1. Who we are
OkToLive Ltd ("OkToLive", "CheckHMO", "we", "us", "our") operates the websites at oktolive.com and checkhmo.co.uk — a UK rental licensing verification platform that lets tenants, landlords, and property professionals check whether a property holds the required HMO or selective licence.
OkToLive Ltd is the data controller for personal data processed through this platform.
Postal address: OkToLive Ltd, [Registered Address], United Kingdom
2. Data we collect
2a. Public visitors (free search)
When you use the free property search without identifying yourself:
- We store a monthly search count in your browser (no personal data).
- We do not use cookies or tracking pixels at this stage.
2b. Identified visitors (after free limit)
When you choose to identify yourself to continue searching for free, we collect and store:
| Data | Required? | Purpose |
|---|---|---|
| First name | Yes | Personalise your experience |
| Last name | Yes | Identity verification on erasure requests |
| Email address | Yes | Restore your session across devices, contact you about service updates |
| Phone number | Optional | Future premium account features only |
This data is stored in our secure database and also cached in your browser's localStorage so you don't need to re-enter it on return visits.
2c. Licence register data (landlords / licence holders)
We process publicly available HMO licence register data published by UK local councils under their statutory obligations. This data may include names and addresses of licence holders and property managers. We do not collect this data directly from individuals — it is sourced from official council open data registers.
2d. Staff accounts
Council and admin staff who access the authenticated dashboard have an account with a name, email address, and hashed password. This data is used solely for authentication.
3. Lawful basis for processing
| Processing activity | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Collecting visitor name, email, phone at sign-up | Consent (Art. 6(1)(a)) — you tick a checkbox at sign-up; you may withdraw at any time by requesting erasure |
| Processing publicly available licence register data (landlord/manager names, addresses) | Legitimate interests (Art. 6(1)(f)) — providing transparent access to statutory public records that councils are legally required to publish |
| Staff account authentication | Contract (Art. 6(1)(b)) — necessary to provide the contracted service to council partners |
| Storing monthly search count in browser | Not personal data; necessary for core service functionality — no legal basis required |
4. How we use your data
- To provide and personalise the property licence search service
- To allow you to restore your session without re-entering your details
- To understand aggregate usage patterns and improve the platform
- To contact you about significant service changes (staff accounts only)
- We never sell, rent, or trade your personal data
- We never use your data for unsolicited marketing
6. How long we keep your data
| Data | Retention period |
|---|---|
| Visitor profile (name, email, phone) | Until you request erasure, or 24 months from last activity — whichever is sooner |
| Licence register data | Updated on each council upload; superseded records are overwritten |
| Staff account data | Duration of council partnership + 12 months |
| Browser search counter | Cleared at the end of each calendar month |
8. Your rights under UK GDPR
As a data subject you have the following rights. To exercise any of them, email hello@oktolive.com or use the in-app options described below.
| Right | How to exercise it |
|---|---|
| Access — receive a copy of your data | Email hello@oktolive.com |
| Erasure — delete your personal data | Click "Delete my data" in the top navigation bar when signed in, or email us |
| Rectification — correct inaccurate data | Email hello@oktolive.com |
| Portability — receive data in a portable format | Email hello@oktolive.com |
| Restrict processing | Email hello@oktolive.com |
| Object to processing (e.g. legitimate interests) | Email hello@oktolive.com |
| Withdraw consent at any time | Click "Delete my data" when signed in, or email us; withdrawal does not affect prior lawful processing |
We will respond to requests within 30 days (extendable by a further two months for complex requests, with notice).
9. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include:
- Encrypted connections (HTTPS / TLS) on all endpoints
- Passwords stored using bcrypt hashing — never in plain text
- JWT authentication tokens with expiry for staff access
- Access controls limiting staff data visibility to their council's records
- Database hosted with access controls and encryption at rest
In the event of a personal data breach likely to result in a risk to individuals' rights, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33/34.
10. Children
This service is intended for adults (18+). We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact hello@oktolive.com immediately.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced via a banner on the site and, where possible, by email to registered users. The "Last updated" date at the top of this page always reflects the most recent version. Continued use of the service after changes constitutes acceptance of the updated policy.
If we change how we use your data in a way that requires fresh consent, we will ask you to consent again before processing continues.
12. Contact & complaints
If you are unhappy with how we have handled your personal data you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK supervisory authority:
🌐 ico.org.uk/make-a-complaint · 📞 0303 123 1113
We would appreciate the opportunity to address your concern before you approach the ICO, so please contact us first.