Privacy & Data Retention Policy.
Version: 17 October 2026. Your Local HMO Directory is a privately operated, non-commercial personal project hosted at chillinlounge.co.uk; it is not a registered business or a government/council service. The individual responsible for operating this website determines how its personal data are processed. The public contact point for privacy questions, legal notices and data-subject requests is yourlocalhmo@gmail.com. To request the operator's legal identity or appropriate correspondence details, contact that address. The site name and domain identify the service rather than a separately incorporated legal entity.
1. What information we retain
Website use: Public connection IP, server request time, requested page or API route, status/response size, referring website's domain (where sent), and browser-reported User-Agent. These generate approximate device, OS and browser categories and daily activity groups. Automated requests and likely scanning may also be labelled. Daily groups are not proof of a unique person. The searchable 30-day database excludes form contents, passwords, precise GPS, full query strings and confirmation tokens, though original Apache technical logs may contain URL parameters until rotated.
Optional location and network context: when suitable local databases are installed, country, region, city and network/ASN organisation inferred from the public IP, plus possible VPN, proxy or Tor listings. This information is fallible, can be unknown and cannot reliably identify a person, device owner or physical address. The site's visitor logger does not transmit IP addresses to third-party IP lookup APIs.
Members: name, email, optional organisation, application and safeguarding purpose, requested and granted access levels, password hash (not plain password), email verification, reviews, access grants, account status, timestamps and pseudonymous registration/security hashes. Reports: chosen council, issue category, message text, optional reply address, submission date and pseudonymous IP hash. Reports may contain personal data supplied by contributors; do not submit names of occupants or unnecessary sensitive information.
Terms: version/time of an acknowledgement, temporary daily-hashed IP and User-Agent values for acceptance evidence, and the signed first-party acknowledgement cookie. Logged-in members may also have the last accepted version/time recorded against their account. Source records: dated council licensing, planning and other historical HMO evidence, kept with provenance and reviewed for accuracy, not as allegations against current occupants.
2. What we do with the information and why
We operate the directory, verify and protect accounts, moderate submissions, monitor service errors, investigate security incidents, prevent abuse, validate source information and control access to safeguarding cases. Where appropriate and proportionate, the operator relies on legitimate interests under UK GDPR Article 6(1)(f), subject to a documented balancing assessment; some services may rely on contractual steps or specific legal obligations as relevant. A terms acknowledgement is not presented as GDPR consent for analytics.
We do not sell personal data or use these logs to harass, dox, threaten, discriminate against or target individuals. VPN/device classifications are informational rather than decisions or proof of wrongdoing.
3. Retention by category
UK GDPR does not require every record to have the same fixed storage period. We use the following time limits or necessity-based review triggers; a documented lawful preservation obligation or investigation may justify a limited exception.
| Record category | Retention / review rule |
|---|---|
| Detailed visitor records and connecting IPs | 30 days; deleted automatically from the searchable database. |
| Apache technical access logs | Daily rotation, 14 daily retained rotations under the current configuration, plus the current log. Backup copies must be managed separately. |
| Unsuccessful login/security-attempt hashes | 30 days once the maintenance task is installed. |
| Logged member access to protected resources | 180 days once the maintenance task is installed, unless a specific incident requires preservation. |
| Anonymous terms acknowledgement evidence | 90 days once maintenance is installed. |
| Essential acknowledgement cookie | 90 days, or until a material terms-version change. No separate analytics tracking cookie. |
| Member registration, password hash, email verification, permissions, approval history and safeguarding-case authorisations | While the account/application needs to operate or be reviewed; review accounts after closure or refusal and delete when no longer required, subject to applicable legal holds. Account-linked audit records may be deleted with the account where appropriate. |
| Public housing reports, submitted text and reply details | While pending review, correction, genuine follow-up or dispute. Closed reports are to be periodically reviewed and deleted/anonymised once unnecessary; unusually sensitive submissions need prompt attention. |
| Published HMO licence/planning-source evidence | While historically relevant with source/date and periodic accuracy, minimisation and correction review; not automatically erased just because a licence expires. |
| Gmail verification/support messages and backups | Subject to separate mailbox and backup retention; not covered by the visitor database 30-day deletion job. Unnecessary correspondence and obsolete backups must be reviewed and removed. |
Retention may be shortened in response to a valid request. Information reasonably necessary for a specific claim, regulatory request or legal duty may be preserved with restricted access and review. A pseudonymous hash can still be personal data; we do not treat hashing as automatic anonymisation.
4. Cookies, providers and international processing
The essential ylhmo_session session cookie supports form security and account login. The essential ylhmo_terms signed cookie avoids repeated acknowledgement prompts for up to 90 days. Neither is a marketing cookie; the visitor-log system adds no fingerprint or extra analytics cookie. You can block cookies in your browser, but sign-in and forms may stop working. If optional cookies or marketing tracking are introduced, we will assess PECR consent requirements separately.
Map pages may request scripts/tiles from external resources including OpenFreeMap, OpenStreetMap-based services and public JavaScript/CDN providers, which can receive request IPs and browser information. A user-initiated postcode lookup may contact postcodes.io with the searched postcode and request metadata. Google handles outgoing and incoming Gmail messages; email and third-party services may process information internationally. Appropriate supplier contracts and transfer safeguards require independent checking; this policy does not promise every provider is UK-hosted.
5. Access, security and permitted disclosure
Individual visitor activity is visible only to the authenticated admin dashboard; account and property information is role-gated. Passwords use non-reversible password hashes and access is protected with HTTPS. No technical system is perfectly secure. Information may be disclosed to processors or where lawfully required; protected member data must not be republished without prior written permission, except where legislation or protected disclosures permit or require it. Public records are also subject to third-party source terms and statutory rights.
6. Your rights and objections
You may have the right to access, rectify, erase or restrict personal information, to object to processing, and in applicable circumstances to portability. Right to object: if we rely on legitimate interests, you can object at any time; we will assess the objection and stop processing unless a valid overriding lawful reason applies. We do not make solely automated decisions with legally significant effects based on VPN, location or device estimates.
Contact yourlocalhmo@gmail.com with “Data protection request”. We may seek proportionate verification before disclosing account data. You can complain to the Information Commissioner's Office. The statutory response period applies, including any lawful extension or exemption.
7. Accountability and policy changes
The operator must periodically review data collected, security, controller contact details, processors, retention, legitimate-interest assessments and the necessity of safeguard records. If material terms change, users will be asked to acknowledge the new version. No policy or checkbox removes your statutory rights.