Privacy Policy

1. Who we are

Tendmere is a trading name of Down the Cove Group Ltd (Company No. 16784991), a company registered in England and Wales with its registered office at 18 Bond Street, Leeds, LS15 8GE (“Tendmere”, “we”, “us”). We operate the Tendmere property management application and website at tendmere.com. We act as a data controller for the personal data described in this notice.

Down the Cove Group Ltd also operates the Down the Cove retail brand at downthecove.com. Personal data collected through Tendmere is processed on separate infrastructure and is not shared with, accessible to, or combined with data from the retail business. This notice covers only Tendmere.

For data protection queries, contact us at privacy@tendmere.com.

2. What data we collect

Account information

• Name, email address, and password (hashed)
• Release-access status. Paid checkout is not enabled in this release, so Tendmere does not currently collect new payment-card or subscription-purchase data.

Property and tenancy data

• Property addresses, values, and details you enter
• Tenant names, contact details, and lease information
• Rent payments, expenses, and financial records
• Compliance certificates and document uploads

Banking data

• Transaction data you add manually or import by CSV, including amounts, dates and references
• Automatic Open Banking connections are not enabled in this release, and Tendmere does not receive or store bank login credentials

Usage data

• Pseudonymous page-view and feature events via PostHog (EU-hosted), disabled until you opt in and not linked to your Tendmere account identity
• Opted-in analytics use a random device-scoped distinct identifier; Tendmere does not send account user ID, email, property or tenant identifiers, or record contents
• Limited campaign parameters from a signup link, such as UTM tags or an advertising click identifier, may be recorded with signup so we can understand where an account came from; optional Google Ads measurement is sent only after consent
• Device type and browser for compatibility purposes

3. How we use your data

• To provide and maintain the Tendmere service
• To help you reconcile rent records you enter or import
• To send compliance reminders and notifications you have enabled
• To generate tax review packs and digital records; production submission to HMRC is not enabled
• To improve our product from pseudonymous, account-unlinked usage events, only after analytics consent
• To measure whether an advertisement led to a visit or signup, only after measurement consent where third-party measurement is involved
• To respond to support queries

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing

• Contract: Processing necessary to provide the service you signed up for
• Legitimate interest: Security, diagnostics and responding to support enquiries
• Legal obligation: Responding to valid legal requests
• Consent: Pseudonymous product analytics, optional advertising measurement and marketing emails (each opt-in only and reversible)

4a. Tenant messaging

Landlords, agents and tenants can exchange operational messages in Tendmere. Each sender chooses whether a tenant message is private to them or shared with the tenancy, and access is enforced against the user’s current workspace and tenancy role. Outbound transactional email may be used for account, invitation and notification delivery.

Inbound email replies are disabled in this release. A message received by email cannot be assumed to appear in Tendmere; users should open the app to reply. We will not advertise email-to-thread replies until the inbound provider credential, signature verification, routing and production acceptance checks are complete.

Marketing or promotional content is never mixed into tenant operational messages. Tenants can request a copy of their data or opt out of non-essential messages at any time via /legal/data-request.

5. Data storage and security

Tendmere’s core application, database and object storage run on dedicated EEA infrastructure. Connections use TLS 1.2 or higher, stored data and backups are encrypted, and row-level access controls restrict records by workspace, role, property and tenancy scope. Encrypted offsite backups are held in a separately controlled repository.

6. Data sharing

We share data only with:

• Hetzner: Dedicated EEA hosting for the core application, database and files
• Resend: Outbound transactional email; inbound email replies are disabled in this release
• Expo, Apple and Google: Mobile push delivery when notifications are enabled
• PostHog: EU-hosted, opt-in product analytics without record contents
• Google: Opt-in advertising visit and conversion measurement, when configured; personalised advertising and advertising user-data sharing are disabled, and property or tenant record contents are not sent
• Sentry: Crash and diagnostic reporting configured for its EU region
• Your accountant: Only if you grant them a finance-scoped workspace role
• Planned referral providers: Canopy, Simply Business, London & Country and compliance-booking partners do not receive Tendmere data in this release because their handoffs are disabled. Any future handoff will require a clearly labelled, deliberate user action and an updated disclosure before data leaves Tendmere.

Some optional processors, including mobile push and crash-reporting providers, may process limited data outside the UK or EEA. Where that happens, the applicable processor terms and a lawful UK transfer mechanism must cover the transfer. Paid billing, automatic bank feeds and production HMRC submission are disabled in this release.

6a. Planned referral partners

Referral-provider handoffs and commissions are disabled in the current release. Tendmere does not send partner orders, pre-fill provider forms, confirm purchases by webhook, or receive a referral fee today.

• Canopy — UK tenant referencing is planned but not available. Tendmere can record manually supplied referencing evidence and decisions; it does not currently order a provider check or transfer applicant data.
• Simply Business — landlord-insurance introduction is planned but not available. Tendmere does not provide quotes, advice, policy sales or a live broker handoff, and no insurance data is shared.
• London & Country (L&C, FRN 143002) — a BTL mortgage introduction is planned but not available. Tendmere does not send property or borrower data to L&C in this release. Mortgage records in Tendmere are user-entered operating data, not advice.

Before any provider is enabled, this notice and the relevant in-product screen will identify the provider, exact fields, purpose, lawful basis, controller roles and any commission.

7. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Port your data (export in CSV format)
• Restrict or object to processing
• Withdraw consent for marketing communications

To exercise any of these rights, use the verified privacy-request form or email privacy@tendmere.com. We will respond without undue delay and normally within one calendar month.

8. Data retention

We retain account data while the account is active. Settings links to the verified privacy-request process for access or deletion. We erase or anonymise data after verification unless a limited record must be retained for a legal, tax, fraud-prevention, safety or dispute purpose. Encrypted recovery archives expire under the published backup schedule, and erased data is not restored to normal live use.

9. Cookies

We use essential cookies and browser storage for authentication, session management and privacy choices. Optional PostHog analytics and, when configured, Google Ads measurement are used only with your consent. See our Cookie Policy for full details.

10. Changes to this policy

We may update this policy from time to time. Significant changes will be notified via email or in-app notification. The “last updated” date at the top reflects the most recent revision.

11. Contact and complaints

For privacy queries: privacy@tendmere.com

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.