Privacy notice
Thrice Property Solutions Privacy Notice (November 2026). This notice explains what personal data 8Thrice Property Solutions Ltd, trading as Thrice Property Solutions, collects about tenants, applicants, guarantors, landlords, holiday guests and website visitors, why, who it is shared with, how long it is kept and what rights you have. It is written to the standard set by the Information Commissioner’s Office for a privacy notice under Articles 13 and 14 of the UK GDPR and is the notice referred to in our tenancy agreements.
1. Who we are and how to contact us
8Thrice Property Solutions Ltd, trading as Thrice Property Solutions, is the data controller for the personal data described in this notice. We are registered in England and Wales, company number 13188747, registered office Unit 4 Clifford Court, Cooper Way, Carlisle, Cumbria CA3 0JG, trading address 1 Marine Drive, Paignton, Devon TQ3 2NJ. We are registered with the Information Commissioner’s Office (ICO) under registration ZB176165.
Our data protection lead is Joshua Davies, Managing Director. For anything to do with your personal data, including requests to use your rights or a complaint about how we have handled your data, contact us by email at info@thrice.uk, by telephone on 07507 719961 (Monday to Saturday, 8am to 8pm), or by post to the registered office above. Please put “Data protection” in the subject line or on the envelope so it reaches the right person quickly.
This notice applies to everyone whose personal data we handle: people who enquire about a room or a property, applicants and their guarantors, tenants and other occupiers, emergency contacts, landlords and property owners who use our services, guests who stay in our holiday apartment, contractors, and visitors to thrice.uk. Where a property is owned by someone other than us and we manage it for them, the owner is a separate controller of the information they need to meet their own legal duties as landlord, and we share with them only what that requires. Where we take a lease of a property ourselves under our Guaranteed Rent service, we are your landlord and the only controller you need to deal with.
This notice was last updated on 7 November 2026 and replaces the 2023 Personal Data Privacy Notice. It is the privacy notice referred to in Addendum A of our tenancy agreements and in our application form.
2. The personal data we collect and where it comes from
Most of what we hold comes from you: your enquiry, your application form, the documents you show us, the tenancy or management agreement you sign, and your messages to us through the COHO app, email, telephone or WhatsApp. Some comes from other people, and we say so below.
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Enquirer (website form, telephone, SpareRoom, OpenRent or other portal) | Name, email address, telephone number, the property or room you are asking about, your message | You, or the portal you enquired through |
| Applicant for a room or property | Name, date of birth, nationality, photographic identity document, current and previous addresses, employment and income details, bank statements, previous landlord’s details, emergency contact, whether you have pets or will have a child living with you, and anything else you choose to tell us on the application form | You; your employer, previous landlord or accountant when we check references; our referencing provider (see section 9) |
| Guarantor | Name, contact details, identity document, address, income and credit information | You, and the referencing checks |
| Tenant or occupier | Everything above, plus the signed tenancy agreement and addenda, the written statement of terms, right to rent check records, holding deposit and deposit records, rent ledger and payment records, inventory and inspection reports with photographs, maintenance requests, complaints, messages in COHO, correspondence about arrears, notices and any court papers, and the names of any permitted occupiers or visitors you tell us about | You, our inspections and visits, the Home Office right to rent service, the Deposit Protection Service, contractors who attend, and the landlord of the property |
| Emergency contact or next of kin | Name, relationship to the tenant, telephone number | The tenant who nominated you (we tell them to let you know) |
| Landlord or property owner | Name, address, email, telephone, company details, proof of ownership and identity, HMO licence and safety certificate details, insurance details, bank account for rent remittance, tax status (for example whether you live abroad), the agreement between us, statements and correspondence | You; HM Land Registry and Companies House; the local authority licensing team; contractors |
| Holiday apartment guest (Apartment Harmony, Torquay) | Name, contact details, dates of stay, number of guests, the booking and payment record, and any messages. If you book through Airbnb, Airbnb is a separate controller of the data it holds and shares with us only what the booking needs | You, or Airbnb |
| Contractor or supplier | Name, trade, contact details, insurance and qualification evidence, invoices, the jobs you attend | You |
| Website visitor | Technical data such as IP address, browser and device type, pages visited and the time of your visit, collected through cookies as described in section 8 | Your browser, through Squarespace |
Sensitive information. We do not ask for special category data as a matter of course. We may hold it where you tell us, or where it is needed to look after you properly: for example a disability that needs an adjustment to the property, a health or safeguarding concern, an allegation of antisocial behaviour, or a police or court matter. Where that happens we record only what is needed, keep it to the people who need to know, and rely on the conditions in section 3. Right to rent checks record your immigration status because the law requires us to check it; we do not use that information for any other purpose.
Where providing information is a legal or contractual requirement. You do not have to give us anything. But we cannot grant a tenancy without the identity and right to rent documents the law requires, we cannot offer you a room without the information we need to assess affordability and references, and we cannot protect your deposit without your name and contact details. If you choose not to provide something, we will tell you what the consequence is at the time.
CCTV. Cameras operate at some of the houses we manage (at Ashdown Lodge, Exeter and 12 and 14 Morton Road, Exmouth at the date of this notice). They cover entrances, exits and some communal areas only, never bedrooms, bathrooms or kitchen interiors, and record no audio. The cameras, their coverage and the 30-day retention period are set out in Addendum A of the tenancy agreement for each property and on the signage at the property.
3. Why we use your data and our lawful bases
We only use personal data where the UK GDPR gives us a lawful basis. The table shows each purpose and the basis we rely on. Where the basis is our legitimate interests, we have weighed that interest against your rights and you can object (section 7).
| What we do | Lawful basis (UK GDPR Article 6) |
|---|---|
| Answer your enquiry and arrange a viewing | Steps at your request before entering into a contract, Article 6(1)(b); for landlord enquiries, our legitimate interest in running the business, Article 6(1)(f) |
| Assess your application: identity, affordability, references, credit and open banking checks, guarantor checks | Steps at your request before entering into a contract, Article 6(1)(b); legitimate interests in letting responsibly, Article 6(1)(f) |
| Carry out and record right to rent checks | Legal obligation, Article 6(1)(c): Immigration Act 2014 |
| Grant and manage your tenancy: the agreement and written statement of terms, rent collection, statements, inspections, repairs, communication through COHO, dealing with complaints and disputes | Performance of the contract, Article 6(1)(b) |
| Take, protect and return deposits, and provide the prescribed information | Legal obligation, Article 6(1)(c): Housing Act 2004 and Tenant Fees Act 2019 |
| Meet HMO licensing, management and safety duties, including giving the council the information its licence conditions and inspections require, and keeping safety certificates | Legal obligation, Article 6(1)(c): Housing Act 2004 and the Management of Houses in Multiple Occupation (England) Regulations 2006 |
| Give tenants the landlord’s name and address, and register properties and landlords on the Private Rented Sector Database when it goes live | Legal obligation, Article 6(1)(c): Landlord and Tenant Act 1985 and 1987, Renters’ Rights Act 2025 |
| Recover rent arrears and other sums due, serve notices and bring or defend court proceedings | Performance of the contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f); Article 9(2)(f) and Schedule 1 of the Data Protection Act 2018 for any special category or criminal offence data involved |
| Operate CCTV at the properties named in section 2 | Legitimate interests, Article 6(1)(f), assessed in a data protection impact assessment for each property |
| Make reasonable adjustments for a disability, and act on a safeguarding or welfare concern | Legal obligation, Article 6(1)(c): Equality Act 2010; special category data under Article 9(2)(b) with Schedule 1 paragraph 1 of the Data Protection Act 2018, or Article 9(2)(g) with Schedule 1 paragraph 18 (safeguarding), or your explicit consent, Article 9(2)(a) |
| Manage properties for landlords: remit rent, report, arrange works, deal with licensing and compliance on their behalf | Performance of the contract with the landlord, Article 6(1)(b) |
| Take and manage holiday bookings for Apartment Harmony | Performance of the contract, Article 6(1)(b) |
| Keep accounting and tax records | Legal obligation, Article 6(1)(c): Companies Act 2006 and tax law |
| Hold client money in a protected client account and maintain our professional memberships | Legal obligation, Article 6(1)(c): Client Money Protection Schemes for Property Agents (Requirement to Belong to a Scheme etc.) Regulations 2019 |
| Respond to Property Redress, the ICO, a court or the police | Legal obligation, Article 6(1)(c), or legitimate interests, Article 6(1)(f) |
| Protect our systems and prevent fraud | Legitimate interests, Article 6(1)(f) |
| Analytics cookies on thrice.uk | Your consent, given through the cookie banner, which you can withdraw at any time |
| Contact landlords who have asked about our services | Legitimate interests, Article 6(1)(f); you can ask us to stop at any time |
We do not sell personal data, we do not use it for automated decisions with legal effects (section 9), and we do not send marketing to tenants or applicants. If we ever want to use your data for a new purpose, we will tell you first and, where the law requires it, ask for your consent.
4. Who we share your data with
We share personal data only where it is needed for the purposes in section 3, and only the data that purpose needs. Our processors act on our written instructions under a data processing contract; the others listed are separate controllers who handle your data under their own privacy notices.
| Recipient | What they receive and why |
|---|---|
| COHO (our property management platform and tenant app) | Applicant, tenant, landlord and contractor records, messages, documents, rent ledgers, inspection photographs and e-signatures. COHO stores and processes this on our behalf |
| Vouch, our tenant referencing partner, and the credit reference and open banking providers it uses | Applicant and guarantor identity, address, employment and financial information, to produce a referencing report |
| The Home Office online right to rent service | Your share code and date of birth, to confirm your right to rent where you hold digital immigration status |
| The Deposit Protection Service (our agent account 4372823) | Tenant names, contact details, tenancy address and deposit amount, to protect the deposit and run its dispute service |
| The landlord of the property you rent, where that is not us | Your name, the tenancy terms, rent payments and anything the owner needs to meet their legal duties, such as a licensing or insurance requirement |
| Contractors, cleaners and safety engineers attending the property | Your name, the room, the access arrangements and the nature of the job |
| Local authorities (Exeter City Council, East Devon District Council, Torbay Council and, as we grow, others), including housing standards, HMO licensing, environmental health and council tax teams, and the waste collection operator for the property | Occupier names and tenancy dates where a licence condition, inspection or council tax enquiry requires it |
| Utility, broadband and other service suppliers to the property | Usually nothing, because the accounts are in our name; occasionally your name where a supplier needs it to provide a service to your room |
| Debt collection agencies, tracing agents and solicitors | Your name, last known contact details and the sums due, only if rent or other charges remain unpaid after our own process |
| Property Redress (our redress scheme, membership PRS057121), the ICO, the courts, the police and other enforcement bodies | What a complaint, investigation, claim or lawful request requires |
| Our insurers, accountants, bookkeepers and legal advisers | What a claim, audit, return or piece of advice requires |
| Squarespace, Google Workspace and our telephone and messaging providers | Enquiry form submissions, email and messages, as the systems that carry them |
| Airbnb | Booking and messaging data for the holiday apartment, where you booked through Airbnb |
| A buyer or successor of the business | Your records, if we sell or transfer the business or a property portfolio, so that your tenancy continues without interruption |
We do not share tenant data with marketing companies or data brokers, and we never publish a tenant’s personal data on our website or social media.
5. Where your data is stored and international transfers
Our records are held in COHO, in Google Workspace (email and files), in our accounting software and in the Deposit Protection Service’s system, with paper copies of signed documents kept securely at our trading address where we hold them at all. Access is limited to the people who need it for their role, protected by individual logins and two-factor authentication where the system offers it, and CCTV recorders are kept locked and password protected at the property.
Some of our suppliers process data outside the United Kingdom. Squarespace (website forms) and Google (email) are United States companies; transfers to them are covered by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) or by standard contractual clauses with the ICO’s UK Addendum, as set out in each supplier’s data processing terms.
Part of our tenant administration (answering routine queries, chasing documents, logging maintenance requests) is carried out by a member of our team who works from the Philippines and who accesses COHO and our team email account. That is a restricted transfer under the UK GDPR. We rely on the ICO’s International Data Transfer Agreement in our contract with that team member, together with a named user account, two-factor authentication and access limited to what the role needs. No tenant data is stored on devices outside the United Kingdom beyond what that access requires.
If you would like more detail about any of these safeguards, contact us at info@thrice.uk.
6. How long we keep your data
We keep personal data only for as long as the purpose needs it or the law requires, then delete or anonymise it. Our standard periods are:
| Record | How long we keep it | Why |
|---|---|---|
| Enquiries that do not lead to an application | 6 months from the last contact | So we can answer follow-up questions, then deleted |
| Applications that are unsuccessful or withdrawn, including referencing reports and guarantor details | 6 months from the decision | To deal with any query or complaint about the decision, including under the Equality Act 2010 |
| Holding deposit records | 6 years from the date the holding deposit was dealt with | Tenant Fees Act 2019 and the Limitation Act 1980 |
| Tenancy agreements, written statements of terms, rent ledgers, deposit records, inventories, inspection reports, maintenance and correspondence | 6 years from the end of the tenancy | The Limitation Act 1980 limitation period for contract claims, and tax and company record keeping |
| Right to rent check records | The length of the tenancy plus 1 year | The Home Office code of practice on right to rent checks |
| CCTV footage | 30 days, then overwritten, unless it has been extracted for an incident, claim, request or investigation | Addendum A of the tenancy agreement and the property’s data protection impact assessment |
| Landlord client records, management agreements and statements | 6 years from the end of the agreement | Contract limitation period, client money and tax record keeping |
| Holiday apartment bookings | 6 years from the stay | Tax record keeping |
| Accounting records | 6 years from the end of the financial year they relate to | Companies Act 2006 and HMRC requirements |
| Website analytics data | As set by the cookie (see section 8), and no longer than 26 months | Squarespace’s analytics retention |
| Records of a data protection complaint or rights request | 6 years from closure | To show how it was handled |
Where a record is needed for a live dispute, claim or investigation, we keep it until the matter is closed and any appeal period has passed, then apply the period above.
7. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you, and receive a copy of it (a subject access request);
- rectification of data that is inaccurate or incomplete;
- erasure of your data in certain circumstances, for example where we no longer need it;
- restriction of our processing while a dispute about accuracy or lawfulness is resolved;
- data portability: to receive the data you gave us, in a machine-readable format, where we process it by automated means on the basis of contract or consent;
- object to processing based on our legitimate interests, including CCTV, and to any direct marketing;
- withdraw consent at any time where consent is the basis we rely on, for example analytics cookies;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (see section 9);
- complain to us and to the ICO.
To use any of these rights, email info@thrice.uk or write to the registered office. We will confirm your identity, respond within one month, and extend that by up to two further months only if a request is complex, telling you why. There is no charge unless a request is manifestly unfounded or excessive. If we refuse a request we will explain the reason and your options.
Complaints. If you are unhappy with how we have handled your personal data, please tell us first at info@thrice.uk or by post; you can also use our complaints procedure at thrice.uk/complaints. We will acknowledge a data protection complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome, as the Data (Use and Access) Act 2025 requires. You also have the right to complain to the Information Commissioner’s Office at any time: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint.
8. Cookies and the website
thrice.uk is built on Squarespace. When you visit, Squarespace sets a small number of essential cookies that make the site work (for example to remember your cookie choice and keep the site secure). These do not need your consent. With your consent, given through the banner when you first visit, we also use Squarespace Analytics cookies to understand which pages are read and where visitors come from; the information is aggregated and we do not use it to identify you. You can decline analytics cookies in the banner, and change your choice at any time through the “Cookie preferences” link in the footer of every page. We do not use advertising or social media tracking cookies.
Enquiry forms. When you send a form on the Landlords, Renters, Investors or Contact pages, Squarespace stores the submission and emails it to us. We use the details to reply to you and, if you go on to apply or instruct us, add them to your record. We keep enquiry submissions for six months if nothing comes of them (section 6).
Holiday apartment bookings. The booking request form on the Bookings page collects your name, contact details, dates and party size so that we can confirm availability and the price. Payment is taken through the payment method we agree with you, and we do not store card numbers. If you book through Airbnb instead, Airbnb’s own privacy policy applies to what you give Airbnb.
Links. The site links to Airbnb, Google, social media and other third-party sites. Their privacy notices apply once you leave thrice.uk.
Children. The site and our services are for adults; we do not knowingly collect data from anyone under 18, other than the names of children who will live in a property, which a parent gives us.
9. Referencing and automated decisions
When you apply for a room we ask Vouch, our referencing partner, to check your identity, your address history, your credit record (including county court judgments and insolvency), your income and your previous landlord or employer references. Where you agree, income can be verified through an open banking connection to your bank instead of bank statements; the connection is read-only, you choose it, and it can be withdrawn. Vouch and the credit reference agencies it uses are separate controllers for the checks they run, and their notices explain how they keep the search records.
The referencing report uses automated tools, but no decision about your application is made by automated means alone. A member of our team reads every report and makes the decision, taking into account anything you have told us, and we treat every applicant on the same basis: we do not refuse applicants because they have children or receive benefits. If a report contains something you think is wrong, tell us and we will ask for it to be checked and reconsider. You also have the right to ask for a human review of any decision you believe was automated, to put your point of view and to contest it.
We do not use profiling for marketing, and we do not use artificial intelligence tools to make decisions about tenants, applicants or landlords.
10. Changes to this notice
We review this notice at least once a year and whenever our processing, our suppliers or the law change. The current version is always at thrice.uk/privacy, and tenants are sent any material change through COHO. Earlier versions are available on request.