Privacy Policy

nextroof Limited is the Data Controller for personal data processed through the nextroof platform. We are registered with the Information Commissioner's Office (ICO) in the United Kingdom. Contact: privacy@nextroof.co.uk · nextroof Limited, 20 Farringdon Road, London EC1M 3HE

We collect the following categories of personal data: Identity data: name, date of birth, nationality, government ID (for KYC/Right to Rent checks) Contact data: email address, phone number, postal address Financial data: bank account details (via open banking), transaction history, payment methods Property data: tenancy agreements, inspection reports, maintenance records Usage data: how you interact with the platform, device information, IP address Communications: messages sent via the platform, support requests AI-generated data: Kiki AI predictions, lead scores, risk assessments based on your activity

We process your data under the following legal bases: Contract performance: processing necessary to provide the nextroof service (tenancy management, rent collection, contractor matching) Legal obligation: compliance with UK law — Right to Rent checks, anti-money laundering, HMRC reporting Legitimate interests: fraud prevention, platform security, product improvement Consent: marketing communications, optional analytics (you can withdraw consent at any time)

Your data is used to: • Manage tenancy agreements, rent collection and property maintenance • Verify your identity and right to rent • Process payments and financial transactions • Power Kiki AI features including arrears prediction, lead scoring and rental valuations • Send transactional notifications (rent reminders, maintenance updates, compliance alerts) • Meet legal and regulatory obligations • Detect and prevent fraud

We share data with the following categories of third parties, all operating under data processing agreements: Payment processors: Stripe (UK/Global), Paystack (Africa) — for rent and fee processing Identity verification: Onfido, SumSub — for KYC and Right to Rent checks Open banking: TrueLayer — for affordability verification (tenant consent required) Cloud infrastructure: Microsoft Azure (UK South region) — hosting and storage AI providers: OpenAI, Anthropic — for Kiki AI features Communications: Twilio, SendGrid, 360dialog — for SMS, email, WhatsApp notifications Blockchain: Polygon network — for document anchoring (document hash only, not personal data) We do not sell your personal data to third parties.

nextroof operates across 6 markets. When you use features relating to Nigeria, Ghana, Kenya, South Africa, or UAE, data may be transferred to those jurisdictions. All international transfers are made under appropriate safeguards (UK Standard Contractual Clauses or adequacy decisions where available).

We retain personal data for as long as necessary for the purpose it was collected, or as required by law: Active account data: retained for the duration of your account Tenancy records: 6 years from tenancy end (UK Landlord & Tenant Act) Financial records: 7 years (HMRC) Identity verification: 5 years (anti-money laundering regulations) Audit logs: 3 years (fraud prevention, anonymised) Marketing data: until consent is withdrawn

Under UK GDPR, you have the right to: • Access your data (Subject Access Request — Art. 15) • Correct inaccurate data (Art. 16) • Erase your data (Right to Be Forgotten — Art. 17) • Restrict processing (Art. 18) • Data portability (Art. 20) • Object to processing (Art. 21) • Withdraw consent at any time To exercise your rights, visit your account's Privacy & Data Rights page or email privacy@nextroof.co.uk. We respond within 30 days.

We use essential cookies for authentication and security, and optional analytics cookies (with consent). See our Cookie Policy for full details.

We protect your data with: AES-256 encryption at rest, TLS 1.3 in transit, role-based access control, multi-factor authentication, regular penetration testing, and SOC 2 Type II audit (in progress).

If you have concerns about how we process your data, contact our Data Protection Officer at privacy@nextroof.co.uk. You also have the right to lodge a complaint with the ICO at ico.org.uk.

We may update this policy. We will notify you of significant changes by email or in-app notification. The "Last updated" date below reflects the current version.