1. Introduction
PROPERTYFLOW TECHNOLOGIES LTD ("PropertyFlow", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our property management platform and services.
We are the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us at info@propertyflowltd.co.uk.
2. Information We Collect
2.1 Information You Provide
We collect information you voluntarily provide when using our services:
- Account Information: Name, email address, phone number, and password when you create an account
- Property Information: Property addresses, descriptions, photographs, and compliance documents (Gas Safety certificates, EICR, EPC, STL Licences)
- Financial Information: Bank account details for Open Banking connections (via TrueLayer) and transaction records. Note: We do not collect or store credit/debit card numbers - subscription payments are processed securely by Stripe
- Business Information: Company details, landlord information, and booking data synced from platforms like Airbnb and Booking.com via Channex
- Communications: Messages and correspondence with our support team
2.2 Information Collected Automatically
When you access our platform, we automatically collect:
- Device Information: Browser type, operating system, device identifiers
- Usage Data: Pages visited, features used, time spent on the platform
- Log Data: IP addresses, access times, and referring URLs
2.3 Information from Third Parties
We receive information from integrated services:
- Channex: Booking data from Airbnb, Booking.com, and other connected platforms
- TrueLayer: Bank account information and transaction data (with your explicit consent)
3. How We Use Your Information
We use your information for the following purposes:
- Service Delivery: To provide property management features, sync bookings, track compliance, and process payments
- Open Banking Services: To connect your bank accounts via TrueLayer for automatic payment detection and landlord payouts (FCA-regulated)
- Compliance Management: To track document expiry dates and send automated reminders for Gas Safety, EICR, EPC, and STL Licence renewals
- Communication: To send service updates, booking confirmations, compliance alerts, and respond to your enquiries
- Platform Improvement: To analyse usage patterns and improve our services
- Legal Compliance: To comply with applicable laws and regulations
4. Legal Basis for Processing
We process your personal data based on the following legal grounds under UK GDPR:
- Contract Performance: Processing necessary to provide our services to you
- Legitimate Interests: Processing for business purposes such as fraud prevention, security, and service improvement
- Consent: Where you have given explicit consent, such as for Open Banking connections
- Legal Obligation: Processing required to comply with legal requirements
5. Data Sharing and Disclosure
We may share your information with:
- Service Providers: Third-party providers who assist in operating our platform, including:
- Microsoft Azure (cloud hosting and database)
- Channex (booking channel management)
- TrueLayer (Open Banking services - FCA-regulated)
- Cloudflare (security and document storage)
- Sentry (error monitoring)
- Business Partners: Cleaning and maintenance service providers you choose to work with through our platform
- Legal Requirements: When required by law, court order, or governmental authority
- Business Transfers: In connection with any merger, acquisition, or sale of company assets
We do not sell your personal data to third parties.
6. Open Banking and Financial Data
PropertyFlow uses TrueLayer, an FCA-regulated Open Banking provider, to access your bank account information with your explicit consent. This enables:
- Automatic detection of booking platform payments (e.g., Airbnb payouts)
- Automated landlord and service provider payouts
- Transaction matching and revenue reconciliation
Important: We never store your banking credentials. All bank connections are made securely through TrueLayer's FCA-regulated infrastructure. You can revoke access at any time through your bank or our platform settings.
7. Data Security
We implement appropriate technical and organisational measures to protect your data:
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Secure authentication using JWT tokens and bcrypt password hashing
- Role-based access controls
- Regular security assessments
- Data stored on Azure infrastructure within the UK/EU
8. Data Retention
We retain your personal data for as long as necessary to:
- Provide our services to you
- Comply with legal obligations (e.g., financial records for 6 years)
- Resolve disputes and enforce agreements
Compliance documents are retained for the duration required by Scottish and UK law, plus a reasonable period thereafter.
9. Your Rights
Under UK GDPR, you have the following rights:
- Access: Request a copy of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data (subject to legal requirements)
- Restriction: Request limited processing of your data
- Portability: Receive your data in a portable format
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent at any time where processing is based on consent
To exercise these rights, contact us at info@propertyflowltd.co.uk.
10. Cookies
Our platform uses essential cookies for authentication and security. We do not use advertising or tracking cookies. For more information, please refer to our cookie settings within the platform.
11. International Transfers
Your data is primarily stored within the UK and EU. Where data is transferred outside these regions, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK ICO.
12. Children's Privacy
Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email.
14. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, please contact:
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.