This notice explains how Rosedoor handles personal data. Rosedoor is a property maintenance platform operated by Kolva Ltd on behalf of landlords. If you are a tenant, your landlord is the data controller for your personal data — they decided to use Rosedoor to manage their properties. Kolva Ltd acts as the data processor handling data on the landlord’s behalf. This notice describes how we handle that data and your rights under UK GDPR.
Who we are
- Operator: Kolva Ltd, a company registered in England & Wales (company no. 16921159), registered office 24 Netherwent View, Magor, Caldicot, NP26 3LG.
- ICO registration: Kolva Ltd is registered with the UK Information Commissioner’s Office, reference ZC068564.
- Contact: [email protected]
What personal data we hold
Depending on whether you are a tenant, a landlord, or a contractor, we may hold the following:
- Tenants: name, email address, phone number, property address you rent, the content of emails you send to
[email protected], photos and attachments you include, and any notes your landlord adds about a maintenance issue. - Landlords (our customers): name, email, login credentials, properties you own, financial records relating to maintenance and invoices.
- Contractors: name, email, phone, bank details for invoice payment, and the content of communications with the landlord through the platform.
We deliberately do not store payment card numbers, CVVs, full bank account numbers, national insurance numbers, or passport numbers in tenant emails. Our system scans inbound email for these patterns and redacts them before storage.
Where we got your data
If you are a tenant, we received your contact details from your landlord when they set up their properties on Rosedoor. Any maintenance correspondence comes directly from you when you email [email protected] or reply to messages we send on your landlord’s behalf.
If you are a contractor, we received your contact details from the landlord who hired you.
Why we hold it (lawful basis)
- Contract (UK GDPR Article 6(1)(b)) — for landlords, processing is necessary to deliver the Rosedoor service they have signed up for.
- Legitimate interests (Article 6(1)(f)) — for tenants and contractors, processing your contact details and correspondence is necessary so that we can coordinate maintenance on the landlord’s behalf. You can object to this processing at any time (see “Your rights” below).
- Legal obligation (Article 6(1)(c)) — financial records (invoices) are retained to meet HMRC tax record-keeping requirements (six years).
Who we share data with
We use a small number of carefully selected sub-processors to deliver the service. Each is contractually bound to process data only on our instructions and to keep it within the UK/EEA.
- Email delivery & inbound processing — handles the content and headers of emails sent to and from the platform.
- Cloud hosting & encrypted storage — holds the database and stored email attachments, in UK/EEA data centres.
- AI providers (text & image) — receive redacted email content, limited personal data (e.g. a tenant’s first name), and photos / invoice images, in order to categorise requests, draft replies, and extract descriptions and line items. Processed on EU endpoints under no-training / no-retention terms.
- Mapping & address geocoding — receives property addresses to display them on a map.
Where a provider’s parent company is based outside the UK/EEA, appropriate safeguards (the UK’s International Data Transfer Addendum or EU Standard Contractual Clauses) are in place. A current list of the specific providers is available on request.
We never sell personal data. We do not use your data for advertising, profiling, or any purpose unrelated to running the property platform.
International transfers
Some of our sub-processors have parent companies headquartered outside the UK/EEA. Although personal data is processed within the EEA on EU endpoints, some operational data (e.g. logs, billing) may be accessible from outside the UK/EEA. These transfers are protected by the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep data
- Tenant contact details and correspondence: retained while the tenancy is active and for up to three years after a tenancy ends, then redacted, unless retention is required for a specific dispute.
- Invoices and financial records: six years from the end of the financial year, in line with HMRC requirements.
- Audit and security logs: six years.
- Forensic copies of original emails and images: retained alongside the redacted versions for the same period as the underlying record, accessible only to the landlord and to Kolva Ltd for support purposes.
Cookies
Rosedoor uses only strictly necessary cookies — the session cookie that keeps your landlord signed in, and a CSRF token used to protect form submissions. We do not use analytics, advertising, or third-party tracking cookies. No consent banner is required for strictly necessary cookies.
Your rights
Under UK GDPR you have the right to:
- Request a copy of the personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to delete data we no longer have a basis to hold.
- Ask us to restrict or object to certain processing.
- Receive your data in a portable, machine-readable format.
- Complain to the Information Commissioner’s Office at ico.org.uk.
Because your landlord is the data controller, requests about tenant data are normally routed through them first. You can also contact us directly at [email protected] and we will help facilitate the request. We aim to respond within one month.
Security
Data is encrypted in transit (TLS) and at rest. Access to the platform requires authentication and two-factor verification for administrators. We keep an append-only audit log of significant actions on a tenant’s data.
Changes to this notice
We may update this notice from time to time. The “last updated” date at the top of this page will always reflect the latest version. Material changes will be communicated to landlords using the platform.