Last updated: 3 July 2026
Umoja Group Ltd ("Umoja", "we", "us", "our") is a company registered in England and Wales. We operate the Umoja platform at umojauk.app, which facilitates the sale of tenanted properties by rewarding tenant co-operation. Company number: —.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Umoja Group Ltd is the data controller.
Umoja Group Ltd is registered as a data controller with the Information Commissioner's Office (ICO), reference ZC186372 (verify on the ICO register).
Data Protection Contact:
Email: [email protected]
Address: Umoja Group Ltd, England, United Kingdom
We collect and process different data depending on your role on the platform:
If you sign in using Google, LinkedIn, Facebook, or Instagram, we receive your name, email address, and profile picture from that provider. We do not post to your social accounts or access your contacts.
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| Creating and managing your account | Contract performance (Art. 6(1)(b)) |
| Facilitating the property sale process | Contract performance (Art. 6(1)(b)) |
| Processing payments (Activation Cost, Karibu Award, Partner Incentive) | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (account updates, sale progress, payment confirmations) | Contract performance (Art. 6(1)(b)) |
| Maintaining audit trails (IP address, timestamps, e-signatures) | Legitimate interest (Art. 6(1)(f)) — legal compliance and fraud prevention |
| Sending a landlord's tenant contact details to the platform for invitation | Legitimate interest (Art. 6(1)(f)) — necessary to deliver the service, with landlord confirmation of authority |
| Sharing property and financial details with conveyancers | Contract performance (Art. 6(1)(b)) — necessary for completion |
| Preventing fraud, enforcing terms, and resolving disputes | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for marketing purposes without your explicit consent. We do not sell, rent, or trade your personal data to third parties. We do not use your personal data to train AI or machine learning models.
| Recipient | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing | Email, payment amount, card details (handled by Stripe directly) |
| Supabase | Database hosting and authentication | Account data, property data |
| Plunk | Transactional email (account emails, sale progress, receipts) | Email addresses, email content |
| Vercel | Website hosting | IP addresses (server logs) |
| Railway | Backend hosting | IP addresses (server logs) |
| Conveyancers | Facilitating property sale completion | Property address, Umoja Fund amount, property reference |
| Cloudflare | DNS, CDN, and cookieless web analytics | Server logs containing IP addresses; aggregate traffic data |
| Brevo | Cold outreach email delivery (separate from transactional email) | Email addresses, email content |
| Meta Platforms Ireland Ltd | Advertising measurement via the Meta Pixel (consent-based only) | Browser events, hashed identifiers, IP address. Transfers governed by adequacy decision (Ireland). |
| Zoho Corporation | Inbound email hosting for hello@ and support@ mailboxes | Email content you send to us |
All third-party processors are bound by data processing agreements and operate in compliance with UK GDPR. Where data is transferred outside the UK, appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).
Our platform deliberately limits what each party can see, to protect all users and maintain fairness:
This is a deliberate design feature to protect commercial confidentiality and ensure fair dealings between all parties.
The Umoja Score is calculated using an algorithm based on two factors: whether you vacated within the agreed exit window (evacuation score) and your rent payment history during the sale period (rent score). The score directly affects the Karibu Award amount you receive.
This is not a purely automated decision. The landlord reviews each score within a set review window, and you have the right to challenge the outcome. Challenges are reviewed by our admin team — a human, not an algorithm — and can result in the score being revised. You are informed of the score, the breakdown, and the challenge window before the score is finalised.
Under Article 22 of the UK GDPR, you have the right to request human intervention in any decision that significantly affects you. Raising a challenge via the tenant dashboard is the standard route for this. If for any reason you are unable to use the dashboard, email [email protected].
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account plus 6 years |
| Contract and e-signature records | 6 years from completion (legal requirement) |
| Payment records | 6 years from transaction (HMRC requirement) |
| Audit trail (IP, timestamps) | 6 years from creation |
| Departure evidence (photos) | 12 months after score finalisation, then deleted |
| Promo code usage records | 6 years from last use (HMRC requirement) |
After the retention period, data is securely deleted or anonymised.
Under UK GDPR, you have the following rights:
To exercise any of these rights, email [email protected]. We will respond within 30 days. We may extend this by up to two further months for complex or numerous requests, in which case we will tell you within the initial 30-day window why the extension is necessary.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
We use minimal cookies and local storage necessary for the platform to function:
| Item | Purpose | Duration |
|---|---|---|
| Supabase auth token | Keeps you logged in | Session / 7 days |
| localStorage items | Stores referral source attribution, session preferences, and your cookie consent choice | Until cleared |
Meta Pixel (consent-based): if you accept the cookie banner, we load the Meta Pixel — a third-party analytics and advertising tool provided by Meta Platforms Ireland Ltd — so we can measure the effectiveness of our advertising on Facebook and Instagram and understand how landlords find us. The pixel sets cookies under the .facebook.com domain. If you decline the banner, the Meta Pixel is not loaded and no advertising cookies are set. You can change your choice at any time by clearing your browser's local storage for this site, which will cause the banner to reappear on your next visit.
Cloudflare Web Analytics: we use Cloudflare's cookieless, privacy-first web analytics to measure aggregate site traffic. This does not use cookies and does not track individual users; we understand this to fall outside the scope of consent requirements under UK GDPR.
We do not use Google Analytics.
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
Our platform is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this privacy policy from time to time. We will notify registered users of material changes by email. The "last updated" date at the top of this page indicates when the policy was last revised.
Umoja Group Ltd
Address: Umoja Group Ltd, England, United Kingdom
Email: [email protected]
Website: umojauk.app