DOMIVO LTD Privacy Notice
This notice explains how DOMIVO LTD collects, uses, shares and protects personal information when you enquire about our services, use our website or customer portal, or are involved in a property that we help manage or maintain. It also explains your rights and how to contact us.
It covers homeowners, landlords, tenants, other occupiers, prospective customers, authorised representatives and contractor contacts. Personal information is information that identifies you or can reasonably be linked to you.
Our public website is app.joindomivo.com and our customer portal is portal.joindomivo.com. This notice also covers the use of customer, property and contractor records through our internal staff systems. Employment and recruitment processing is outside its scope.
We handle personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.
1 Who we are and how to contact us
DOMIVO LTD, referred to as Domivo, we, us or our, is the controller of personal information where we decide why and how it is used for the purposes described in this notice. Section 3 explains circumstances in which another organisation is the controller.
Registered name: DOMIVO LTD
Company number: 16211900
Company status: Active
Registered office: 30 Waterdown Road, Tunbridge Wells, England, TN4 8LE
To ask a privacy question, exercise your rights, report a concern or make a data protection complaint, email [email protected] or use our public contact form. You do not need a portal account to contact us.
Report a vulnerability or security incident to [email protected]. General enquiries go to [email protected]. Questions about plans and new customers go to [email protected].
Customers can also write to [email protected], [email protected], or [email protected] for the matching subject. You may also write to the Privacy Lead, DOMIVO LTD, at our registered office above. No special wording or particular form is required. Please do not send passwords, payment card security codes or unnecessary identity documents with your initial message.
2 Our hosting processor
A technical provider hosts and manages the infrastructure for the Domivo platform. When that provider processes personal information on our behalf and under our documented instructions, it acts as our processor.
Authorised personnel of that provider may access information where necessary to maintain the platform, provide instructed support, manage backups or investigate faults and security incidents. The provider is required to protect that information, restrict access, maintain confidentiality and comply with the data protection obligations applying to its services. Any further processors it uses for our information require the appropriate authorisation and contractual protections.
Domivo remains responsible for its decisions about customer and property information and is your main contact for privacy matters. Using a hosting processor does not remove either organisation's responsibilities under data protection law.
3 Landlords and other organisations
A landlord, managing agent, property owner or contractor may be a separate controller for information it uses for its own purposes. Its own privacy information explains those activities. For example, a landlord may use repair records to manage a tenancy, while a contractor may retain records to meet its own accounting or professional obligations.
Where Domivo processes information solely under another controller's documented instructions, we act as that controller's processor for those activities. We assist the controller with privacy requests and explain the relevant contact arrangements. Our own account administration, business records and other processing for which we decide the purposes remain covered by this notice.
Where property accounts are linked, relevant repair requests, access arrangements, approvals and progress updates may be shared with the responsible landlord or agent. Linking an account does not give that person an automatic right to all of an occupier's messages or personal information. We assess what is necessary and appropriate, including the sensitivity of complaints and household information.
4 Information we collect and its sources
The information we handle depends on your relationship with Domivo and the services involved.
| Category | Information this may include |
|---|---|
| Contact and account details | Name, email address, telephone number, postal address, organisation, relationship to a property, user role, account identifiers and authentication records. |
| Property and service records | Property address, ownership or occupancy details, maintenance plans, repair reports, appointments, work instructions, access arrangements, inspections, approvals, job status and service history. |
| Messages and documents | Enquiries, correspondence, complaints, photographs, attachments, certificates, reports and records of how a request was handled. |
| Billing and payments | Billing contact and address, service plan, quotations, invoices, payment and refund status, transaction references and cancellation records. Payment or refund instructions may also contain information about the payer or receiving account. |
| Technical and security information | IP addresses, timestamps, browser or device information, pages or features accessed, session identifiers, login attempts, security events and diagnostic records. |
| Choices and permissions | Communication preferences, cookie choices and records of consent or withdrawal where relevant. |
We receive information directly from you through forms, account use, messages, uploads and other communications. We also receive relevant information from property owners, landlords, managing agents, authorised representatives, assigned contractors and providers involved in payments. Technical information is generated when you use our services and by the systems that support them.
For example, a landlord may give us a tenant's contact details to arrange a repair; a contractor may supply completion photographs; and a payment provider may confirm a payment or refund. Photographs and documents can contain information about other occupants or visitors. Please include only what is necessary and avoid uploading unrelated financial, identity or medical records.
If another person provides your information, we give you the required privacy information within a reasonable period and no later than one month after obtaining it. If we contact you or disclose the information sooner, we provide the information by that first communication or disclosure, unless a lawful exception applies. Someone else's responsibility to tell you about sharing information does not replace our own transparency duties.
5 Sensitive information and children
Our services do not ordinarily require detailed health information, information about criminal allegations or convictions, or other particularly sensitive information. Please explain the practical adjustment you need, such as an accessible appointment or a different communication method, without supplying a medical history where that is unnecessary.
Some adjustment requests, messages or photographs may nevertheless reveal health or other special category information. We only use this information where it is necessary, we have a lawful basis under Article 6 of the UK GDPR and an applicable additional condition under Article 9.
For an optional adjustment that requires health information, we seek your explicit consent where that is an appropriate and freely given choice. You can withdraw it using the contacts in section 1, and we will discuss whether the adjustment can be arranged without retaining that information. Where necessary for legal claims, we may instead rely on the legal claims condition. In a life-threatening emergency, the vital interests condition may apply where the person concerned is physically or legally incapable of consenting. Any other special category use requires an applicable condition and appropriate information at the time.
We do not routinely request criminal offence information. If a specific matter requires it, we must identify the applicable legal authority or condition before using it. Sending sensitive material without being asked does not, by itself, amount to consent to use it. Unnecessary material is removed or redacted where appropriate.
Our online accounts are intended for adults aged 18 or over. Limited information about children may arise in household, access or repair records. We restrict it to what is necessary for the service or a relevant safety concern and take particular care with its use and disclosure. Please contact us if unnecessary information about a child has been submitted.
6 Why we use information and our lawful bases
We identify the lawful basis that applies to each purpose. A contract with a landlord does not itself provide a contractual basis for using a tenant's information. Where we rely on legitimate interests, we assess whether the use is necessary and proportionate and balance those interests against your rights and reasonable expectations.
Enquiries and quotations
We use contact, enquiry and relevant property details to answer questions and prepare quotations. Where you are the prospective contracting party and ask us to take steps towards a contract, we rely on Article 6(1)(b), steps at your request before a contract. For general enquiries and enquiries from business representatives, we rely on Article 6(1)(f), our legitimate interests in responding to requests and managing business relationships.
Accounts and property services
We use account, property, appointment, work and communication records to administer accounts, coordinate maintenance, arrange access, obtain relevant approvals and keep people informed. We rely on Article 6(1)(b) where necessary to perform a contract with you. For tenants, occupiers, representatives and contractor contacts who are not parties to that contract, we rely on Article 6(1)(f), our and the relevant property owner's legitimate interests in arranging and documenting appropriate property services.
Billing and financial records
We use billing and transaction information to administer charges, payments, refunds and cancellations. We rely on Article 6(1)(b) for necessary administration of your contract, and Article 6(1)(f) for business contact administration and proportionate recovery of unpaid charges. We rely on Article 6(1)(c), legal obligation, for required accounting and tax records, including obligations under company and tax law.
Support and complaints
We use communications and relevant supporting records to investigate problems, respond to complaints and resolve disputes. We rely on Article 6(1)(b) where this is necessary to perform your contract, Article 6(1)(f) for our legitimate interests in resolving issues and establishing or defending legal claims, and Article 6(1)(c) for obligations such as handling data protection rights and complaints.
Security and service operation
We use account events, technical records and necessary support information to prevent misuse, investigate incidents, diagnose faults and keep our services functioning. We rely on Article 6(1)(f), our legitimate interests in protecting people, information and systems. Article 6(1)(c) applies where processing is necessary to meet a specific data protection or other legal duty. Optional cookie-based measurement is addressed separately in section 12.
Marketing and optional choices
We do not currently send promotional marketing emails. Replying to an enquiry and sending necessary service, payment or security messages are separate from promotional marketing.
If we introduce promotional emails or texts, we will explain the use when collecting your details and obtain consent where required. A customer soft opt-in would only be used where all its legal conditions are met, including marketing our own similar services, obtaining details directly during a sale or negotiations for a sale, and providing an opt-out both at collection and in every message. An enquiry alone does not automatically meet those conditions.
Where consent is required for optional processing, we rely on Article 6(1)(a). If a lawful soft opt-in applies, the data protection basis would ordinarily be Article 6(1)(f), our legitimate interest in promoting our similar services, subject to your absolute right to object. We do not use cookie consent as permission to send marketing emails or texts.
Legal requirements and emergencies
We use or disclose necessary information under Article 6(1)(c) to comply with a binding legal requirement, such as a court order. Article 6(1)(f) may apply to proportionate fraud prevention or legal claims. In a genuine emergency, Article 6(1)(d), vital interests, may apply where necessary to protect someone's life. Special category information also requires the additional condition described in section 5.
7 Information needed to provide our services
We identify required information when collecting it. Contact and property details, appropriate access arrangements and relevant billing information may be necessary to create an account, arrange work or administer the requested service. If you do not provide necessary information, we may be unable to provide the affected service.
Where there is a statutory requirement to provide information, we explain that requirement at collection. Marketing permission and consent to optional cookies are not conditions of receiving our core services. Reading or acknowledging this notice is not consent to every use of your information.
8 Who receives your information
We share information only for a relevant purpose, with an appropriate lawful basis and with access limited to what is needed. Recipients may include:
- The hosting processor and authorised providers supporting hosting, backups, system maintenance, network protection and incident investigation.
- Assigned contractors and tradespeople who need property, contact, access and work details to carry out an assignment.
- Relevant property owners, landlords, managing agents and authorised representatives who need appropriate information about their properties, work, approvals, charges or complaints.
- Banks and payment service providers for payments and refunds, accounting providers for financial records, and email delivery or communications providers for delivering messages and supporting customer communications.
- Professional advisers, insurers and auditors where necessary for advice, compliance, insurance or claims.
- Courts, regulators, public authorities and emergency services where disclosure is required by law or otherwise necessary and lawful.
Processors must act under suitable contractual restrictions. Some recipients, including banks, professional advisers and contractors acting for their own purposes, may be independent controllers. Their privacy information explains those separate uses. Where you use a payment service, the provider and its relevant terms and privacy information should be identified in the payment journey.
We do not sell personal information or provide it to other organisations for their own unrelated direct marketing.
If our business is sold, transferred or reorganised, necessary information may be shared with advisers and a prospective or new operator, subject to confidentiality, appropriate safeguards and a lawful basis. We will explain any change of controller or material change in how your information is used. Incorporation alone does not automatically transfer responsibility for records collected by a previous operator.
9 Hosting and international transfers
A hosting processor provides the application's hosting and technical management. Hosting is only part of the processing involved in our services: email delivery, payments, backups, network protection and technical support can also involve other providers and processing locations, including remote access.
Where those services involve a restricted transfer of your information outside the UK, we permit the transfer only where the applicable UK requirements are met. This means relying on UK adequacy regulations covering the relevant recipient, or using appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses. Where required, we assess the protection available and put additional safeguards in place.
We provide information about relevant overseas processing and its safeguards through this notice or a supplementary notice for the service concerned. You can use the contacts in section 1 to ask which recipients and countries are involved in your information, which transfer mechanism applies, and how to obtain a copy of the relevant safeguards. Copies may be redacted to protect confidential information while still explaining the protection available to you.
10 Security and authorised access
We use technical and organisational measures appropriate to the risks, including controls over access to accounts and records, protected authentication, encrypted HTTPS connections and security logging. Access by our staff, contractors and technical providers must be authorised and limited to their work. We assess security needs as our services and risks change.
No online service can guarantee that every security incident will be prevented. If a personal data breach occurs, we assess it, take appropriate action and notify the regulator and affected people where the law requires.
Please contact us promptly through the routes in section 1 if you suspect that your account or information has been compromised. Keep your sign-in details private and avoid including passwords in reports.
11 How long we keep information
We keep information only for as long as necessary for the relevant purpose. The following periods or criteria govern retention. Where the length depends on the service or record, we consider the work still outstanding, applicable legal requirements, relevant warranty or safety obligations, and the period in which a related claim may reasonably arise.
| Record | Retention period or criteria |
|---|---|
| Enquiries and unsuccessful quotations | Until the enquiry and any requested follow-up have concluded and the quotation is no longer open. Any later retention is limited to records needed for an identifiable complaint, claim or legal obligation. |
| Account and customer relationship records | While the account or service relationship is active. After closure, only the records needed to complete outstanding work, reconcile charges, meet legal duties or address relevant claims are retained. Unnecessary profile information is removed. |
| Property, work and completion records | While needed to deliver or document the service and satisfy relevant safety, warranty or legal requirements. Personal details are removed from a continuing property history where they are no longer needed. Relevant evidence may remain for the applicable legal claim period. |
| Invoices, payments and tax records | Generally six years from the end of the last company financial year to which they relate. A longer period applies where required by tax law, an HMRC enquiry or another specific legal requirement. |
| Messages, attachments and support records | For the underlying enquiry, job, account or complaint purpose. Files that evidence work, a payment or a dispute follow that record's retention criteria; unrelated or duplicate material is removed when no longer needed. |
| Access codes and temporary instructions | Only while required for authorised access or the relevant appointment. They are removed promptly once that need ends, unless particular evidence must be preserved for an incident or claim. |
| Technical and security logs | For the period needed to identify faults, detect misuse and investigate relevant events, taking account of incident detection and investigation times. Selected evidence is retained for an active investigation or associated legal claim where necessary. |
| Consent and communication preferences | While we rely on the choice and afterwards only as necessary to demonstrate compliance or address a relevant complaint or claim. A minimal opt-out record is retained for as long as needed to prevent unwanted marketing. |
| Rights requests and privacy complaints | Until the request or complaint and any appeal or regulatory review have been resolved, and afterwards only to evidence our handling for a relevant legal or regulatory requirement or claim period. |
| Backups | For the recovery period needed to restore systems following a failure, corruption or security incident. Copies expire through the backup rotation; information subject to an active legal hold may be preserved separately where necessary. |
An account closure request does not require immediate deletion of every invoice or item of evidence. Conversely, keeping a property or financial record does not justify keeping unrelated personal details indefinitely. We restrict retained information to the purpose that justifies it and delete or irreversibly anonymise it when that purpose ends.
A documented legal hold may suspend deletion of relevant records for a dispute, investigation or legal requirement. We review the need and resume normal disposal when the hold ends. Information awaiting expiry in a backup is kept beyond ordinary use; if a backup is restored, applicable deletion and restriction instructions must be reapplied.
12 Cookies and similar technologies
Cookies and similar browser storage help our services maintain sessions, protect forms, support sign-in and remember choices. Technologies strictly necessary to provide a service you request can be used without optional-cookie consent. We treat optional functional, analytics and marketing technologies separately and require an affirmative choice before enabling them.
The essential cookies described for our platform include:
| Cookie or function | Purpose and duration |
|---|---|
| Domivo.Portal.Auth and Domivo.Admin.Auth | Maintain authenticated sessions in the relevant customer or staff application. The usual authentication validity is up to eight hours, with renewal during continued authorised use. Staff authentication applies to the staff system. |
| Anti-forgery cookies | Help protect form submissions from forged requests. These use a browser-session lifetime. |
| Domivo.CookieNotice | Records cookie choices, including a decision to reject optional cookies, for up to one year. |
| Temporary form and account-link cookies | Carry short-lived form status or information needed to complete an invitation or password-reset journey. They last for the relevant short-lived process, from minutes to hours. |
Optional functionality can remember choices such as whether you are a homeowner or landlord. First-party analytics can use a visitor identifier and page-view count to understand use of the website. Before asking you to enable an optional technology, we provide its specific purpose, the organisation responsible and its duration alongside the choice. Any marketing identifier must have a defined, explained purpose; permission is not sought simply to retain an identifier for unspecified future promotions.
On joindomivo.com, cookie choices are collected by Cookiebot. You can change them at any time with Cookie settings.
Accepting this notice, continuing to browse or agreeing to service terms does not itself provide consent to optional tracking. Cookie permission is also separate from permission to receive promotional messages. Browser settings can block or delete cookies, although blocking essential cookies may prevent sign-in or form submission. The purposes and lawful bases for the personal information used with these technologies are explained in section 6.
13 Automated decisions and artificial intelligence
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Routine reminders, status updates and technical security controls are used to support the service.
If we introduce processing that changes this position, we will explain the processing, its significance and consequences, and the applicable safeguards and rights before it begins. Using software to develop or operate our platform does not, by itself, mean that your account information is sent to an artificial intelligence provider.
14 Your rights
Depending on the processing and the conditions set by law, you may:
- Ask for access to your personal information and information about how it is used.
- Ask us to correct inaccurate information or complete information that is incomplete.
- Ask us to erase information where the right to erasure applies.
- Ask us to restrict processing in the circumstances provided by law.
- Request information you supplied in a structured, commonly used, machine-readable format, and its transmission to another controller where technically feasible, when portability applies to automated processing based on consent or contract.
- Withdraw consent at any time where we rely on it, without affecting the lawfulness of processing before withdrawal.
Your right to object
You may object to processing based on legitimate interests for reasons relating to your particular situation. We must stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
You have an absolute right to object to direct marketing, including profiling related to it. We will stop that use when you object. We may retain a minimal suppression record to respect your choice.
How to make a request
Use any of the contact routes in section 1. You do not need to quote legislation or use a special form. We may ask for proportionate information to verify your identity or authority, and for clarification where the law allows and it is needed to deal with the request.
We respond without undue delay and normally within one month. Where the law allows an extension of up to two further months because of complexity or the number of requests, we explain the extension and reasons within the initial period. Any permitted adjustment to the start or running of the period, including necessary identity checks or clarification for an access request, will be explained.
Requests are normally free. We may charge a reasonable fee or refuse a request only where the law permits, explaining why and how you can complain or challenge the decision. Rights are not absolute: legal obligations, relevant claims and the rights of others may affect what we can provide or delete. Where another organisation is the controller, we assist appropriately and explain its role.
15 Privacy complaints
To complain about our use of your information, use the public contact form or another contact route in section 1 and describe your concern. Please tell us if you need help or an accessible way to complain. A complaint does not require payment, legal wording or a particular form.
We acknowledge data protection complaints within 30 days of receipt. Without undue delay, we make appropriate enquiries, take suitable steps to respond, keep you informed and communicate the outcome, including relevant findings and any action taken. A complaint does not replace or extend the deadline for a separate request to exercise your rights.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. The ICO generally expects you to give us an opportunity to address the issue first, but our process does not remove your right to complain to the regulator or seek a judicial remedy.
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
16 Changes to this notice
We update this notice when our services, processing or legal requirements change. The current version and last-updated date appear at the beginning. We make the notice available on our website and portal and draw material changes to your attention where appropriate.
Before using information for a new purpose, we assess whether that use is lawful and provide the privacy information required. Where fresh consent is necessary, we ask for it. Publishing an updated notice does not itself create consent or remove your existing rights.