Privacy notice

Who we are

BeCert is an independent service based in England. It is not part of GOV.UK or any council.

We have two roles under UK data protection law (ICO: controllers and processors):

• Controller for your account: your name, email address, sign-in details, plan and billing history, and how you use the app.
• Processor for the property and tenant details you add. You are the controller of that information, and we only use it to provide BeCert to you, under the data processing terms in our Terms.

What we collect

We collect only what reminders and your compliance records need.

• Your account: name, email address, how you sign in (a one-time email code), and the devices you've signed in on.
• Your properties: address and postcode, property type, how it's let, and the certificates and checks you track, with their dates and the documents you upload.
• Tenancies: optional tenant name, tenancy dates, rent, deposit amount, scheme and reference, and the dates checks were done.
• Billing: your plan and payment history. Card details go straight to our payment provider; we never see or store them.
• Security records: sign-in times, device type and IP address, to protect your account.

We never ask for tenants' bank details, dates of birth, National Insurance numbers or copies of ID documents. For Right to Rent, record only the date you checked. Please don't add health or other sensitive details about tenants in notes.

Why we use it, and our lawful basis

• To run your account and send your reminders: to perform our contract with you.
• To keep accounts secure and prevent misuse: our legitimate interest in protecting you and the service.
• To take payment and keep tax records: contract, and our legal obligation to keep accounting records.
• To email you news or offers: only if you opt in. You can opt out in Settings or from any email.

These are lawful bases set out by the ICO. We never sell your information or use it for advertising.

Who we share it with

We use a small number of suppliers who process data for us under written contracts, as UK law requires (UK GDPR Article 28):

• hosting and database (in the UK or EU)
• email delivery for reminders and sign-in codes
• payments

The named suppliers and where each stores data: [SUPPLIER LIST, CONFIRMED AT LAUNCH].

We only share information otherwise if the law requires it, or with your instruction, for example a share link you create for a lender or council.

Where it is stored

We store and process your information in the UK or the European Economic Area. If a supplier ever needs to process it elsewhere, we will use a safeguard approved under UK law, such as the International Data Transfer Agreement (ICO: international transfers).

How long we keep it

• Certificates: for as long as your account is open, so you can meet your own record-keeping duties. For example, landlords must keep gas safety records for at least 2 years (HSE) and the electrical safety report until the next inspection (regulation 3). You can delete anything at any time.
• Tenant details: we prompt you to delete them 12 months after a tenancy ends.
• Closed accounts: deleted 30 days after you close your account, giving you time to download your data. Backups are overwritten within 35 days after that.
• Security records: 90 days.
• Billing records: as long as tax law requires.

Your rights

You can ask to see, correct, download or delete your information, object to how we use it, or ask us to restrict it (ICO: your data protection rights). You can download everything and delete your account yourself in Settings, on the website and in the app.

If a tenant asks about information you've stored in BeCert, you handle the request as the controller, and we'll help you.

Cookies and storage on your device

• This website sets no cookies and uses no analytics or tracking.
• The app uses one cookie to keep you signed in, and stores your display preferences (such as dark mode) on your device. These are strictly necessary for the service you've asked for, so they don't need consent (ICO: exceptions).

How we protect it

Data is encrypted in transit and at rest, documents are stored privately and only reachable through short-lived links, and staff access is limited and logged. Found a security problem? Email security@becert.co.uk. We won't take action against anyone who reports in good faith.

Questions and complaints

Contact us at help@becert.co.uk. We acknowledge data protection complaints within 30 days (ICO). If you're not happy with our answer, you can complain to the ICO.

Changes to this notice

We'll show the date of each change at the top of this page, and email you before any change that affects how we use your information.