Draft for legal review. Not yet in force.
Privacy notice
Last updated: 10 November 2026
Who we are
Landlord Registration Tracker is a trading name of Barecode Limited, a company registered in England and Wales with company number 11637872. Our registered office is 8 Rushall Manor Road, Walsall, England, WS4 2HA. In this notice, "we" and "us" mean Barecode Limited.
We are registered with the Information Commissioner's Office (ICO) and pay the data protection fee. Our registration number is [TO CONFIRM: ICO registration number].
If you have a question about this notice or your data, email hello@agency.barecode.co.uk. [TO CONFIRM: whether to name a person responsible for data protection, and whether a data protection officer is needed.]
What this notice covers
This notice explains how we use personal data when we are the controller, which means we decide how and why it is used. That is the data of:
- agency owners and staff who have accounts, and agencies' billing contacts;
- visitors to our website;
- people who apply to join the beta, and people we contact about the product; and
- people who email us for support.
If you are a landlord or a landlord's contact
Letting agencies use Landlord Registration Tracker to help the landlords they act for get ready to register. If your agency has added your details, the agency is the controller of that data. We process it on the agency's behalf, under a data processing agreement. This includes your name and contact details, your properties, the certificates uploaded, the emails sent to you, the agency's call notes and its activity log.
Your agency's own privacy notice explains how it uses your data. To use your rights, please contact your agency. If you contact us instead, we will pass your request to the agency [TO CONFIRM: how quickly] and help it respond.
Landlord Registration Tracker does not ask for your date of birth, your home address (other than a correspondence address your agency already holds) or your GOV.UK One Login details. It never registers you or submits anything to the government. You register and pay on GOV.UK yourself.
Agency owners and staff
What we hold. Your name, work email address and password (stored only in scrambled, hashed form). Your two-factor and passkey settings, if you turn them on. Your role, your permissions and the agency you belong to. If you signed up from a link carrying campaign tags, such as utm_source or an ad click id, we keep those tags with your sign-up. [TO CONFIRM: that sign-ups keep campaign tags on the live site.]
Billing contacts. Stripe holds billing details and takes payment through its own pages. We never see or store card details.
What we use it for.
- To run your account and keep it secure.
- To send service emails, such as sign-up and password emails, staff invitations, trial reminders, payment notices, export links and notices before an agency's data is deleted.
- To take payment and keep our accounts.
- To give support.
Lawful basis. For the agency owner who signs up, performing our contract with the agency. For staff, our legitimate interest in providing the service the agency has bought. For accounting records, our legal obligations. [TO CONFIRM: the lawful bases, since staff are not party to the contract.]
What you do in the app. Your actions are recorded in your agency's activity log. That log belongs to your agency, which is its controller.
How long we keep it. For as long as your agency's account exists. When your agency is deleted or purged, every staff account goes with it. [TO CONFIRM: what happens to a staff account when an owner removes it, and how long we keep our own invoices and accounting records.] Stripe keeps payment records under its own retention.
Website visitors
We use cookie-free analytics, [TO CONFIRM: Plausible or Fathom], to count visits. It sets no cookies and collects no personal data. It runs on our public pages only. Our cookie notice lists the few cookies we do use.
Campaign tags in a link you follow are read from the page address only. We store them only if you sign up or apply to the beta.
[TO CONFIRM: whether our web server logs record IP addresses, and how long those logs are kept.]
Fonts are served from our own server, not from a third-party font service.
Beta applicants
What we hold. What you tell us on the beta form [TO CONFIRM: the fields on the form], and any campaign tags on the link you arrived from.
What we use it for. To consider your application, run the beta, arrange feedback calls and apply any free period offered to beta testers.
Lawful basis. Steps you ask us to take before a contract, and our legitimate interest in testing the product with real agencies. [TO CONFIRM: lawful basis for beta applicants.]
How long we keep it. [TO CONFIRM: retention for beta applications, accepted and not.]
Letting agencies we contact about the product
We keep a list of letting agencies we may approach, with their business contact details. We take these from public sources: Companies House, the member lists of the letting agent redress schemes, and agencies' own websites. [TO CONFIRM: the exact details kept, for example agency name, business address, and the name and work email of a director or member of staff.]
How we contact you. We email limited companies and LLPs, with a way to opt out in every message. We contact sole traders and partnerships only with their consent.
Lawful basis. Our legitimate interest in telling letting agencies about a product that helps with a new legal duty. You can object at any time, and we will stop.
Opt-outs. If you opt out, we keep a hashed copy of your contact details, so that we never contact you again even after the rest of your details are deleted.
How long we keep it. If you do not reply, we delete your details after 12 months. [TO CONFIRM: how long we keep details of agencies that reply or become customers.]
[TO CONFIRM: that our first message to each agency links to this notice and says where we found its details.]
Support emails
What we hold. Your name, email address and what you write to us.
What we use it for. To answer you, fix problems and improve the service.
Lawful basis. Our legitimate interest in supporting our customers.
How long we keep it. [TO CONFIRM: retention of support emails, and which service hosts our inbox.]
If your email includes landlords' details, we treat them as your agency's data, under the data processing agreement.
Who we share data with
We use these service providers. [TO CONFIRM before publishing: the whole list below.]
| Provider | What for | Where | Notes |
|---|---|---|---|
| DigitalOcean | Server hosting | London, UK | |
| Resend | Email delivery | United States | A US company. [TO CONFIRM: UK IDTA/addendum] |
| Stripe | Payments and billing | [TO CONFIRM: Stripe entity and location] | Stripe also uses some data for its own purposes, such as preventing fraud, under its own privacy policy. [TO CONFIRM: Stripe's role for those purposes] |
| Laravel Nightwatch, run by Laravel | Application monitoring | EU region | Sent with personal data removed: users as ids only, and no IP addresses, tokens or email addresses |
| [TO CONFIRM: Plausible or Fathom] | Website analytics | [TO CONFIRM: location] | No cookies, no personal data |
| postcodes.io | Finding a property's region from its postcode | [TO CONFIRM: location] | Only a property's postcode is sent |
[TO CONFIRM: whether to list the object storage provider for documents, the service hosting our own email, and the server management service.]
We may also share data with our professional advisers, with a buyer of our business, or with authorities where the law requires it. We never sell personal data.
Transfers outside the UK
Our servers are in the UK. Resend is a US company, so emails pass through the United States. [TO CONFIRM: UK IDTA/addendum.] Laravel Nightwatch uses its EU region, and the UK treats the EU as giving adequate protection. [TO CONFIRM: the safeguards for Laravel and Stripe.]
Keeping data secure
- Staff can turn on two-factor sign-in and passkeys. Our own platform admins must use two-factor sign-in.
- Data is hosted in the UK.
- Documents are kept in private storage and downloaded through short-lived signed links. Every download is logged.
- Our support team can view an agency's account read only, for up to 60 minutes per session, after giving a reason. The agency can see each session in its activity log.
- [TO CONFIRM: encryption at rest.]
Your rights
You have the right to:
- ask for a copy of your data;
- ask us to correct it;
- ask us to delete it;
- ask us to limit how we use it;
- object to how we use it, including an absolute right to stop marketing;
- ask for your data in a portable form; and
- withdraw consent, where we rely on it.
Email hello@agency.barecode.co.uk. We will reply within one month. If you are unhappy, you can complain to the ICO at ico.org.uk. We would like the chance to help first.
Automated decisions
We do not make decisions about you with legal or similarly significant effects by automated means alone.
Changes to this notice
The date at the top shows when this notice last changed. We will tell agency owners by email about significant changes. [TO CONFIRM: how and when changes are announced.]