Privacy notice
Last updated: August 2026· Version: 1.0
This notice explains what we do with personal data when you use HMOJo. It is written for the person who holds the HMOJo account, normally a landlord, letting agent or property manager.
If you are a tenant who has been invited to HMOJo by your landlord, a separate, shorter notice applies to you: see Tenant privacy notice.
1. Who we are
HMOJo is operated by CJ Normandie Ltd, a company registered in England and Wales under company number 16185973, whose registered office is at 1 Derwent Business Centre, Clarke Street, Derby, United Kingdom, DE1 2B.
We are registered with the Information Commissioner's Office under registration number ZC224987.
- General contact: hello@HMOJo.co.uk
- Privacy and data protection: privacy@HMOJo.co.uk
- Security: security@HMOJo.co.uk
We have not appointed a Data Protection Officer, because we are not required to.
2. The two roles we play
This matters, because it determines who is answerable to whom.
We are the controller for personal data about you as an account holder — your name, your email address, your billing details, how you use the service, and your correspondence with us. Section 3 onwards of this notice covers that data.
We are a processor for personal data about your tenants, applicants, guarantors and contractors that you put into HMOJo. You decide what goes in, why, and how long it stays. We act on your instructions. Our obligations to you in that role are set out in the Data Processing Addendum, which forms part of your contract with us. What we tell tenants directly is set out in the Tenant privacy notice.
If you are unsure which applies: if the data is about you, this notice applies. If the data is about someone whose landlord you are, the Addendum applies and you are the controller.
3. What we collect about you
| Category | Examples |
|---|---|
| Account data | Name, email address, password (stored hashed), account role |
| Property data | Property addresses, room counts and layouts, licence details, compliance dates |
| Documents you upload | Gas safety records, EICRs, EPCs, fire risk assessments, licences, tenancy agreements |
| Team data | Names and email addresses of managers or VAs you invite |
| Usage data | Pages viewed, features used, log-in times, device and browser type, IP address |
| Support data | Emails, chat messages and anything you send us |
| AI interaction data | Your questions to Jo and the responses given |
| Billing data | Plan, room count, invoices. We do not see or store your card details — payments are handled by our payment provider, who holds the card data. |
We do not collect or process rent payments, deposits or tenant payment data.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account; deliver the service you signed up for | Performance of a contract |
| Send compliance reminders and renewal chasers | Performance of a contract |
| Provide support and respond to you | Performance of a contract |
| Take payment and issue invoices | Performance of a contract |
| Keep the service secure, prevent abuse, investigate incidents | Legitimate interests — protecting our service and our customers |
| Understand how the product is used so we can improve it | Legitimate interests — improving our product. We use aggregated or pseudonymised data for this wherever we can |
| Send you product updates and marketing about HMOJo | Consent, or legitimate interests where you are an existing customer and we are telling you about a similar service. You can opt out at any time, in any message |
| Keep accounting records; respond to legal or regulatory requests | Legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for that assessment.
We do not make any decision about you by automated means that produces a legal or similarly significant effect. Jo suggests; you decide.
5. Where your data is held
All personal data is stored and processed in the United Kingdom and the European Economic Area.
This includes the AI features — document reading and Jo — which run in an EEA region.
The UK Government has determined that the EEA provides an adequate level of protection for personal data, so no additional transfer safeguards are required for UK–EEA transfers. We do not transfer your personal data outside the UK and EEA. If that ever changes, we will update this notice before it happens and put appropriate safeguards in place.
6. AI features
HMOJo uses AI in two places: reading documents you upload to extract dates and details, and Jo, the in-product co-pilot.
- These features run in an EEA region.
- Your data is not used to train any third-party AI model.
- AI output can be wrong. It is a prompt to check something, never a certification that you are compliant. You remain responsible for verifying anything before acting on it.
- No AI feature makes a decision about a person. We do not score, rank or approve tenants, applicants or guarantors.
7. Who we share it with
We share personal data with:
- Service providers who help us run HMOJo: hosting and database infrastructure, email delivery, AI processing, payment processing, error monitoring and customer support tooling. Each is bound by a written contract that restricts them to acting on our instructions. A current list of these providers, and the region each operates in, is available on request from privacy@HMOJo.co.uk.
- Professional advisers accountants, lawyers, insurers where needed.
- Authorities or regulators, where we are legally required to.
- A buyer or successor, if we sell or reorganise the business, or transfer it to a new company. We will tell you if that happens and your data will remain protected on the same terms.
We do not sell personal data, and we do not share it with advertisers.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, property and document data | For as long as your account is open |
| All account data after you cancel or we close your account | 90 days, then permanently deleted |
| Billing and accounting records | 6 years from the end of the relevant financial year (legal requirement) |
| Support correspondence | 2 years from last contact |
| Security and access logs | 12 months |
| Marketing preferences and opt-outs | Until you ask us to delete them, or indefinitely for suppression purposes |
Please note: 90 days after cancellation, everything goes — including compliance certificates. Some of those documents you are legally required to keep. Export your data before you cancel. You can export at any time from account settings.
During the beta, HMOJo does not hold Right to Rent or identity documents at all. Continue to keep those records in your own system.
9. How we protect it
Encryption in transit and at rest. Row-level access controls so that every query is scoped to your account. Access to production systems limited to those who need it. Suppliers selected on the basis of their security posture.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to you, we will tell you without undue delay, and we will notify the ICO within 72 hours where the law requires it.
10. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you
- rectify it if it is wrong
- erase it, in certain circumstances
- restrict how we use it, in certain circumstances
- port it — receive it in a machine-readable format, or have it sent elsewhere
- object to processing based on legitimate interests, and to direct marketing at any time
- withdraw consent where we rely on it, without affecting what we did before
Email privacy@HMOJo.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify who you are first.
If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — at any time, without coming to us first.
11. Cookies and analytics
We use:
- Strictly necessary cookies — to keep you logged in and to keep the service secure. These do not require your consent and cannot be turned off.
- Analytics — to understand how the product is used. These are only set if you consent via our cookie banner, and you can change your mind at any time from Cookie settings.
We do not use advertising or tracking cookies, and we do not share data with ad networks.
12. Children
HMOJo is not intended for anyone under 18. You must be 18 or over to hold an account. If you are a landlord and a tenant or occupant is under 18, do not enter their personal data into HMOJo without a lawful basis for doing so.
13. Changes to this notice
We may update this notice. If the change is significant, we will email account holders at least 30 days before it takes effect. The version number and date at the top will always tell you which version is current, and previous versions are available on request.