platform or by email.
Get in touch
Contact us using this form and we will get back to you right away!
In partnership with
