1. Who we are
Roost is a property management platform for UK private landlords and their tenants, operated by Morado Limited, a company incorporated in England and Wales.
- Company name: Morado Limited
- Registered office: 603 Mercury House, 2 Jude Street, London, E16 1FF
- Company number: 12155728
- Contact email: privacy@wearemorado.com
- Website: https://getroost.co.uk
For the purposes of UK data protection law, Morado Limited is the data controller in respect of personal data collected through the Roost platform and website.
2. What this policy covers
This policy explains how we collect, use, store, and share your personal data when you:
- visit https://getroost.co.uk or https://app.getroost.co.uk
- create a Roost account (as a landlord or as a tenant via an invite)
- use any of the features of the Roost platform
Please read it carefully. By using Roost you confirm you have read and understood this policy. If you do not agree with it, you should not use the platform.
3. The personal data we collect
3.1 Data you give us directly
| Category | Examples |
|---|---|
| Identity data | Full name |
| Contact data | Email address, phone number (if provided) |
| Account credentials | Email + password (password is hashed; we never store it in plain text). Multi-factor authentication (MFA) is required. |
| Property data | Property address, type, number of bedrooms |
| Documents | Documents you upload (e.g. tenancy agreements, gas safety certificates, EPC reports). These may contain third-party personal data. |
| Communications | Messages sent between landlords and tenants; issue reports and replies. |
| Profile information | Name, contact details, optional avatar image |
3.2 Data we collect automatically
| Category | Examples |
|---|---|
| Usage data | Pages visited, features used, timestamps |
| Technical data | IP address, browser type and version, device type, operating system |
| Cookies | See Section 9 (Cookies) |
3.3 Data we receive from others
When a landlord invites a tenant, we receive the tenant's email address from the landlord. We use it solely to send the invite and to create the tenant's account.
4. How and why we use your personal data
We only use your personal data where we have a lawful basis to do so under UK GDPR.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and managing your account | Identity, contact, credentials | Contract (Article 6(1)(b)) |
| Providing the platform: property management, documents, messages, issues | All platform data | Contract (Article 6(1)(b)) |
| Sending service notifications (e.g. new message, issue raised) | Identity, contact | Contract (Article 6(1)(b)) — service notifications, not marketing |
| Sending a tenant invite at the landlord's request | Tenant email | Legitimate interests (Article 6(1)(f)) |
| Keeping the platform secure and preventing fraud | Technical, usage | Legitimate interests (Article 6(1)(f)) |
| Complying with legal obligations | As required | Legal obligation (Article 6(1)(c)) |
| Improving the platform | Usage data (aggregated/anonymised where possible) | Legitimate interests (Article 6(1)(f)) |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We do not send marketing emails. If this changes, we will update this policy and obtain your consent first.
5. Sensitive (special category) data
We do not intentionally collect special category data (health, race, religion, biometric data, etc.). If a document you upload happens to contain such data, you are responsible for ensuring you have the right to share it with us and with the other party on the platform.
6. Who we share your data with
We do not sell your personal data. We share it only in the following circumstances.
6.1 Between landlords and tenants on the same property
The platform enables communication between a landlord and their tenant on a specific property. The other party can see your name and contact details (as provided in your profile), messages and issue replies, and documents the landlord has uploaded (tenants get read-only access).
6.2 Service providers (data processors)
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, file storage (S3), email delivery (SES), user authentication (Cognito) | Primarily UK (London — eu-west-2). CloudFront CDN edge nodes operate globally. See Section 7. |
6.3 Legal or regulatory requirements
We may disclose your data if required to do so by law, court order, or at the request of a regulatory authority (e.g. the ICO, police, HMRC). We will notify you if we are legally permitted to do so.
6.4 Business transfer
If Morado Limited is sold, merged, or its assets are transferred, your personal data may be transferred as part of that transaction. We will notify affected users in advance where possible.
7. International transfers
Our primary infrastructure runs in AWS's eu-west-2 (London) region, which is within the UK. However, AWS CloudFront (our content delivery network) uses a global network of edge locations, some of which are outside the UK and EEA.
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. For AWS, this is covered by the AWS Data Processing Addendum, which incorporates the UK International Data Transfer Agreement (UK IDTA) and the UK Addendum to the EU Standard Contractual Clauses, ensuring your data receives equivalent protection regardless of where it is processed.
8. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Active account data | For as long as your account is active | To provide the service |
| Property and tenancy data (documents, messages, issues) | 6 years after the tenancy ends (or 6 years after the property is archived, whichever is later) | UK legal obligation for landlords; mirrors your statutory record-keeping duty |
| Notifications | 12 months from creation | Operational necessity |
When a landlord archives a property, all associated data is retained in a read-only state for 6 years from the end of the tenancy, in line with UK legal requirements. After that period, we will contact the landlord to confirm whether to delete or retain the data. We will never auto-delete your data.
When you request account deletion, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it. In those cases, the retained data will be held securely, used only to comply with legal obligations, and deleted once the retention period expires (subject to your confirmation, as above).
9. Cookies
We use cookies and similar tracking technologies on getroost.co.uk and app.getroost.co.uk. Full details are set out in our Cookie Policy.
In summary: we currently use only strictly necessary cookies (session management, authentication, security). We do not set analytics or marketing cookies without your explicit consent. You can manage or delete cookies via your browser settings, though disabling strictly necessary cookies will prevent you from logging in.
10. Your rights under UK GDPR
You have the following rights in relation to your personal data:
- Right of access — You can request a copy of the personal data we hold about you.
- Right to rectification — You can ask us to correct inaccurate or incomplete data.
- Right to erasure — You can ask us to delete your data, subject to our legal retention obligations (see Section 8).
- Right to restriction — You can ask us to limit how we use your data while a dispute is being resolved.
- Right to data portability — You can request your data in a structured, machine-readable format.
- Right to object — You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
- Rights related to automated decision-making — We do not carry out automated decision-making with significant effects on you.
To exercise any of these rights, contact us at privacy@wearemorado.com. We will respond within one calendar month. We will not charge a fee for reasonable requests. We may ask you to verify your identity before responding.
11. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Helpline: 0303 123 1113
We would appreciate the opportunity to address your concern directly first — please contact us at privacy@wearemorado.com before going to the ICO.
12. Data security
We take appropriate technical and organisational measures to protect your personal data:
- All data in transit is encrypted using TLS.
- Data at rest (database and file storage) is encrypted using AWS KMS customer-managed keys.
- Multi-factor authentication (MFA) is mandatory for all user accounts.
- Access to production infrastructure is restricted to authorised personnel only.
- We do not store passwords in plain text.
- Daily automated backups are retained for 31 days.
No method of transmission over the internet is 100% secure. While we take these measures seriously, we cannot guarantee absolute security.
13. Third-party links
The platform and website may contain links to third-party websites, plug-ins, or applications. Clicking those links may allow third parties to collect data about you. We do not control those third-party sites and are not responsible for their privacy practices. When you leave Roost, we encourage you to read the privacy policy of every site you visit.
14. Children
Roost is intended for use by adults (18+). We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly.
15. Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect. The "Last updated" date at the top of this page will always reflect the current version. Continued use of Roost after the effective date of any change constitutes acceptance of the updated policy.
16. Contact us
For any questions about this policy or how we handle your personal data:
- Email: privacy@wearemorado.com
- Post: Morado Limited, 603 Mercury House, 2 Jude Street, London, E16 1FF