Effective Date: 17 June 2026
Website: www.thekarnani.com
Company: Potentia Investments Limited
Trading Name: Karnani
Company Number: 12525449
Registered in: England and Wales
Contact Email: [email protected] and [email protected]
1. Introduction
Karnani respects your privacy and is committed to protecting personal information lawfully, fairly, securely, and transparently.
This Privacy Policy explains how Potentia Investments Limited, trading as Karnani, collects, uses, stores, shares, protects, and retains personal data when you use our website, make an enquiry, arrange a viewing, apply for a tenancy, pay a holding deposit, enter into a tenancy, communicate with us, or otherwise use our services.
This Privacy Policy applies to prospective tenants, tenants, guarantors, occupiers, applicants, landlords, contractors, suppliers, website users, and other individuals who interact with us.
We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and other applicable data protection and housing laws.
This policy does not form part of any tenancy agreement or contract, but it explains how your personal data is handled.
2. Who We Are
For the purposes of data protection law, Potentia Investments Limited, trading as Karnani, is usually the data controller for the personal data we collect and process.
In some situations, we may process data on behalf of landlords, property owners, operators, or third-party service providers. Where this applies, our role may be that of a processor or joint controller, depending on the arrangement.
Where required, we will ensure that appropriate data protection arrangements are in place.
3. Scope of This Policy
This policy applies to personal data collected through:
● our website;
● enquiry forms;
● viewing requests;
● property portals;
● tenancy applications;
● referencing and screening processes;
● holding deposit and booking processes;
● tenancy agreements;
● guarantor forms;
● email, phone, SMS, WhatsApp, portal, and other communications;
● maintenance and inspection processes;
● rent collection and arrears management;
● compliance checks;
● complaints and disputes;
● CCTV, photographs, videos, inspections, and access records where applicable;
● third-party systems and platforms used by us.
4. Personal Data We May Collect
We may collect and process the following categories of personal data where relevant.
4.1 Identity Data
This may include:
● full name;
● date of birth;
● nationality;
● immigration status information where required;
● passport, driving licence, residence permit, biometric residence card, share code, or other identity documents;
● student ID or university information;
● photograph or likeness where included in documents, CCTV, inspection photographs, or identification checks.
4.2 Contact Data
This may include:
● email address;
● phone number;
● WhatsApp number;
● current address;
● previous addresses;
● forwarding address;
● emergency contact details;
● guarantor contact details;
● next of kin details where provided.
4.3 Tenancy and Application Data
This may include:
● property or room applied for;
● viewing history;
● move-in date;
● tenancy term;
● rent amount;
● application forms;
● references;
● landlord or agent history;
● employment details;
● university or course details;
● guarantor information;
● household information;
● occupancy details;
● tenancy agreement records;
● notices, renewals, variations, and tenancy communications.
4.4 Financial Data
This may include:
● rent payment records;
● holding deposit records;
● tenancy deposit records;
● bank account details for refunds;
● payment references;
● arrears records;
● invoices;
● proof of income;
● employment income details;
● student funding information;
● guarantor financial information;
● affordability information;
● bank statements or payslips where lawfully requested for tenancy assessment.
4.5 Compliance and Legal Data
This may include:
● Right to Rent documents and checks;
● share codes;
● immigration status confirmation;
● deposit protection records;
● council tax or student exemption evidence;
● HMO or licensing-related records;
● maintenance and safety reports;
● complaints;
● disputes;
● legal correspondence;
● insurance records;
● incident reports;
● anti-fraud records;
● records required for tax, accounting, legal, regulatory, or housing compliance.
4.6 Communication Data
This may include:
● emails;
● phone call records;
● call recordings where applicable;
● SMS messages;
● WhatsApp messages;
● portal messages;
● enquiry notes;
● support tickets;
● maintenance requests;
● complaints;
● internal notes about your enquiry, application, tenancy, conduct, payment history, or property-related matters.
4.7 Property, Inspection, and Maintenance Data
This may include:
● inspection photographs;
● room condition records;
● inventory reports;
● check-in and check-out reports;
● maintenance photographs;
● repair history;
● access records;
● lockbox records where applicable;
● evidence relating to damage, cleanliness, safety, keys, deposits, disputes, or compliance matters.
4.8 Website and Technical Data
This may include:
● IP address;
● browser type;
● device type;
● operating system;
● referral source;
● pages viewed;
● time spent on the website;
● form submissions;
● cookies and analytics data;
● approximate location derived from device or browser data;
● security logs.
4.9 Marketing and Preference Data
This may include:
● marketing consent;
● property preferences;
● budget;
● location preferences;
● viewing preferences;
● communication preferences;
● subscription or unsubscribe records;
● property alert preferences.
4.10 Special Category or Sensitive Data
We do not usually seek to collect special category data. However, such data may occasionally be processed where necessary and lawful, for example where information is provided in relation to health and safety, disability adjustments, vulnerability, safeguarding, legal claims, or accommodation needs.
Where we process special category data, we will only do so where we have a lawful basis and a valid condition under data protection law.
4.11 Criminal Offence Data
We do not routinely collect criminal offence data. However, it may be processed where relevant to fraud prevention, property safety, serious complaints, legal proceedings, police involvement, or protection of residents, staff, landlords, or property.
Such data will only be processed where lawful and necessary.
5. We Do Not Intentionally Collect Children’s Data
Our services are not aimed at children under 18.
We do not intentionally collect personal data from children under 18 unless it is necessary and lawful, for example where a minor is listed as an occupier, dependent, emergency contact, or part of a household application.
If we become aware that we have collected children’s data without a lawful reason, we will take appropriate steps to delete or restrict it.
6. How We Collect Personal Data
We may collect personal data directly from you when you:
● use our website;
● submit an enquiry;
● request a viewing;
● complete a form;
● apply for a tenancy;
● pay a holding deposit;
● provide identification;
● provide Right to Rent information;
● provide references;
● provide guarantor details;
● sign a tenancy agreement;
● communicate with us;
● report maintenance;
● raise a complaint;
● make payment;
● attend a viewing, check-in, check-out, or inspection.
We may also collect personal data from third parties, including:
● property portals such as SpareRoom, Rightmove, Zoopla, OpenRent, or similar platforms;
● referencing agencies;
● credit checking providers;
● employers;
● universities or education providers;
● previous landlords or agents;
● guarantors;
● payment processors;
● banks;
● deposit protection schemes;
● contractors;
● councils and local authorities;
● utility providers;
● professional advisers;
● fraud prevention services;
● public registers;
● government services used for Right to Rent checks;
● other lawful sources relevant to tenancy, property management, compliance, or dispute resolution.
7. How We Use Personal Data
We may use personal data for the following purposes:
7.1 Enquiries and Viewings
To respond to enquiries, match you with suitable properties, arrange viewings, send property details, answer questions, and communicate with you about availability.
7.2 Applications and Referencing
To process tenancy applications, verify identity, assess suitability, carry out referencing, complete affordability checks, assess guarantors, and decide whether to proceed with a tenancy.
7.3 Holding Deposits and Reservations
To record holding deposit payments, reserve properties, manage deadlines, process withdrawals, apply funds to rent or deposit, refund sums where due, and retain sums where legally permitted.
7.4 Right to Rent and Legal Compliance
To complete Right to Rent checks, verify immigration status where required, retain evidence of compliance, and comply with landlord, housing, immigration, tax, accounting, licensing, deposit, and regulatory obligations.
7.5 Tenancy Management
To prepare tenancy agreements, manage move-ins and move-outs, collect rent, manage deposits, issue invoices, maintain records, handle notices, manage arrears, arrange inspections, and communicate about your tenancy.
7.6 Property Management and Maintenance
To manage repairs, inspections, cleaning, safety checks, contractor visits, access arrangements, inventories, check-in and check-out reports, deposit evidence, damage records, and property condition records.
7.7 Safety, Security, and Protection
To protect residents, staff, contractors, landlords, neighbours, and property; prevent fraud; investigate incidents; respond to emergencies; maintain evidence; and support legal or insurance claims.
7.8 Complaints, Disputes, and Legal Claims
To handle complaints, resolve disputes, respond to legal correspondence, prepare evidence, defend or bring legal claims, manage deposit disputes, and protect our legal position.
7.9 Business Administration
To manage internal records, accounting, audits, reporting, training, quality control, staff management, contractor management, service improvement, and operational control.
7.10 Marketing and Property Updates
To send you property alerts, updates, offers, or marketing communications where permitted by law. You may opt out at any time.
8. Lawful Bases for Processing
We will only process personal data where we have a lawful basis under UK data protection law.
The lawful bases we may rely on include:
8.1 Contract
We process personal data where necessary to take steps before entering into a tenancy or contract, or to perform a tenancy agreement, service agreement, or other contract.
This includes enquiries, applications, referencing, tenancy documents, payments, move-ins, maintenance, and tenancy management.
8.2 Legal Obligation
We process personal data where necessary to comply with legal obligations, including housing law, landlord and tenant law, Right to Rent requirements, tax law, accounting rules, deposit protection rules, health and safety law, licensing requirements, and regulatory duties.
8.3 Legitimate Interests
We process personal data where necessary for our legitimate business interests, provided your rights and freedoms do not override those interests.
Our legitimate interests may include:
● responding to enquiries;
● managing applications;
● preventing fraud;
● verifying information;
● protecting property;
● keeping residents and staff safe;
● managing repairs and inspections;
● recovering unpaid sums;
● maintaining business records;
● managing complaints and disputes;
● defending legal claims;
● improving services;
● ensuring operational efficiency;
● communicating with applicants, tenants, landlords, contractors, and suppliers.
8.4 Consent
We may rely on consent for optional marketing, certain cookies, or other optional processing.
Where we rely on consent, you may withdraw consent at any time. Withdrawal of consent does not affect processing already carried out lawfully before withdrawal.
8.5 Vital Interests
In rare cases, we may process personal data where necessary to protect someone’s life or physical safety, for example in an emergency.
8.6 Public Task or Substantial Public Interest
In limited cases, we may process data where necessary for substantial public interest reasons or where required in connection with public authorities, safeguarding, fraud prevention, or legal duties.
9. Right to Rent Data
We may collect and process identity documents, immigration status information, share codes, and related evidence to carry out Right to Rent checks.
You must provide accurate information and documents when requested.
We may use government services, identity verification services, or other lawful methods to complete these checks.
We may retain evidence of Right to Rent checks for as long as necessary to prove compliance with legal obligations and defend our position in the event of investigation, penalty, dispute, or claim.
10. Guarantor Data
If a guarantor is required, we may collect and process the guarantor’s personal data, including identity, contact, address, employment, income, financial, referencing, and signature information.
You must ensure that any guarantor whose details you provide is aware that their personal data will be shared with us and processed for tenancy assessment and guarantee purposes.
We may contact the guarantor directly and use their data to assess suitability, prepare guarantor documents, enforce obligations, manage disputes, and comply with legal requirements.
11. Sharing Personal Data
We may share personal data where necessary and lawful with:
● landlords, property owners, operators, or managing agents;
● referencing agencies;
● credit checking providers;
● Right to Rent or identity verification providers;
● deposit protection schemes;
● payment processors;
● banks;
● accountants;
● bookkeepers;
● auditors;
● solicitors and legal advisers;
● insurers;
● debt recovery agents;
● courts and tribunals;
● local authorities and councils;
● government bodies and regulators;
● utility providers;
● broadband and service providers;
● contractors, cleaners, maintenance workers, and tradespeople;
● inventory clerks;
● inspection providers;
● software, CRM, property management, accounting, email, document signing, and cloud storage providers;
● emergency services;
● police or enforcement authorities where lawful;
● prospective purchasers, investors, business partners, or successors in the event of a business sale, restructure, merger, or transfer.
We only share personal data where we have a lawful reason to do so and only to the extent reasonably necessary.
12. Contractors and Maintenance Providers
Where repairs, inspections, cleaning, access, safety work, or property visits are required, we may share limited personal data with contractors or service providers.
This may include your name, contact details, property address, room number, access instructions, maintenance issue, availability, photographs, or relevant safety information.
Contractors must only use the information for the purpose for which it was shared.
13. Software and Cloud Platforms
We use third-party systems and cloud-based platforms to operate our business. These may include property management systems, CRM systems, email systems, accounting systems, document signing platforms, referencing platforms, payment systems, communication tools, storage systems, and maintenance platforms.
Examples may include Google Workspace, Landlord Vision, Zoho, Meta, accounting software, property portals, payment providers, and other operational tools used by us from time to time.
These providers may process personal data on our behalf or as independent controllers depending on the service.
We take reasonable steps to use reputable providers and appropriate security measures.
14. International Data Access and Transfers
Some of our systems, software providers, support staff, contractors, or operational teams may be located outside the United Kingdom.
Where personal data is accessed from or transferred outside the UK, we will take steps required by data protection law to protect it.
This may include:
● UK adequacy regulations;
● International Data Transfer Agreements;
● UK Addendums to Standard Contractual Clauses;
● contractual confidentiality obligations;
● access controls;
● security measures;
● limiting access to what is necessary.
By using our services, you understand that property management, administration, support, and operational services may involve secure access by authorised personnel or providers outside the UK where lawful safeguards are in place.
15. Data Security
We use appropriate technical and organisational measures designed to protect personal data from unauthorised access, loss, misuse, alteration, disclosure, or destruction.
These measures may include:
● password protection;
● access controls;
● two-factor authentication where available;
● secure cloud systems;
● encrypted systems where appropriate;
● staff and contractor confidentiality obligations;
● limited access permissions;
● secure document handling;
● internal data handling procedures;
● data minimisation where practical;
● audit trails and system logs where available.
No system is completely secure. You are also responsible for keeping your own email, phone, portal, passwords, and payment details secure.
You must notify us immediately if you believe your information, email account, payment details, or communication with us has been compromised.
16. Payment Security
We will never ask you to send money to unofficial bank details through informal or suspicious channels.
You should only rely on payment instructions provided through official company email addresses, verified portals, or approved payment systems.
You are responsible for verifying bank details before making payment.
We are not responsible for losses caused by fraud, phishing, impersonation, compromised email accounts, incorrect bank details entered by you, or payments made to unauthorised third parties, unless the loss is caused by our proven failure to comply with legal duties.
17. How Long We Keep Personal Data
We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, accounting, tax, tenancy, operational, fraud prevention, dispute, and claim purposes.
Typical retention periods include:
● enquiry data: up to 12 months from last meaningful contact, unless there is a lawful reason to keep it longer;
● unsuccessful application data: up to 12 months, unless required for dispute, fraud prevention, compliance, or legal reasons;
● tenancy records: usually up to 6 years after the tenancy ends;
● financial and accounting records: usually up to 6 years;
● Right to Rent records: retained for as long as necessary to demonstrate compliance and defend against legal or regulatory action;
● deposit, rent, arrears, dispute, and legal records: up to 6 years or longer where a dispute, claim, investigation, or enforcement issue is ongoing;
● CCTV footage, where applicable: usually 30 to 90 days unless needed for an incident, investigation, complaint, insurance matter, legal claim, or safety concern;
● inspection photographs, inventories, maintenance records, and property condition evidence: usually for the tenancy period and up to 6 years after, where relevant to deposit, repair, dispute, compliance, or legal matters;
● marketing data: until you unsubscribe, withdraw consent, or we decide it is no longer useful or lawful to retain.
We may retain data for longer where required or permitted by law, where a dispute is ongoing, where we need evidence to protect our legal position, or where deletion would interfere with legal, regulatory, accounting, or fraud prevention obligations.
18. Your Data Protection Rights
Subject to legal limits, you may have the following rights:
● the right to access personal data we hold about you;
● the right to request correction of inaccurate or incomplete data;
● the right to request deletion of personal data;
● the right to restrict processing;
● the right to object to certain processing;
● the right to data portability;
● the right to withdraw consent where processing is based on consent;
● the right to complain to the Information Commissioner’s Office.
These rights are not absolute. We may refuse or limit a request where we have a lawful reason to do so, including where data is needed for legal obligations, tenancy management, accounting, fraud prevention, dispute resolution, legal claims, regulatory compliance, or protection of other people’s rights.
19. Data Access Requests
To make a data request, please email:
Use the subject line:
Data Protection Request
You should include:
● your full name;
● current and previous property address, if applicable;
● email address used with us;
● phone number used with us;
● clear details of your request;
● proof of identity if requested.
We may ask for additional information to verify your identity before responding.
We will respond within the timeframe required by law unless an extension is permitted.
20. Correction and Accuracy
You must ensure that the personal data you provide to us is accurate, complete, and up to date.
You must notify us promptly if your name, address, phone number, email address, immigration status, guarantor details, payment details, or other relevant information changes.
We are not responsible for problems, delays, missed notices, failed checks, or losses caused by inaccurate, incomplete, outdated, or misleading information provided by you.
21. Deletion Requests
You may request deletion of your personal data.
However, we may not be able to delete data where we need to keep it for:
● tenancy management;
● rent collection;
● deposit protection;
● accounting;
● tax;
● Right to Rent compliance;
● legal obligations;
● complaints;
● disputes;
● fraud prevention;
● safeguarding;
● property safety;
● regulatory requirements;
● legal claims;
● enforcement or defence of our rights.
Where deletion is not possible, we may restrict use of the data where appropriate.
22. Marketing
We may send marketing communications where permitted by law.
This may include property alerts, room availability, offers, service updates, or similar information.
You can opt out of marketing at any time by contacting us or using any unsubscribe option provided.
Opting out of marketing does not stop us from sending important service, tenancy, legal, compliance, safety, payment, or property management communications.
23. Cookies and Analytics
Our website may use cookies, pixels, analytics tools, and similar technologies to operate the website, improve performance, understand user behaviour, measure marketing effectiveness, and enhance user experience.
Some cookies are necessary for the website to function. Others may be optional and depend on your consent or browser settings.
You can manage cookies through your browser settings or any cookie preference tool provided on our website.
Blocking some cookies may affect website functionality.
24. CCTV, Photographs, and Property Evidence
Where applicable, CCTV, photographs, videos, inspections, inventories, maintenance images, and access records may be used for:
● property safety;
● security;
● maintenance;
● evidence of property condition;
● damage assessment;
● cleaning assessment;
● deposit disputes;
● complaints;
● legal claims;
● anti-social behaviour issues;
● contractor management;
● compliance;
● insurance purposes.
We will use such data only where lawful and necessary.
We do not use CCTV or inspection evidence for unlawful monitoring.
25. Call Recordings and Communication Monitoring
Where applicable, calls or communications may be recorded, stored, reviewed, or monitored for:
● training;
● quality control;
● dispute resolution;
● evidence;
● fraud prevention;
● complaint handling;
● staff management;
● service improvement;
● legal or compliance purposes.
If call recording is used, we will take reasonable steps to make this clear where required.
26. Automated Decision-Making
We do not usually make tenancy decisions based solely on automated decision-making without human involvement.
However, third-party referencing, affordability, identity, fraud, or credit checking providers may use automated tools as part of their assessment process.
Where this occurs, the provider’s own privacy policy may also apply.
27. Links to Third-Party Websites
Our website and communications may include links to third-party websites, property portals, payment systems, referencing platforms, or other services.
We are not responsible for the privacy practices, security, content, or data handling of third-party websites.
You should read their privacy policies before providing personal data.
28. Landlords, Operators, and Business Transfers
Where we manage, market, or operate property on behalf of landlords, owners, or operators, we may share relevant personal data with them where necessary for tenancy, property management, compliance, accounting, legal, or operational purposes.
If our business, assets, contracts, property management portfolio, or company structure are sold, transferred, merged, reorganised, or assigned, personal data may be shared with or transferred to relevant parties as part of that transaction, subject to appropriate confidentiality and legal safeguards.
29. Fraud Prevention and Misuse
We may use personal data to detect, prevent, investigate, and respond to fraud, false applications, identity misuse, payment fraud, unlawful subletting, property damage, unpaid rent, anti-social behaviour, abuse of staff, misuse of systems, and other unlawful or improper conduct.
Where necessary and lawful, we may share information with landlords, referencing agencies, fraud prevention services, debt recovery agents, insurers, police, courts, regulators, local authorities, or legal advisers.
30. Complaints About Data Use
If you are unhappy with how we handle your personal data, please contact us first so we can investigate and respond.
Email:
[email protected]
[email protected]
Please use the subject line:
Data Protection Complaint
You also have the right to complain to the Information Commissioner’s Office.
ICO website: www.ico.org.uk
31. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, regulation, business operations, systems, services, or data handling practices.
The latest version will be published on our website with an updated effective date.
Where changes are significant, we may take reasonable steps to notify affected individuals where required.
Continued use of our website or services after the updated policy is published means you acknowledge the updated policy.
32. Contact Details
For questions, concerns, or data protection requests, please contact:
Karnani
Potentia Investments Limited trading as Karnani
Email: [email protected]
Alternative Email: [email protected]
Website: www.thekarnani.com