Privacy Policy

1 Who We Are

Ready2Rent is operated by Ready 2 Rent ("we", "us", "our"), registered in the Isle of Man at Rheast-Twoaie, Ballacorey Road, Bride, Isle of Man, IM7 4AW. For the purposes of the Isle of Man Data Protection Act 2018, we are the data controller for the personal data described in this policy.

2 Personal Data We Collect

Depending on how you use Ready2Rent, we may collect:

Identity data — name, date of birth, and a photo identity document (passport, driving licence, or equivalent)
Verification photo — a selfie taken during your application, used to confirm it matches your identity document
Address data — proof of your current address
Financial data — bank statements (last 3 months) and payslips or equivalent proof of income
Background check data — a Basic DBS certificate, if you choose to provide one
Referee data — names and contact details of an employer, landlord, and/or character referees you nominate
Contact data — your email address, used for account access, reminders, and service communications
Landlord account data — if you register as a landlord or agent: your name and personal or business address
Payment data — handled directly by Stripe (see Section 6); we do not receive or store your full card details
Technical data — your IP address, captured for account security, fraud prevention, and audit logging

We do not knowingly collect any personal data beyond what is described in this policy, and we do not collect special category data (e.g. health, religion, sexual orientation) as part of the ordinary vetting process.

3 How We Collect It

Almost all personal data we hold is provided directly by you, by uploading documents and entering details into the Ready2Rent application form. Referee contact details are provided by the applicant, who confirms they have the referee's permission for us to make contact (see our Terms of Service, Section 6). Technical data such as your IP address is collected automatically when you use the service.

4 Why We Process Your Data, and Our Legal Basis

Purpose	Legal basis
Reviewing and verifying your application documents	Performance of a contract with you
Generating an indicative affordability estimate	Performance of a contract with you
AI-assisted extraction of a payslip/bank statement when local extraction fails	Performance of a contract with you
Contacting your nominated referees	Performance of a contract with you, on the basis of the permission you confirm you hold
Sharing a cropped photo with a referee to confirm identity	Your explicit consent, confirmed by our team before any sharing occurs
Processing landlord credit purchases and extension fees	Performance of a contract with the paying party
Security logging, fraud prevention, audit trail	Our legitimate interests in keeping the service secure and trustworthy
Referring suspected forged or fraudulent documents to authorities	Legal obligation / our legitimate interests and those of third parties
Keeping financial records of payments received	Legal obligation (accounting and tax law)

5 Automated Decision-Making

Where we show an estimated affordable rent range, it is calculated using an automated, industry-standard income-multiple method — but this figure is always reviewed by a member of our team before it is shown to you or shared with a landlord. We do not make any solely automated decision about you that has a legal or similarly significant effect, and no decision about whether to grant you a tenancy is ever made by us — that decision rests entirely with the landlord or agent you choose to share your passport with.

6 Who We Share Your Data With

We never share your application documents or data with any landlord, letting agent, or other outside party on our own initiative, other than the processors listed below in this section, who act only on our instructions to help us deliver the service to you and are not permitted to use your data for their own purposes. Outside of Ready2Rent and those processors, your data is only ever seen by someone when you personally choose to generate and share a passport link with them. See our Terms of Service, Sections 8–9, for full detail.

We use a small number of processors and service providers to run Ready2Rent:

Stripe — processes landlord credit purchases and passport extension payments. When you pay, you are redirected to Stripe's own secure payment page; we never receive or store your full card details. Stripe is a PCI-DSS Level 1 certified payment processor and acts as an independent data controller for the payment data it collects — see stripe.com/privacy.
Document processing (OCR) — where a payslip or bank statement needs text extraction, we first attempt this using OCR software running locally on our own servers, with no third party involved.
Anthropic (AI-assisted verification) — if local extraction cannot read a payslip or bank statement, a member of our verification team may manually send that specific document to Anthropic's Claude AI model to extract the income figures needed to complete your check. This sends the document itself, not just extracted text, to Anthropic for processing. Anthropic is a US-based AI provider; under its standard commercial API terms, data submitted this way is not used to train its models. See anthropic.com/legal/privacy. This step is used only where needed to verify your application.
Email delivery — application reminders, referee requests, and account emails are sent from our own mail infrastructure, not a third-party bulk-email provider.

We do not sell your personal data, and we do not use any third-party advertising or analytics services on Ready2Rent.

7 International Transfers

Your application data is hosted on servers operated by our hosting provider, IONOS SE, located in Spain. As Spain is a European Union member state operating under UK/EU-equivalent data protection standards, this does not reduce the level of protection your data receives. Stripe may also process payment data outside the Isle of Man as part of its global payment infrastructure, and Anthropic (see Section 6) may process a specific document outside the Isle of Man when AI-assisted verification is used. Stripe and Anthropic each maintain their own cross-border transfer safeguards (including standard contractual clauses where applicable) as described in their respective privacy policies.

8 Data Retention

Full detail on how long we keep your data is set out in our Terms of Service, Section 7. In summary: your documents and application data are held for a minimum of 90 days from submission, extendable to a combined maximum of 270 days, and are automatically and permanently deleted when your passport expires. Referee email addresses are not retained beyond that point. Landlord account data is retained for as long as the account remains active, plus a reasonable period afterwards for accounting records.

9 How We Protect Your Data

Your documents and personal data are protected by several independent layers of security, not a single measure:

Encryption at rest. Every document is individually encrypted with AES-256-GCM before it is stored, each with its own unique encryption values — a single compromised file cannot be used to unlock any other applicant's documents.
Encryption in transit. All data is transmitted only over TLS-encrypted connections, on servers operated by our EU-based hosting provider (see Section 7).
Multi-factor, IP-restricted staff access. Viewing an applicant's documents requires all three of: a password, a separate one-time passcode from an authorised device, and a connection from a pre-approved location. Connections outside that allowlist never reach the login form at all.
Audit logging. Every access to an applicant's file, and every deletion, is written to an internal audit log we can review — access is not just restricted, it is recorded.
Automatic, unattended retention enforcement. Deletion of data past its retention period (Section 8) is carried out by a scheduled automated process, not a manual step someone has to remember to do.
Automated abuse protection. Repeated failed logins or abusive request patterns are automatically detected and the source blocked.
No public exposure path. Applicant documents are held entirely outside the parts of our infrastructure that serve the public website — there is no URL that can be guessed, scanned, or requested to reach them directly.

No method of storage or transmission can be guaranteed 100% secure, and we don't claim otherwise — but these measures are designed so that no single failure, mistake, or stolen password is enough on its own to expose your documents.

If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the Isle of Man Information Commissioner without undue delay where required by law, and will notify affected individuals directly where the breach is likely to result in a high risk to them.

10 Cookies

Ready2Rent uses only strictly necessary cookies — for example, to keep you signed in and to protect forms against cross-site request forgery. These cookies are essential to the service functioning and cannot be disabled while still using Ready2Rent. We do not use any advertising, analytics, or third-party tracking cookies.

When you are redirected to Stripe to make a payment, Stripe may set its own cookies on its own domain under its own privacy policy, outside of our control.

11 Children

Ready2Rent is not directed at, and must not be used by, anyone under 18. We do not knowingly collect personal data from children.

12 Your Rights

Under the Isle of Man Data Protection Act 2018, you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Erasure — request deletion before your passport expires
Restrict processing in certain circumstances
Object to processing carried out on the basis of our legitimate interests
Portability of your data in a machine-readable format
Withdraw consent at any time, where processing is based on consent (for example, referee photo sharing), without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at dataaccess@ready2rent.im. We will respond within one calendar month.

If you are unsatisfied with our response, you may complain to the Isle of Man Information Commissioner: www.inforights.im

13 Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or in the law. Material changes will be reflected in the "Last updated" date above. We will not retroactively apply a materially reduced level of protection to data we already hold without your consent.