Skip to main content

Privacy Policy

Effective date: 22 September 2026
Updated: 30 September 2026 (Cookiebot and reCAPTCHA wording verified).

1. Who we are

This Privacy Policy explains how SJR Data (“we”, “us”, “our”) processes personal data in connection with the SJR Data website and housing analytics / arrears portal available at https://sjrdata.com.

SJR Data is the trading name of Clear Arrears Limited, a company registered in England and Wales (company number 09455934). Registered office: 1 Park Road, Hampton Wick, Kingston upon Thames, Surrey, KT1 4AS. ICO registration number ZC257613.

For privacy enquiries, contact our Data Protection Officer (DPO), Simon Raine, at simon@sjrdata.com.

2. What the service is

SJR Data provides a business-to-business (B2B) housing analytics and arrears management portal used by housing organisations (for example local authorities and housing providers) to support rent arrears, account analysis, correspondence and related operational workflows. The service processes housing and related operational data uploaded or supplied by the customer organisation — typically transactional rent account data turned into usable reports and operational views.

3. Personal data we process

Depending on how the service is used, we may process:

  • Account and contact data — name, email address, telephone number and related profile details used for login, account administration and security contacts. User accounts are granted centrally by SJR Data at the request of our customers and are removed once no longer active.
  • Authentication and security data — passwords (stored in hashed form), multi-factor authentication records (including SMS one-time passcodes and, where an administrator opts in, WebAuthn/passkey credential data), login/session logs, IP addresses, device/browser metadata and security event logs.
  • Service usage data — activity within the portal needed to operate features, support users and maintain security.
  • Customer-uploaded housing / operational data — Excel and other files or records uploaded by authorised users on behalf of their organisation. These datasets may include personal data relating to tenants, residents or other individuals as determined by the customer (for example names, addresses, account references, balances and arrears history).
  • Communications data — contents of support messages (including live chat where used) and transactional emails or SMS we send (for example password resets and security codes).

We do not sell personal data. We mainly send transactional security and account messages rather than marketing. We do not seek special category data (for example medical details, sexual orientation or religious affiliation) about portal users for account administration.

4. Purposes of processing

We process personal data to:

  • provide, maintain and improve the SJR Data service;
  • authenticate users, including SMS OTP via Twilio where SMS two-factor authentication is enabled, and optional WebAuthn/passkeys for administrators alongside SMS or authenticator 2FA;
  • protect the service (fraud prevention, abuse detection, malware scanning of uploads, audit logging);
  • provide customer support and operational notices;
  • comply with legal obligations that apply to us; and
  • manage our relationship with customer organisations under contract.

5. Legal bases

Under UK data protection law, our processing is typically based on one or more of the following:

  • Contract — where processing is necessary to provide the service the customer organisation has asked us to deliver;
  • Legitimate interests — for example securing the platform, preventing misuse, and improving reliability, balanced against individuals’ rights;
  • Legal obligation — where we must keep records or respond to lawful requests; and
  • Consent — where required for optional cookies/marketing or similar choices (we mainly send transactional security and account messages, not marketing).

Where a customer organisation uploads tenant or housing data, that organisation generally determines the purposes and means of that processing and is responsible for ensuring it has a lawful basis to upload and instruct processing of that data in the portal.

6. Processors and service providers

We use carefully selected providers to run the service. Depending on configuration, personal data may be processed by:

  • Hosting — FastComet (application hosting and related infrastructure). Access to the hosting console is limited to responsible SJR Data staff and protected with multi-factor authentication;
  • Email — Google Workspace / Gmail SMTP for transactional and support email;
  • SMS / voice messaging — Twilio for SMS OTP and related messaging features;
  • File malware scanning — Cloudmersive for scanning uploaded files;
  • Content delivery / security — Cloudflare;
  • Maps — Google Maps where map features are shown in the portal;
  • Bot protection — Google reCAPTCHA on login and related forms where enabled;
  • Consent management — Cookiebot on public and logged-in pages.

These providers process data only as needed to provide their services to us and under appropriate contractual arrangements.

7. Cookies and similar technologies

The site uses cookies and similar technologies that are necessary for the service to function and consent-management cookies. Typical categories include:

  • Login / session cookies — so you remain signed in and can access restricted areas; these are typically cleared when you log out;
  • Security / form cookies — for example CSRF protection and remembering limited form context;
  • Preference cookies — where the site needs to remember display or consent preferences;
  • Third-party cookies — where present, Google reCAPTCHA and Cookiebot.

You can control non-essential cookies through the cookie banner/tooling shown on the site and via your browser settings. Disabling necessary cookies may prevent login or other core features from working.

8. International transfers

Some providers (including Twilio, Google and Cloudmersive) may process data outside the United Kingdom. Where personal data is transferred internationally, we take steps designed to ensure appropriate safeguards are in place as required by UK data protection law (for example standard contractual clauses or other lawful transfer mechanisms used by those providers).

9. Retention

We retain personal data only for as long as needed for the purposes above. In general:

  • account data is kept while the user account is active and for a reasonable period afterwards for security, support and contractual records; inactive user accounts are removed when no longer required;
  • security and login logs are kept for a limited operational period;
  • as a standard operational practice, the application database holds around three months of transactional rent account data for each customer, unless a different retention arrangement is agreed with that customer;
  • customer-uploaded datasets are otherwise retained according to the customer organisation’s instructions and our retention practices for the service, and may be deleted or returned when an engagement ends, subject to backup and legal retention needs;
  • SJR Data does not maintain separate external backups of customer rent-account datasets beyond the hosted application environment (codebase backups are kept separately for disaster recovery and do not serve as a customer data archive).

Exact periods may vary by data type and customer requirements.

10. Your rights

Depending on your circumstances and applicable law, you may have rights to access, rectify, erase, restrict or object to certain processing, and to data portability. You may also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

To exercise rights relating to an SJR Data user account or our own processing, contact our DPO at simon@sjrdata.com. If your request concerns tenant or housing data held because a customer organisation uploaded it, we may need to direct you to that organisation as the primary controller of that data.

11. Children

The service is intended for authorised business users of housing organisations. It is not directed at children. We do not seek data relating to children for portal user accounts.

12. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will be revised when changes are published. Continued use of the service after an update means the revised policy applies to that ongoing use.

13. Contact

SJR Data
Data Protection Officer: Simon Raine
Email: simon@sjrdata.com
Website: https://sjrdata.com

This page is provided for transparency about how SJR Data handles personal data. It is not legal advice. Policies may be updated. For formal legal advice, please consult a qualified solicitor.

© 2026 Clear Arrears Limited, trading as SJR Data.
Registered in England & Wales, company no. 09455934.
Registered office: 1 Park Road, Hampton Wick, Kingston upon Thames, Surrey, KT1 4AS.