Terms of Use.
Terms & Conditions
Welcome to LetRef Ltd’s website, www.letref.co.uk. If you continue to browse and use either website you are agreeing to comply with and be bound by the following terms and conditions of use, which together with our privacy policy govern LetRef Ltd’s relationship with you in relation to this website. The term LetRef Ltd, LetRef or “us” or “we” refers to the owner of the website whose registered office is LetRef Ltd, C/O Mittal & Associates Spaces, Aurora House, 71-75 Uxbridge Road, Ealing, London, United Kingdom, W5 5SL. The term “you” refers to the user or viewer of our website.
The use of the website is subject to these terms of use:
The content of the pages of this website is for your general information and use only. It is subject to change without notice. We reserve the right to update these terms from time to time without notice to you. We recommend you regularly revisit this page to ensure you have seen and are aware of our latest terms.
LetRef Ltd makes all reasonable efforts to ensure that the information contained on these websites is current, accurate and complete at the date of publication. Neither we nor any third parties provide any warranty or guarantee as to the accuracy, timeliness, performance, completeness or suitability of the information and materials found or offered on this website for any particular purpose. You acknowledge that such information and materials may contain inaccuracies or errors and we expressly exclude liability for any such inaccuracies or errors to the fullest extent permitted by law.
Your use of any information or materials on these websites is entirely at your own risk, for which we shall not be liable. It shall be your own responsibility to ensure that any products, services or information available through these websites meet your specific requirements.
This website contains material, which is owned by or licensed to us. This material includes, but is not limited to, the design, layout, look and appearance. Reproduction is prohibited other than in accordance with the copyright notice, which forms part of these terms and conditions.
All trademarks reproduced in these websites, which are not the property of, or licensed to the operator, are acknowledged on the websites.
You must not restrict any other user from using and enjoying the service; and you must not upload, post, publish, transmit, reproduce or distribute in any way, information or other material on this website without prior written permission.
Unauthorised use of this website may give rise to a claim for damages and/or be a criminal offence.
From time to time, this website may also include links to other websites. These links are provided for your convenience to provide further information. They do not signify that we endorse the website(s). We have no responsibility for the content of the linked website(s).
You may not create a link to this website from another website or document without LetRef Ltd’s prior consent, which you can obtain by emailing mail@letref.co.uk.
LetRef Ltd will endeavour to ensure that this website is accessible for 24 hours a day but will not be liable if, for any reason, this website is unavailable for any time or for any period. LetRef Ltd will have the right to suspend access to the sites temporarily or permanently and without notice.
Your use of this website and any dispute arising out of such use of the websites is subject to the laws of England and Wales.
Privacy Policy.
Effective Date: October 2026
LetRef Ltd (“LetRef”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Statement explains how we collect, use, store, and share your personal information in accordance with UK Data Protection Legislation (including the UK General Data Protection Regulation and the Data Protection Act 2018).
1. Corporate Ownership & Data Sharing
LetRef Ltd is a wholly owned subsidiary of Cumbria Capital Ltd (Company No. 12177019).
To deliver our tenancy referencing services, conduct operational oversight, manage risk, and streamline group administration, LetRef Ltd shares relevant personal data within our corporate group, specifically with:
- Cumbria Capital Ltd (Company No. 12177019, Registered Office: 101 New Cavendish Street, 1st Floor South, London, United Kingdom, W1W 6XH) – as our parent company.
- FCC Paragon Group Ltd (“FCC”) (Company No. 16024786, Registered Office: 101 New Cavendish Street, 1st Floor South, London, United Kingdom, W1W 6XH) – an affiliated entity owned by Cumbria Capital Ltd, for joint processing, service delivery, operational support, and risk management.
How Your Information is Shared
- Landlords & Letting Agents: Completed reference reports detailing salary verification, credit checks, references, and supporting documents are provided directly to the instructing letting agent or landlord. Reference reports are not issued directly to applicants by LetRef.
- Group Entities (Cumbria Capital & FCC): Your personal data may be accessed, processed, or transferred between LetRef, Cumbria Capital Ltd, and FCC Paragon Group Ltd strictly for the purposes of completing references, fraud prevention, IT administration, and legal/regulatory compliance.
- Third Parties: We may search the files of licensed credit reference agencies (who will record the search) and use Anti-Money Laundering (AML) verification providers. We will not disclose your confidential information to unapproved third parties unless required by law, court order, or in connection with fraud investigations.
2. Use of Personal Information & Purpose of Processing
We use the information you provide or that we collect about you, your company, or your guarantor to:
- Process and evaluate tenancy, guarantor, and company applications.
- Verify identity and perform Right to Rent, AML, and credit checks with licensed credit reference agencies.
- Contact named employers, previous employers, accountants, landlords, or letting agents.
- Detect, prevent, and investigate fraud, application misuse, or financial crime.
- Conduct general internet and public record searches relevant to your application.
- Keep your instructing letting agent or landlord updated on the progress and status of your referencing application.
3. Data Storage & Security
We maintain appropriate physical, electronic, and managerial safeguards to protect your data against unauthorized access, loss, or damage:
- Security Standards: LetRef is certified under the UK Government-backed Cyber Essentials Plus scheme, ensuring our systems are regularly audited against cyber threats.
- Data Transmission: All data transmitted to and from our website is secured using industry-standard SSL encryption.
- Location & Transfers: Data is stored on secure servers located within the UK / European Economic Area (EEA). Where document attachments are stored via third-party cloud providers (such as Dropbox), all international transfers comply with valid UK data transfer mechanisms (e.g., the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses / UK IDTA).
4. Data Retention & Deletion
- Online Reference Portal: On completion of your reference, the reference report and all supporting documents are retained on our secure web portal.
- Business Transaction Records: Core business transaction records and reference summary data are retained for up to 4 years from completion to maintain accurate accounting records, address complaints, and resolve potential legal claims.
- Right to Deletion: You may request deletion of your personal data at any time by contacting our Data Controller at mail@letref.co.uk. Subject to applicable legal obligations, fraud prevention mandates, or legal retention requirements, we will delete your data and issue a formal deletion certificate.
5. Cookies
Our website uses necessary session cookies to distinguish you from other users, allow form completion, and ensure secure site navigation. Data collected via cookies is aggregated and anonymous. You can restrict or disable cookies through your browser settings, though doing so may prevent referencing forms from working correctly.
6. Personal Data Breaches
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify you as soon as practically possible with guidance on the nature of the breach and steps to protect yourself. We will also report the incident to the Information Commissioner’s Office (ICO) in accordance with our statutory obligations.
7. Contact Us & Your Rights
You have rights under UK GDPR regarding access, rectification, erasure, and restriction of your personal data.
For queries, data correction requests, or deletion applications, please contact:
- Data Controller: LetRef Ltd
- Email: mail@letref.co.uk
- Parent Company: Cumbria Capital Ltd, 101 New Cavendish Street, 1st Floor South, London, United Kingdom, W1W 6XH
For further information regarding your individual rights under UK data protection laws, visit the Information Commissioner’s Office (ICO) at ico.org.uk.
Personal Information Promise.
What is the Personal Information Promise and why make one?
The ICO urges heads of organisations and government departments to sign up to the Personal Information Promise, to demonstrate their organisation’s senior level commitment to data protection. The aims of the initiative are to improve compliance with the Act and strengthen public trust and confidence in those who are entrusted with their personal information.
The promise lists a number of key commitments that senior figures will make on behalf of their organisations to protect personal information.
Download LetRef’s Promise (pdf)
What is the aim of the Promise?
The Promise is intended to help strengthen public trust and confidence in the way organisations handle their personal information. It is a clear statement from the very top of an organisation that it values the personal information entrusted to it and will put the appropriate resources in place to look after it. It also sends a clear signal to the workers in the organisation about the importance of looking after people’s personal information and that this is something taken very seriously at senior level.
Does it create additional legal obligations?
No, the Promise does not create additional legal obligations. The Promise reflects existing legal obligations in the Data Protection Act and puts them into straightforward language that individuals can readily understand. What it does do is to show a public commitment by the organisation to comply and put in place the measures that help ensure that it complies.
It is like a mission statement for the handling of personal information.
How will the ICO use it?
The ICO do not intend to use this as an additional regulatory tool – we will continue to use the Data Protection Act and associated legislation for our enforcement role.
The Promise is made as a general statement aimed at those whose personal information is held and not to the ICO. We will keep a list of those who say they are signing the Promise and put this on our website. If a compliance problem occurs it is up to organisations to reflect on whether they are living up to the Promise.
We recognise that even with the best of intentions a problem can occur or there may be legitimately held views which differ from our own. It’s the commitment to try to live up to the Promise that counts.
What is meant by ‘going further than the letter of the law’?
Many organisations already go further than the letter of the law. For example, they employ data protection officers and follow good practice standards set out in codes of practice, such as the ones issued by the ICO. This is not a commitment to do whatever a customer asks the organisation to do. Organisations can still make their own decisions.
It is about not doing the absolute bare minimum and just trusting to luck that the law is being complied with and the personal information in its care is protected.
How far do we need to go to address privacy risks first?
This is a commitment to think about the privacy and compliance implications before embarking on a new use of information or developing a new system.
At its simplest this may mean asking the data protection officer for an opinion or with something that might engage real privacy concerns considering whether a privacy impact assessment is necessary.
What does the reference to ‘treating as a disciplinary matter’ mean?
This means that there is a disciplinary sanction that can be used if there is deliberate misuse of information by staff or important safeguards are not followed.
The sanction will depend upon the nature of the contravention. A very minor one off matter may just result in a verbal warning. A much more serious one such as selling personal information to third parties for personal gain may warrant dismissal.
This does not compel an organisation to take disciplinary action on every occasion however minor but to ensure that staff understand that deliberate misuse or reckless use of personal information may result in disciplinary action being taken.
What checks do we need to do, and how do we report on how we are doing?
Most organisations have mechanisms in place to ensure they are complying with their legal obligations. This is usually done by internal checks or part of external audit procedures.
The important thing is that an organisation does not leave matters to chance and has a way of checking how well it looks after personal information. The report on progress does not need to be published separately; it can just be a short reference as part of an organisation’s annual reporting process.
Is the Promise the same as an Information Charter?
No, the two are complementary and not exclusive. The Information Charters being published by some public bodies are aimed at setting out the general standards that people can expect, whereas the Promise provides a signal from the very top of an organisation that protecting personal information is a key organisational aim. The Promise is intended to send a powerful message to the organisation’s staff and the public that appropriate resources have been allocated to protect personal information.
While there are overlaps between the Personal Information Promise and the Information Charter, there is no contradiction between the two. We see the Charter and the Promise sitting side by side where a Charter has been adopted.