Privacy Policy
This policy explains how Step 1 Tenant Referencing Ltd collects, uses, shares and protects personal information when providing tenant referencing services and operating the STEP 1 website and platform.
Who we are
Step 1 Tenant Referencing Ltd, trading as STEP 1, provides tenant referencing services to landlords and letting agents. For the personal information described in this policy, Step 1 Tenant Referencing Ltd acts as a data controller where it determines why and how that information is processed.
Our role may vary for particular services where we process information on the documented instructions of a landlord or letting agent. The landlord or agent may also be a separate data controller and should provide its own privacy information.
Data-protection contact details
Who this policy covers
This policy may apply to:
- Prospective and current tenants
- Guarantors and permitted occupiers
- Landlords and letting-agent customers
- Employers, accountants and previous landlords providing references
- People contacting us about our services
- Users of our website, platform or contact forms
Children
Our referencing services are not normally intended for applicants under 18. Where limited information about a child or young person is genuinely required, we aim to collect only the minimum necessary information and process it using an appropriate lawful basis.
Information we may collect
The information required depends on the service requested and the applicant’s circumstances.
Identity and contact
Name, date of birth, telephone number, email address, current address, previous addresses and identification documents.
Tenancy information
Property details, proposed rent, tenancy dates, household information and landlord or agent instructions.
Employment and income
Employer details, employment status, salary, accountant information, payslips and other evidence of income.
Financial and affordability
Bank statements where supplied, affordability information, credit-search results, insolvency information and relevant court judgments.
Rental and reference history
Previous tenancies, payment history, landlord references and responses received from reference providers.
Technical and communication data
IP address, login and security records, platform activity, emails, telephone notes, enquiries and complaint information.
Right to Rent and identity evidence
Where relevant to the service requested, we may handle identity or Right to Rent evidence. A general tenant reference does not by itself replace the prescribed Home Office Right to Rent process.
Criminal-offence information
We do not routinely conduct criminal-record checks or collect criminal-conviction data as part of our standard tenant referencing services.
Where information comes from
We may obtain personal information from:
- The applicant or guarantor
- The landlord or letting agent requesting the reference
- Employers, payroll contacts or accountants
- Previous landlords or managing agents
- TransUnion International UK Limited
- Public registers and official sources where legally permitted
- Our website, platform, emails and telephone communications
If required information is not provided, we may be unable to complete the requested checks or provide a reliable referencing outcome.
Why we use information and our lawful bases
| Purpose | Information involved | Lawful basis |
|---|---|---|
| Providing tenant referencing services | Identity, contact, tenancy, employment, income, affordability and rental-history information | Contract and legitimate interests |
| Credit, affordability and identity checks | Identity details, address history and relevant financial information | Legitimate interests and, where applicable, consent |
| Producing a referencing risk outcome | Results from affordability, credit, employment and landlord checks | Legitimate interests |
| Preventing fraud and protecting security | Identity, contact, device, login and application information | Legitimate interests and legal obligation where applicable |
| Customer service, complaints and disputes | Communications, application records and account information | Contract, legitimate interests and legal obligation |
| Meeting legal and regulatory duties | Information relevant to the particular requirement | Legal obligation |
| Operating and securing our website and platform | IP address, device, account, login and technical data | Legitimate interests |
Our legitimate interests
Our legitimate interests include providing accurate tenant referencing, helping customers assess tenancy risk, verifying information, preventing fraud, securing our systems, administering our business and handling legal claims. We consider the impact on individuals before relying on legitimate interests.
Consent
Where we rely on consent for a specific activity, consent may be withdrawn by contacting us. Withdrawal does not affect processing that was lawful before consent was withdrawn, and another lawful basis may still permit or require certain information to be kept.
TransUnion credit and identity checks
TransUnion International UK Limited
To process relevant applications, we may supply identity, address and application information to TransUnion International UK Limited. TransUnion provides services including credit-risk and affordability checking, fraud prevention, identity verification and tenant vetting.
TransUnion acts as a separate data controller for its own use of personal information. Its privacy notice explains the information it holds, its lawful bases, retention periods, profiling, international transfers and individual rights.
Read TransUnion’s Bureau Privacy Notice →Who we may share information with
We may share relevant information with:
- The landlord or letting agent requesting the reference
- TransUnion International UK Limited
- Employers, accountants and previous landlords
- Identity-verification and fraud-prevention providers where required
- Website, hosting, platform, email, storage and IT-support providers
- Professional advisers, insurers, auditors and debt-recovery providers
- Regulators, courts, law-enforcement bodies or public authorities where legally required
- A purchaser or successor if our business is restructured or transferred
We require service providers acting on our behalf to use personal information only for authorised purposes and to apply appropriate security measures.
Risk outcomes and human decision-making
Our final referencing outcome involves human review
Credit-reference information, affordability calculations and other checks may produce scores, indicators or risk information. These results do not make the final STEP 1 referencing outcome by themselves.
A member of our administration team reviews affordability evidence and the completed checks before making the final referencing risk outcome. We do not make decisions with legal or similarly significant effects based solely on automated processing.
The landlord or letting agent remains responsible for deciding whether to offer or continue with a tenancy. Applicants may contact us if they believe information used in their reference is inaccurate or if they wish to request a human review or explanation.
How long we retain information
General referencing-record retention
We generally retain application records, supporting documents and completed reference reports for up to six years after the referencing process is completed.
This period supports contract administration, audit requirements, complaints, disputes, fraud prevention and potential legal claims. Some information may be kept for a shorter period where it is no longer needed.
Information may be retained for longer where required by law, necessary for an active complaint or legal claim, or required by a regulator. When information is no longer required, it will be deleted, securely destroyed or anonymised where reasonably practicable.
TransUnion applies its own retention periods to information it processes as a separate data controller.
Security and international transfers
Security
We use appropriate technical and organisational measures designed to protect personal information. These may include encrypted connections, controlled access, authentication, backups, staff procedures and monitoring.
No internet or storage system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess it and notify affected individuals and the ICO where legally required.
International transfers
Some technology or service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we use appropriate protections such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another legally permitted safeguard.
Contact us if you would like further information about safeguards relevant to a particular transfer.
Your data-protection rights
Depending on the circumstances and the lawful basis used, you may have the right to:
- Request access to personal information held about you
- Ask for inaccurate or incomplete information to be corrected
- Request deletion of information in certain circumstances
- Request restriction of processing in certain circumstances
- Object to processing based on legitimate interests
- Request data portability where applicable
- Withdraw consent where processing relies on consent
- Request information about human review of a referencing outcome
These rights are not absolute and exemptions may apply. We may ask for information to verify your identity before responding. We normally respond within one month, although the law allows more time for complex or multiple requests.
Your right to object
You have the right to object to processing based on legitimate interests. If you object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
Submit a rights requestCookies and website information
Our website may use essential cookies and similar technologies needed for security, website functionality, forms and platform access. Our embedded Google map may also allow Google to process technical information when the map is loaded or used.
Further information about the cookies used, their purposes and available controls is provided in our Cookie Policy.
Read our Cookie PolicyContact, complaints and policy changes
Contact STEP 1
Please contact us first if you have a question, rights request or concern about how your personal information has been used.
Complaining to the ICO
Information Commissioner’s Office
You have the right to complain to the Information Commissioner’s Office if you are dissatisfied with how we have handled your personal information or responded to your request.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Visit the ICO complaints service →Changes to this policy
We may update this policy when our services, providers or legal obligations change. The latest version will be published on this page with an updated review date. Material changes may also be communicated directly where appropriate.
Website analytics
If you consent to statistics cookies, we use Google Analytics 4 (measurement ID G-BD50RRK6D2) to measure visits and improve the website. Google LLC acts as our analytics technology provider. Analytics is not loaded unless statistics consent is granted, and consent can be withdrawn through the website cookie settings.