UK GDPR Article 30 — Record of personal data processing activities for residential block management.
🇬🇧 UK Data Residency Commitment
All personal data is stored exclusively in UK-based data centres. This applies to primary databases, backups, and system logs. No personal data is transferred outside the United Kingdom without appropriate safeguards under UK GDPR Chapter V.
| ID | Purpose | Data Categories | Legal Basis | Retention | Recipients | Data Residency |
|---|---|---|---|---|---|---|
| PA-001 | Block Management Service Delivery Core application operations: managing blocks, units, leaseholders, and property records for residential block management. | Leaseholder names, Email addresses, Phone numbers, Correspondence addresses, Lease details, Unit assignments | Contract (Art. 6(1)(b)) | Lifetime of management agreement + 6 years | Neon (database — UK region) | UK |
| PA-002 | Service Charge & Financial Processing Processing service charge demands, recording payments, managing arrears, ground rent tracking, and financial reporting. | Leaseholder names, Service charge amounts, Payment records, Ground rent amounts, Arrears data, Bank account details (encrypted AES-256-GCM) | Contract (Art. 6(1)(b)) + Legal Obligation (Art. 6(1)(c)) | 7 years (Companies Act 2006 / HMRC) | Neon (database — UK region) | UK |
| PA-003 | Client Money Handling (FCA/CASS) Ring-fenced client money accounts via Calmony, CASS-compliant reconciliation, segregated fund management per block. | Bank sort codes (encrypted), Account numbers (encrypted), Transaction references, Reconciliation records | Legal Obligation (Art. 6(1)(c)) — FCA CASS Rules | 7 years (FCA CASS regulations) | Calmony (banking partner) | UK |
| PA-004 | Leaseholder Ownership History Immutable audit trail of leaseholder changes per unit. Required for conveyancing, title records, and lease event tracking. | Previous/new leaseholder names, Email addresses, Phone numbers, Transfer dates, Transfer notes | Legal Obligation (Art. 6(1)(c)) — Land Registry / Conveyancing | Indefinite (legal requirement for title records) | None (internal) | UK |
| PA-005 | Managing Agent Regulatory Compliance Storing ARMA, RICS, and FCA registration details, client money protection records, and professional indemnity insurance for regulatory compliance. | Company registration numbers, Regulatory membership numbers, Insurance policy details, FCA reference numbers | Legal Obligation (Art. 6(1)(c)) | Lifetime of organisation + 6 years | None (internal) | UK |
| PA-006 | Platform Billing & Subscriptions Processing platform subscription payments, generating invoices, and managing billing for managing agents. | Email address, Name, Payment method (via Calmony Pay), Invoice history | Contract (Art. 6(1)(b)) | 7 years (financial records) | Calmony Pay (payment processor) | UK |
| PA-007 | Transactional Email & Communications Sending service charge demand notifications, team invitations, compliance alerts, and system notifications. | Email addresses, Names, Communication content | Contract (Art. 6(1)(b)) | 30 days (email logs) | Resend (email delivery) | UK processing, email delivery may transit US infrastructure |
| PA-008 | Security & Audit Logging Logging state-changing operations for security monitoring, compliance auditing, and incident response. | User ID, Action performed, IP address, Timestamp, Resource affected | Legitimate Interest (Art. 6(1)(f)) | 90 days | None (internal) | UK |
| PA-009 | GDPR Data Subject Requests Processing and tracking Subject Access Requests, erasure requests, and other data subject rights under UK GDPR. | Requester name, Email address, Relationship to organisation, Request details | Legal Obligation (Art. 6(1)(c)) — UK GDPR | 3 years after request completion | None (internal) | UK |
| PA-010 | Role-Based Access Control Managing platform roles (Principal, Property Manager, Read-Only, Leaseholder, Freeholder) and access permissions. | User ID, Role assignment, Block/owner scope, Assignment history | Contract (Art. 6(1)(b)) + Legitimate Interest (Art. 6(1)(f)) | Lifetime of user account | None (internal) | UK |
| PA-011 | Analytics (Optional) Tracking usage patterns to improve the platform. Only collected with explicit user consent. | Usage events, Page views, Feature interactions (anonymised) | Consent (Art. 6(1)(a)) | 90 days | None (internal) | UK |
Data Controller
{{COMPANY_NAME}} — {{COMPANY_ADDRESS}}
Data Protection Officer: {{DPO_EMAIL}}
Supervisory Authority
Information Commissioner's Office (ICO) — ico.org.uk