Kamma Landlord and Manager Privacy Notice

Kamma Limited, a company registered in England and Wales with company number 09546202, whose registered office is at Unit 207, Elementa Workspace, 1 Giltspur Street, London EC1A 9DD.

For licence applications, we are a data controller in respect of the personal data described in this notice. That means we decide why and how it is used. For licensing compliance, we act on behalf of your managing agent or letting agent, who is the controller: we use your information only on their instructions, and their own privacy notice explains how they use it. Your agent will be able to give you a copy of their privacy notice on request.

If you have any question about this notice, or want to exercise any of the rights described below, contact Gary Gale, Chief Technology Officer, at hello@kammadata.com.

We provide property licensing services to letting agents, property managers and landlords. We do two things:

Licensing compliance. We tell our customers which of the properties in their portfolio need a licence under the Housing Act 2004.

Licence applications. Where we are instructed, we prepare and submit a licence application to the relevant local authority on a landlord's behalf.

In both cases we may hold personal data about you even though you have not dealt with us directly. This notice explains what we hold, why, and what you can do about it.

We usually receive your information from:

• your managing agent or letting agent, where they use our services;
• you directly, where you have instructed us yourself; or
• publicly available sources, including local authority licensing registers, which local authorities are required to publish.

For licensing compliance, we may hold: your name; your correspondence address; your contact details; the addresses of properties you own or manage; and information about whether those properties are let and how they are occupied.

Where we are submitting a licence application, we may also hold: your date of birth; proof of identity such as a passport or driving licence; details of any proposed manager; and information about criminal convictions and offences, in the form of a suitability declaration or a criminal record check, where the local authority requires it.

Some local authorities require a declaration about whether you (or a proposed manager) have relevant criminal convictions, and some require a criminal record check. This is treated as particularly sensitive information under data protection law.

We want to be clear about three things.

We do not check, verify or assess this information. We pass it to the local authority exactly as it is given to us. Whether you are a fit and proper person to hold a licence is decided by the local authority, not by us.

We only hold it with your consent. You will have given that consent when your documents were uploaded through our portal, either by ticking our consent statement yourself or, if your managing agent uploaded them, by giving your consent to your agent, who confirms to us that you have done so. You can withdraw that consent at any time by contacting us. If you do, we will stop using this information and delete it. We cannot recover anything already sent to the local authority, and withdrawing consent will usually mean your application cannot go ahead.

We delete it quickly. Documents containing this information are permanently deleted within 30 days of us being notified of the local authority's decision, or of your application being withdrawn or closed. Copies held in our secure backups are deleted within 90 days.

We do not keep any register of criminal convictions.

Where we rely on legitimate interests, we have assessed whether our interests are outweighed by your rights, and you can ask us for that assessment.

The local authority, where we are submitting a licence application on your behalf. The local authority is a separate data controller and will handle your information under its own privacy notice.

Your managing agent, where they instructed us on your behalf.

Our service providers, who process information only on our instructions and cannot use it for their own purposes. These are Google, who host our systems and handle our email; Airtable, who hold our records of licence applications; and the platforms we use to collect and sign documents. A current list is available on request.

Our professional advisers and insurers, where necessary.

We do not sell your personal data, and we do not use it for marketing to you. Where your managing agent referred you to us for a licence application, we may pay your agent a commission for that referral. Your agent should tell you the amount.

Your personal data is stored on secure servers located predominantly in the Netherlands, with some information held in the United Kingdom, and our backups are held in the same two countries. The exception is our record of licence applications, which is held by Airtable, the service we use to track applications, in the United States.

The Netherlands is recognised under UK law as providing an adequate level of data protection, so your information receives the same protection there as it would in the UK. We do not need to put any additional transfer safeguards in place for this.

The United States does not have that recognition for all purposes, so the information we hold with Airtable is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our contract with Airtable. You can ask us for a copy of these safeguards. If we ever needed to send your information anywhere else without that recognition, we would use similar safeguards approved under UK data protection law.

You have the right to:

• Be told what we do with your information, which is what this notice is for.
• Ask for a copy of the personal data we hold about you. We will respond within one month, or tell you if we need longer because your request is complex.
• Have it corrected if it is wrong.
• Ask us to delete it, though we may not be able to where we need it to meet a legal obligation or to defend a claim.
• Ask us to restrict how we use it while a question about it is resolved.
• Object to us using it where we rely on legitimate interests.
• Withdraw your consent to us holding criminal conviction information, at any time.
• Receive it in a portable format, where we rely on your consent or on a contract with you.

We do not make any decision about you by automated means, and we do not carry out profiling of individuals.

To exercise any of these rights, contact us at hello@kammadata.com. If your request is about information we hold for licensing compliance on behalf of your agent, we will pass it to your agent, who will respond, and we will help them do so.

If you are unhappy with how we have handled your personal data, tell us at hello@kammadata.com. We will acknowledge your complaint within 30 days and investigate it without undue delay.

You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would prefer the chance to resolve it first, but you do not have to come to us before going to the ICO.

We review this notice at least annually. This version was published on 20th October 2026. Where we make a material change we will update the version date and, where the change affects you significantly, we will tell you directly.