Privacy Notice

Learn how we use and protect your personal data

By registering with Keyzy (a trading name of Kollitom Ltd) you are entrusting us with your personal data. Your privacy is protected by law, and it is also protected by our privacy policies. This page gives you an idea of how we use your data and the safeguards we put in place to protect it.

You can contact our voluntarily appointed Data Protection Officer at [email protected]. If you have any concerns or wish to exercise your rights or you can write to us at Keyzy (Kollitom Ltd), LABS Atrium, Chalk Farm Road, NW1 8AH.

Our Promises:

To help you on your homeowner journey we will need data about you and your circumstances. To make this as relevant to you we will need data about you and your circumstances and in some cases share this with partners. We make the following promises about how we will treat this data:

We will only collect data about you that is relevant and necessary;
Your data will only be held on systems that meet compliance standards;
Your data will only be accessed by those who need it, and we will minimise the amount of data that is processed, wherever possible;
We will only share data with third parties that meet our own privacy standards for the purposes of trying to secure you funding unless either you have agreed to share data, we are required to share it by law or we need to fulfil our service commitments to you through credit reference agencies (see below) and other partners;
We will always remember that it is your personal data, not ours. As such we will ensure complete transparency and openness with you wherever possible.
We respect your rights as outlined in the next section and will respond to all requests promptly.

Or, you can email us on [email protected]

Your Rights:

You may have the following rights over any data we hold about you:

Request a copy of personal information we hold about you.
Ask that we update the personal information we hold about you or correct such personal information that you think is incorrect or incomplete.
Ask that we delete personal information that we hold about you or restrict the way in which we use such personal information.
Object to our processing of your personal information; and/or
Withdraw your consent to our processing of your personal information (to the extent such processing is based on consent and consent is the only permissible basis for processing).

You can read more about your rights here.
If you would like to uphold your rights then please contact our Data Protection Officer at [email protected].
If you are dissatisfied with our response you also have the right to lodge a complaint with the Data Protection Authority. This can be done at https://ico.org.uk/concerns.

Collecting Data:

We collect information about you in two key ways:

From you – The more information you provide the better the insights we can provide and the easier it is to align your circumstances with our partners. For example, you may share information for us to assess your suitability for a mortgage; banking transactions; car and other insurances or other data associated with a product you express an interest in or you signed up or our newsletter, or met one of us at events or meetings or have approached us on social media ;
From others – this is data about you that we may hold from credit rating agencies, mortgage providers, especially if you have had a mortgage offer rejected, mortgage brokers and their agents or from proactive marketing activity and referrals. We may also receive data from other partners we use for prizes, competitions and offers.

We try and minimise the personal data held on you. Typically, this is restricted to: the information needed to buy a home with our partners:

Identity Data including your first name, last name, current and previous address and date of birth. We may also ask you for a selfie or a picture of your passport or driving license to confirm identification as part of our legal responsibilities.
Contact Data including email address, telephone numbers, home address, employer address, employer name.
Account Data including information you give us when you register your account.
Financial Data including account and card payment details, bank income, NI Number, savings, spending, linked bank account details and credit history and verification of this data (see below).
Technical Data including internet protocol (IP) address, browser type and version, location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the website and services.
Application Data including details about your family and living situation, property preferences and housing history.
Usage Data including information about how you use our website and services.
Marketing and Communications Data including your consent, if required, to get updates from us.

Our website and other materials sent to you may contain links to other third party websites. We may also offer buttons to social media that link to third party services. We're not responsible for the content or the data privacy these sites provide through their tools or sites.

Special Categories of Data

In some cases, we may need to process "special categories" of your personal data. This data requires a higher level of governance. We will not usually ask for this type of data, however, if you belong to a union for example and link your accounts and spending through the app or you provide us with other special category data, for example to let us know that you're vulnerable we will be processing this data. This data will not be used for any other purpose whilst identified to you and by using the app you acknowledge and agree that this processing is done with your consent.
We will only ask about special categories of data if we think it is causing a difficulty with your account. We will always explain why we are asking for it and how we might use it.

Processing your Data

Data is processed/stored locally and on encrypted third party hosted cloud services. We use several different platforms to deliver our services including Microsoft, Box, Monday, Google, Meta and Hotjar. In addition, we may use Large Language Models (LLM) to help us fulfil some of our services. A list of these systems can be provided on request. These services all have strong data security at the heart of their systems including ISO27001 and SOC2 certification. We ensure that access to these services is strictly controlled and include strong authentication processes like Multi Factor Authentication.
Due to the service providers locations, some data will either be in UK, EEA/EU data centres or on US based servers that have demonstrated strong Data Security. We may also process your data in countries outside the UK or European Union from time to time in other aspects of our business.
Further to Section 119A of the Data Protection Act 2018 and noting Case C-311/18 in the European Court of Justice, if your data is transferred or processed outside of the UK or EEA we ensure the safeguards of International Data Transfer Agreements (IDTAs) or Addendums are enforced. Where this is not possible, we ensure that European Standard Contractual Clauses are entered.
We regularly review suppliers for data security compliance to ensure your data is safe and track where your data is held.
We will never ask you for your username or password for your account or ask you for any credentials for other applications or websites.

What we use your Data for

We use your data primarily to qualify you as a potential Keyzy customer. We might use your information to:

Assess your creditworthiness and whether you can afford to take the product;
Ensure any offers provided to you are appropriate to your circumstances;
Verify the accuracy of the data you have provided to us;
Prevent criminal activity, e.g. fraud and money laundering;
Manage your account(s);
Trace and recover any debts;
Work out if you are a suitable candidate if you apply for an employment role;
Collect and share credit data about you and other applicants;
Link to your various financial accounts with an Open Banking provider;
Provide marketing information about us and our services (you can unsubscribe any time);
Let you know about any changes to the website and service;
Collect for analytics purposes information about your journey with us including aggregating this data.

Calls may be recorded for information holding, quality and training purposes. All our processes are subject to various internal policies to ensure that your data privacy and security is upheld.

Legal Basis for Processing your Data

Your data is only processed based on a defined legal basis. These are:

Consent – For most of the data you provide us directly we ask for your consent to process it for the purposes of fulfilling our service to you. This consent is asked for when you sign up and includes your identity and financial information. We also use it for our marketing communication with you.
Legitimate Interest – We may require using some of your data for our Legitimate Interests, for example data analytics and making recommendations to you.
Legal Obligation – We may need to process some of your data for legal obligations.

Credit Reference Checks

As part of our process, we carry out credit and identity checks with one or more credit reference agencies (CRAs). We submit your personal information to the CRAs as part of processing your application.

This includes income and expenditure verification that will link your financial records to our third party providers systems. We use TrueLayer Open Banking APIs to connect your financial accounts when you add them to your account. TrueLayer is a secure financial technology provider that connects your bank account to our service for seamless and safe transactions. When your financial data is linked a hard search against your credit file will be produced. This enables us to quickly establish that Keyzy is affordable for you.

To find out more information, you can view the TrueLayer Terms of Service and TrueLayer Privacy Policy.

If you become a Keyzy customer we may also do regular checks in the future to manage your account.

The information regarding your rental payments and track record as a tenant, will be shared with Equifax Ltd. Equifax will add this information to the credit reference data it holds about You and use it as a controller, in accordance with its fair processing notice (a copy of which can be found by following the link below), including to assist other landlords and organisations to:

Assess and manage any new tenancy agreements You may enter into;
Assess your financial standing to provide You with suitable products and services;
Manage any accounts that you may already hold, for example reviewing suitable products or adjusting your current product in light of your current circumstances;
Contact You in relation to any accounts you may have and recovering debts that you may owe;
Verify your identity and address to help them make decisions about services they offer;
Help prevent crime, fraud and money laundering;
For Equifax to undertake statistical analysis, analytics and profiling,
And for Equifax to conduct system and product testing and database processing activities, such as data loading, data matching and data linkage.

We will continue to exchange information about you with CRA’s while you have a relationship with us. We will also inform the CRA’s about your settled accounts. If you borrow and do not repay in full or on time, CRA’s will record the outstanding debt. This information may be supplied to other organisations by CRA’s.
When CRA’s receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.
If you would like to see more information on these, and to understand how the credit reference agencies each use and share rental data as bureau data (including the legitimate interests each pursues) this information is provided in this link: www.equifax.co.uk/crain (Credit Reference Agency Information Notice (CRAIN)). (For a paper copy, please get in touch with us or with Equifax).
Please be aware that Equifax may continue to hold and use your information following any termination of your services.

Joint Applications

If you are making a joint application, or tell us that you have a spouse or a financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application.
CRA’s will also link your records together and these links will remain on your and their files until such time as your partner successfully files for a disassociation with the CRA’s to break the link.

Sharing your Data

So we can give you the best service, we might need to share your personal information with other trusted third parties in addition to Credit Reference Companies. This includes where processing is within the same group as our business or organisation and is obligated to uphold the same standards of Data Protection and Security. For example, with our sister company Klink App Ltd. When we do this, we will use the consent you give us as part of your application, even if you were on our wait list, you weren’t successful with your application or you were not the main applicant, to invite you to use the app.
We will not share your information with other external organisations except as part of providing a product or service to you and/or when legally obliged to.

Retaining your Data

Dependant on the data you provide us and for what purpose it is provided we may need to retain your data for up to 6 years after you are no longer a customer of us. If you wish to find out more about your specific data retention, please contact us.

Data Permissions

Every marketing email sent from us allows you to opt out of receiving further emails from us, except for the purposes of fulfilling any contractual arrangements.
You can also contact us at the email address above and request to opt out, view, export or delete your data.
If you request for your data to be deleted, your name and email address will be added to an exceptions list and all other data removed to the extent possible, except where we are legally obliged to retain the data or where we need your data to fulfil our service to you.

Legal Compliance

We seek to uphold our legal obligations as covered by the Data Protection Act 2018, Data Use and Access Act 2025 and the General Data Protection Regulation 2016. Our Data Protection Authority is designated as the Information Commissioners Office (ICO).
This Privacy Policy is reviewed on a regular basis and was last reviewed in July 2025.