Domivo privacy notice

Effective date: 16 September 2026 · Version 1.0

This notice explains how Domivo uses personal information when you visit our website, enquire about our services, use our customer portal or are involved in a property we manage or maintain. It covers homeowners, landlords, tenants, other occupiers, prospective customers, authorised representatives and contractor contacts.

In this notice, “Domivo”, “we”, “us” and “our” mean the operator identified below. Personal information means information relating to an identified or identifiable person. We handle it under the UK General Data Protection Regulation, the Data Protection Act 2018 and applicable electronic communications rules, as amended.

1 Who is responsible for your information

One of the following describes the controller, depending on whether Domivo Limited has been incorporated. The unused clause will be removed when the operator identity is confirmed.

Before incorporation: Domivo is a trading name used by [FULL LEGAL NAME OF THE INDIVIDUAL, PARTNERSHIP OR EXISTING COMPANY], whose business contact address is [ADDRESS]. This operator is the controller of the personal information described in this notice. Domivo Limited has not yet been incorporated.

After incorporation and transfer of operations: Domivo Limited is registered in [JURISDICTION] under company number [NUMBER], with its registered office at [ADDRESS]. Domivo Limited is the controller of the personal information described in this notice.

A controller decides why personal information is used and the essential arrangements for using it. Please contact our privacy lead at [MONITORED PRIVACY EMAIL] or write to [PRIVACY POSTAL ADDRESS].

Our website and customer portal are available at https://app.joindomivo.com and https://portal.joindomivo.com. This notice covers customer and property records accessed through our staff system. A separate workforce notice covers employment and recruitment information.

2 The role of Serio Technical Solutions

Serio Technical Solutions Limited (“STS”) provides technical management, infrastructure and data hosting for the Domivo platform. When STS stores, maintains or accesses Domivo personal information on our behalf and on our documented instructions, it acts as our data processor. Technical administration does not itself make STS the operator of our property-management business.

Authorised STS personnel may access information where necessary to provide agreed support, investigate technical incidents, maintain systems or carry out other instructed processing. Such access is subject to contractual confidentiality and data-protection requirements. Domivo remains your main contact for questions and requests about its use of your information.

3 Property owners and other controllers

A landlord, managing agent or other organisation may separately decide how it uses information about a property or its occupants. Its own privacy notice explains that processing. Where we act only on another controller’s documented instructions, we act as its processor for those activities and assist it in handling your rights. We will identify the relevant controller on request. Our independent uses, such as administering our customer relationship, are covered by this notice.

4 Information we collect and where it comes from

We collect information you provide through enquiries, account registration, service requests, messages, complaints, uploaded documents and other communications. We also receive relevant information from landlords, property owners, managing agents, authorised representatives, contractors and payment providers.

Contact and account information: your name, email address, telephone number, postal address, organisation, relationship to a property, user role, account identifiers and authentication records.

Property and service information: property address, owner or occupier details, maintenance plans, repair reports, appointment availability, work instructions, access arrangements, inspection records, job status and service history.

Communications and files: enquiries, messages, complaint details, correspondence, photographs, attachments, documents and records of actions taken to resolve requests. Images and files may contain information about occupants or other people.

Billing information: billing contact and address, service plan, quotations, invoices, payment status, transaction references, refunds and cancellation records. [CONFIRM PAYMENT PROVIDER AND EXACT CARD OR BANK DATA RECEIVED. State that full card details are not stored only if verified.]

Technical information: IP addresses, timestamps, browser and device information, pages or features accessed, session identifiers, login attempts, security events and diagnostic information. Enquiry records store a truncated IP address (the last octet of IPv4, or the last 64 bits of IPv6, set to zero). Security, audit and rate-limiting records may store the connecting IP address as seen by the application. Browser user-agent strings are not stored on enquiry records.

Preferences: communication choices, marketing permissions, cookie choices and records of when you gave or withdrew consent.

Contractors may provide visit notes, completion photographs, reports and invoices. Landlords or agents may supply contact details and repair instructions so that we can arrange work with tenants. Payment providers may confirm whether a payment succeeded or was refunded. We do not assume that every item supplied by another person is necessary or accurate.

If you provide information about another person, share only what is needed for the service and make them aware of this notice where appropriate. This does not remove our own responsibility to provide privacy information. Where we obtain information indirectly, we provide the relevant information within one month, at our first communication or before the first disclosure, whichever applies first, unless a lawful exception applies.

5 Sensitive information and children

Please do not send medical records, identity documents, criminal-record information or other sensitive material unless we have specifically requested it and explained why it is needed. Tell us the practical access or communication adjustment you need rather than supplying detailed medical information where that is sufficient.

Our service and online accounts are intended for adults. Information about children may nevertheless appear in household or repair records. We limit it to what is necessary for the relevant service or safety issue and apply appropriate safeguards. Please contact us if unnecessary information about a child has been submitted.

6 Why we use information and our lawful bases

We use the following bases only where they apply to the activity concerned. A contract with a landlord does not automatically give us a contractual basis for processing a tenant’s information. Where we rely on legitimate interests, we assess the necessity of the processing and its impact on people’s rights.

Enquiries and quotations

We use contact details, enquiry content and relevant property details to answer questions and prepare quotations. We rely on taking steps at your request before entering a contract where you are the prospective contracting party. For general enquiries or business representatives, we rely on our legitimate interest in responding to requests and managing business relationships.

Accounts and agreed services

We use account, property, appointment, job and communication records to administer your account and deliver the services you contract with us to receive. Our basis is performance of that contract where the processing is necessary. For tenant contacts, representatives and other people who are not parties to that contract, we rely on legitimate interests in coordinating maintenance, arranging access and keeping the relevant people informed, subject to their rights.

Payments and financial records

We use billing and transaction information to charge for agreed services and manage refunds under our contract with you. We retain required accounting and tax records to comply with applicable legal obligations. For business customer contacts and proportionate debt recovery, we rely on legitimate interests in administering and collecting payments.

Support and complaints

We use communications, relevant account records and supporting evidence to investigate service issues, answer complaints and resolve disputes. We rely on contract where needed to fulfil our agreement with you, legitimate interests in resolving issues and establishing or defending claims, and legal obligation where a specific duty applies, including handling data-protection complaints.

Security and maintenance

We use technical logs, account events and relevant support information to detect misuse, diagnose faults and keep the platform available and secure. We rely on legitimate interests in protecting customers and systems and, where applicable, our legal obligations concerning personal-data security. Technical suppliers acting for us process this information on our instructions.

Marketing

We do not currently send promotional marketing emails. The public contact form is used so that we can reply to your enquiry. Service, security and account messages are not dependent on marketing permission. If we later send optional promotional communications, we will obtain consent where required or, for our own similar services to existing customers, meet the soft opt-in conditions and provide an opt-out when details are collected and in each message.

Legal requests and emergencies

We use or disclose relevant information where necessary to comply with a specific legal obligation, such as a binding court order. We may rely on legitimate interests for proportionate fraud prevention or legal claims. In a genuine emergency, vital interests may apply where necessary to protect someone’s life; any sensitive information also requires an appropriate additional legal condition.

7 Information you need to provide

We identify mandatory fields when collecting information. Contact and property details, suitable access arrangements and relevant billing information may be necessary to arrange or provide the requested service. Without them, we may be unable to open an account, arrange work or complete payment. Marketing permission is optional. Where information is required by law, we explain the requirement at collection.

8 Who receives your information

We disclose information only where necessary for the purpose concerned and where we have a lawful basis. Depending on the service, recipients include:

• STS, for platform hosting and technical management as explained in section 2, and authorised technical subprocessors engaged under the applicable processing agreement.
• Assigned contractors and tradespeople, who receive the contact, location, access and work details needed for their assignment. They do not need unrestricted access to your account or unrelated documents.
• Relevant property owners, landlords, managing agents or authorised representatives, who receive appropriate updates about their properties, work, charges and complaints. We assess what can properly be shared rather than automatically disclosing all communications.
• Payment, accounting, communications, email-delivery and customer-support providers, for the functions they perform. Email is sent through the configured SMTP service when mail is enabled. [INSERT ACTUAL RECIPIENTS OR SPECIFIC CATEGORIES AND LINKS, INCLUDING THE PAYMENT PROVIDER IF USED.]
• Professional advisers, insurers, auditors, courts, regulators and public authorities where necessary for advice, claims, compliance or lawful requests.

Some recipients, such as professional advisers or payment providers, may act as independent controllers for their own defined purposes. Their privacy notices explain those uses. Processors must act under appropriate contractual restrictions.

We do not sell your personal information or share it for other organisations to market their own services to you.

If our business is transferred or reorganised, necessary information may be disclosed to professional advisers and a prospective or new operator, subject to appropriate safeguards and a lawful basis. We will explain a change of controller and any material change in use. Incorporating a company does not, by itself, make it the controller of earlier records.

9 Hosting and international processing

The Domivo application infrastructure and data are hosted and technically managed by STS. Primary hosting location: [CONFIRM COUNTRY]. Backup and disaster-recovery locations: [CONFIRM COUNTRIES].

Hosting location alone does not describe every place information is processed. Email, payment, website-protection, monitoring, support and other suppliers may process information abroad, including through remote access. [LIST ACTUAL OVERSEAS RECIPIENTS OR CATEGORIES, DESTINATION COUNTRIES AND THE TRANSFER MECHANISM FOR EACH; IF NONE, CONFIRM THAT BEFORE STATING SO.]

Where a restricted transfer outside the UK occurs, we use the applicable lawful mechanism, such as UK adequacy regulations or appropriate safeguards including the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses. Where required, we assess the protection offered and apply supplementary measures. Contact our privacy lead for information about the safeguards or a copy, subject to appropriate redactions.

10 Security and authorised access

We are responsible for implementing technical and organisational measures appropriate to the risks of our processing and for using suppliers that provide sufficient guarantees. Access should be limited to authorised people who need the information for their work.

Verified measures currently include encrypted HTTPS connections in production, hashed passwords, HttpOnly session and anti-forgery cookies, role-based access in the staff application and customer portal, staff multi-factor authentication, application security logging, and restricted container privileges. No online system can be guaranteed completely secure.

If a personal-data breach occurs, we assess it and notify the regulator and affected people where the law requires. Please contact [SECURITY OR PRIVACY EMAIL] if you believe your account or information has been compromised. Do not include passwords in your report.

11 How long we keep information

We keep personal information only for as long as needed for its purpose, applicable legal requirements and the establishment, exercise or defence of claims. Closing an account does not necessarily require immediate deletion of invoices or records needed for a live dispute. We restrict retained information to the purpose that justifies keeping it.

• Unsuccessful enquiries and quotations: [PERIOD] after the enquiry closes or the last meaningful contact.
• Account and customer relationship records: during the relationship and [PERIOD] after closure, with only necessary records retained thereafter.
• Property, job, appointment and completion records: [PERIOD] after work completion or the end of the management relationship, taking account of relevant safety, warranty and claim requirements.
• Invoices, payments and tax records: [PERIOD AND APPLICABLE START POINT] according to the accounting and tax obligations applying to the actual operator.
• Messages, uploaded files and support records: [PERIOD OR RECORD-SPECIFIC CRITERIA]. Documents forming part of a job, invoice or dispute follow the relevant retention category.
• Access codes and short-lived access instructions: until [EVENT OR PERIOD] after their operational need ends.
• Routine technical and security logs: [PERIOD]; selected incident evidence may be retained for [PERIOD OR SPECIFIC CLAIM OR INVESTIGATION CRITERIA].
• Consent and marketing records: while relied on and [PERIOD] afterwards where necessary to demonstrate compliance. A minimal suppression record is kept for [PERIOD OR CRITERIA] to honour an opt-out.
• Rights requests and privacy complaints: [PERIOD] after closure, limited to what is needed to evidence handling and address any related claim.
• Backup copies: [MAXIMUM RETENTION OR ROTATION PERIOD], including off-site and offline copies.

A documented legal hold may temporarily suspend normal deletion for relevant records. When the reason ends, the normal schedule applies. Where information is deleted from active systems but remains in a backup, it is kept beyond ordinary use until expiry. If restoration is necessary, applicable deletion and restriction instructions are reapplied.

12 Cookies and similar technologies

Our website and portal use cookies or similar browser storage to maintain sessions, support sign-in, prevent misuse and remember your cookie choices. You can accept all optional cookies, reject them, or choose groups. Essential cookies are always on. Optional cookies are off until you accept them. You can change your mind at any time through Cookie settings.

• Sign-in cookies (Domivo.Admin.Auth / Domivo.Portal.Auth): keep you signed in on the staff application or customer portal. HttpOnly, SameSite=Lax, typically up to 8 hours with sliding renewal. Essential.
• Anti-forgery cookies: protect forms against cross-site request forgery. HttpOnly, SameSite=Lax, session lifetime. Essential.
• Cookie-choice cookie (Domivo.CookieNotice): stores whether you accepted optional functional, analytics and marketing cookies. HttpOnly, SameSite=Lax, up to 1 year. Essential.
• Short-lived form and token-handoff cookies: carry a status message or a password-reset or invitation token after you open a link. HttpOnly, SameSite=Lax, minutes to hours. Essential.
• Functional cookie (Domivo.Functional): remembers helpful form choices such as whether you are a homeowner or landlord. Set only if you accept functional cookies.
• Analytics cookie (Domivo.Analytics): a first-party visitor identifier and page-view count. It is not shared with advertising networks. Set only if you accept analytics cookies.
• Marketing cookie (Domivo.Marketing): a first-party identifier so we can later send optional promotions. We do not load third-party advertising cookies. Set only if you accept marketing cookies.

Accepting this privacy notice is not consent to optional tracking or marketing. Use Accept all, Reject optional, or Choose optional cookies. Browser settings can also restrict storage, although blocking essential cookies may prevent sign-in or form submission.

13 Automated decisions and artificial intelligence

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Routine reminders and status updates do not determine your legal rights. Software used to build or run the platform does not itself mean that your personal data is sent to an artificial-intelligence provider.

14 Your data protection rights

Depending on the circumstances and the basis for processing, you may ask us to:

• Provide access to your personal information and an explanation of how we use it.
• Correct inaccurate information or complete information that is incomplete.
• Erase information where the legal conditions for erasure apply.
• Restrict processing in the circumstances provided by law.
• Provide information you supplied in a structured, commonly used, machine-readable form, and transmit it to another controller where technically feasible, when portability applies to automated processing based on consent or contract.

Where we rely on consent, you can withdraw it at any time by contacting our privacy lead or using the relevant unsubscribe or settings control. Withdrawal does not affect the lawfulness of processing before it was withdrawn.

Your right to object

You can object at any time to processing based on legitimate interests for reasons relating to your particular situation. We must stop unless the law permits us to continue, for example because of compelling legitimate grounds overriding your interests, rights and freedoms, or the establishment, exercise or defence of legal claims.

You have an absolute right to object to the use of your personal information for direct marketing, including related profiling. We will stop that use when you object. Use the unsubscribe option or contact [PRIVACY EMAIL].

Making a request

Contact [PRIVACY EMAIL] or [POSTAL ADDRESS], or use the public contact form. You do not need to use a special form or legal terminology. We may request proportionate information to verify identity or authority and, where appropriate, clarify the request. We normally respond without undue delay and within one month. Where the law allows an extension, pause or different start point, we explain this and any action needed from you.

Requests are normally free. If a lawful exception permits a fee or refusal, we explain the reason and your complaint options. Rights are not absolute; information may need to be retained for legal obligations or claims, and we must protect other people’s rights. Where another organisation is the controller, we will help identify it and deal with the request according to our role.

15 Privacy complaints

If you are concerned about our handling of your personal information, email [PRIVACY COMPLAINTS EMAIL] or write to [POSTAL ADDRESS]. Explain what happened and the outcome you are seeking. You do not need to pay or use a particular form. Let us know if you need help or an accessible way to complain.

We acknowledge data-protection complaints within 30 days, make appropriate enquiries and keep you informed. We provide an outcome without undue delay, explaining our findings and any action taken. The acknowledgement period is not a substitute for the timescale applying to a separate rights request.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. The ICO generally expects you to give the organisation an opportunity to address your concern first.

• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

16 Changes to this notice

We review this notice when our services or processing change. The effective date and version appear at the beginning. For material changes, including a change of controller after incorporation, we provide appropriate notice. If we intend to use information for a new purpose, we explain that use and establish the required legal basis before starting it. An update does not itself amount to your consent.

Back to sign in