1. Data Controller
{{COMPANY_NAME}}(“we”, “us”, “our”) is the data controller for personal data processed through the agentOS Block Manager platform. We are registered with the Information Commissioner's Office (ICO).
Data Protection Officer: {{DPO_EMAIL}}
2. UK Data Residency
All personal data processed by this platform is stored exclusively in UK-based data centres. This is a hard requirement that applies across all infrastructure components, including primary databases, backups, and system logs.
We do not transfer personal data outside the United Kingdom unless required to do so and subject to appropriate safeguards under UK GDPR Chapter V (e.g. UK adequacy decisions, standard contractual clauses, or binding corporate rules).
3. Data We Collect
In the context of residential block management, we process the following categories of personal data:
- Managing agent data: company name, registration numbers (Companies House, ARMA, RICS, FCA), contact details, regulatory information
- Leaseholder & freeholder data: names, email addresses, phone numbers, correspondence addresses, lease details, service charge apportionment
- Financial data: service charge demands, payment records, ground rent amounts, arrears information, bank account details (encrypted at rest per AES-256-GCM)
- Compliance data: certificate records, inspection histories, contractor details
- Account data: user name, email address, organisation membership, roles and permissions
- Technical data: IP address, browser type, session data, audit log entries
4. Legal Bases for Processing
We process personal data under the following legal bases:
- Contract (Art. 6(1)(b)): providing block management services, processing service charge demands, managing leases
- Legal obligation (Art. 6(1)(c)): FCA client money regulations, Companies Act record-keeping, HMRC tax requirements, ARMA/RICS compliance obligations
- Legitimate interest (Art. 6(1)(f)): security monitoring, audit logging, fraud prevention, service improvement
- Consent (Art. 6(1)(a)): marketing communications, analytics cookies (opt-in only, withdrawable at any time)
5. Data Retention
We retain personal data only as long as necessary for the purposes described above. Specific retention periods:
- Account data: retained while the account is active, deleted within 30 days of account closure
- Financial records: retained for a minimum of 7 years as required by the Companies Act 2006 and HMRC regulations
- Client money records: retained for 7 years per FCA CASS requirements
- Audit logs: retained for 90 days for security purposes
- Compliance certificates: retained for the lifetime of the block under management, then 6 years after management ceases
- Leaseholder history: retained indefinitely as an immutable record of ownership changes (legal requirement for conveyancing)
6. Your Rights Under UK GDPR
Under the UK General Data Protection Regulation and Data Protection Act 2018, you have the following rights:
- Right of access (Art. 15): request a copy of all personal data we hold about you (Subject Access Request)
- Right to rectification (Art. 16): request correction of inaccurate personal data
- Right to erasure (Art. 17): request deletion of your personal data, subject to legal retention obligations (financial records must be retained for 7 years)
- Right to restrict processing (Art. 18): request that we limit how we use your data
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interest
- Rights related to automated decision-making (Art. 22): we do not use automated decision-making or profiling
To exercise any of these rights, contact our Data Protection Officer at {{DPO_EMAIL}}. We will respond within one calendar month as required by UK GDPR. Managing agents can also submit and track data requests through the platform's GDPR dashboard.
7. Financial Record Retention & Erasure Limitations
Under UK GDPR Article 17(3)(b), the right to erasure does not apply where processing is necessary for compliance with a legal obligation. For residential block management, this includes:
- Service charge records and financial transactions (7 years — Companies Act 2006)
- Client money account records (7 years — FCA CASS regulations)
- Ground rent payment records (7 years — HMRC requirements)
- Leaseholder ownership history (required for conveyancing and title records)
Where erasure is requested but financial records must be retained, we will delete all non-essential personal data immediately and schedule the remaining financial records for deletion once the retention period expires. You will be notified of what data was retained and why.
8. Sub-Processors
We use the following third-party services. All have been assessed for UK GDPR compliance and have appropriate data processing agreements in place:
- Neon — PostgreSQL database hosting (UK region)
- Vercel — application hosting and deployment (UK/EU edge)
- Calmony Pay — payment processing for subscriptions
- Resend — transactional email delivery
See our Register of Processing Activities for full details of all data processing operations.
9. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- AES-256-GCM encryption at rest for all financial data (bank account numbers, sort codes)
- TLS 1.3 encryption for all data in transit
- Row-level security (RLS) ensuring strict multi-tenant data isolation
- Role-based access control (RBAC) with five defined platform roles
- Immutable audit trails for all compliance and financial operations
- Ring-fenced client money accounts per FCA CASS requirements
10. Cookies
We use strictly necessary cookies for authentication and session management. Analytics and marketing cookies are only set with your explicit consent via the cookie banner. You can change your cookie preferences at any time.
11. Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
12. Contact
For any privacy-related enquiries, contact our Data Protection Officer at {{DPO_EMAIL}}.