Privacy policy
Who we are
Caution List is run by Tenvia, a trading name of HD7 Global Ltd, company number [company number], registered office [address]. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
Caution List is a secure, invite-only service that lets approved social housing providers share safety information about tenants, managing agents, referral agents and others, so that their staff and contractors can work safely and residents are protected.
For questions about this policy or your information, contact [privacy@yourdomain].
Who this policy covers
- People recorded on the caution list, such as tenants or applicants, and people connected with managing agents, referral agents, contractors or landlords.
- Staff of approved housing providers who have a login.
- People who request access using the form on our website.
- Visitors to our website.
What information we hold
People recorded on the list
Name; date of birth (tenants only); the town or city where an incident happened, or where a business operates; phone number, email address and company number for businesses; a category and risk level; a factual summary of what happened; incident dates; police or Action Fraud reference numbers and outcomes; guidance for staff; and reports and comments added by other approved providers. We do not record home addresses.
Some of this may be criminal offence data, for example police references and outcomes. We only process this where the law allows and we have an appropriate policy document in place.
Provider staff
Name, work email, job title, work phone number, the provider you work for, your two-step sign-in settings, and a record of what you do on the service (sign-ins, searches, entries viewed, added or changed).
People who request access
Your name, work email and organisation.
Website visitors
Basic technical information needed to deliver the website securely, such as your IP address, which our hosting provider processes. If we turn on visitor statistics, these are cookie-free and do not identify you.
Where the information comes from
Information about people on the list is added by approved housing providers from their own records of incidents. Information about provider staff comes from their employer and from the staff member. Access requests come from the person who submits the form.
Why we use it and our legal basis
- Keeping staff, contractors and residents safe, and preventing fraud and harm. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). For criminal offence data we rely on [condition in Schedule 1 of the Data Protection Act 2018, to be confirmed by your adviser].
- Running provider accounts, including security and the audit log. Lawful basis: legitimate interests and our agreement with each provider.
- Responding to access requests. Lawful basis: legitimate interests.
An entry is information to support a provider’s own risk assessment. Providers agree that an entry must not be the only reason for refusing someone housing or a service.
Who can see it
Only named staff at approved housing providers, after signing in with a password and a code from an authenticator app, and Tenvia. Each provider can see entries, reports and comments from every approved provider, and the contact details of the provider who added an entry. Everything people look at is recorded.
We use these service providers to run Caution List, under contracts that require them to protect your information:
- Supabase: database, logins and two-step sign-in, hosted in London.
- Netlify: website hosting.
- [email provider, for example Resend]: sending invitation and password reset emails.
- Cloudflare: cookie-free visitor statistics, only if switched on.
We may share information with the police or other authorities where the law requires or allows it.
How long we keep it
- Entries must be reviewed at least once a year. Entries not reviewed within 30 days of their review date are archived automatically and no longer shown in normal use. Archived entries are deleted after [period, for example 2 years].
- Reports and comments are kept for as long as the entry they belong to.
- Audit records are kept for [period, for example 7 years].
- Provider staff accounts are kept while access is active and for [period] after it ends.
- Access requests are kept for [period, for example 12 months].
Your rights
You have the right to ask for a copy of your information, to have it corrected, to object to us using it, and in some cases to have it deleted or its use restricted. Some rights may be limited where an exemption applies, for example where disclosure would put someone’s safety at risk or prejudice the prevention or detection of crime. If we rely on an exemption, we will tell you unless doing so would itself cause that harm.
To make a request, contact [privacy@yourdomain]. We will respond within one month. You do not have to pay.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
How we protect it
- Access only by invitation, with two-step sign-in for every account.
- Encryption in transit, and security rules in the database that limit who can see and change what.
- Automatic sign-out after a period without activity.
- A permanent audit log of sign-ins, searches, views and changes.
Cookies and storage
We do not use advertising or tracking cookies. When you sign in, your browser stores a secure session token so you stay signed in; this is strictly necessary for the service to work. We also remember that you have seen our cookie notice. If visitor statistics are switched on, they are provided by Cloudflare Web Analytics, which does not use cookies or identify you.
Transfers outside the UK
Our database is hosted in London. Some service providers may process limited information, such as technical data or emails, outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the ICO’s International Data Transfer Agreement.
Changes to this policy
We will update this page if anything changes and show the date at the top.