Privacy Policy

1. About PropSure

PropSure Ltd provides property compliance, auditing and maintenance-management services through its website and secure client platform.

Legal name: PropSure Ltd Trading name: PropSure Company number: To be confirmed Registered office: Available once PropSure Ltd's separate registered office has been confirmed Privacy contact: privacy@prop-sure.co.uk

PropSure Ltd is the data controller for personal information collected through its website, enquiries, demonstrations, accounts, billing, marketing and its own business activities.

Where a client uploads or manages personal information through the PropSure platform, the client will normally be the data controller and PropSure Ltd will act as a data processor on the client's instructions.

Requests concerning information uploaded by a client should normally be directed to that client. PropSure Ltd will assist the client where required.

2. The laws that apply

PropSure Ltd processes personal information in accordance with applicable UK data-protection and privacy law, including:

• The UK General Data Protection Regulation
• The Data Protection Act 2018
• The Privacy and Electronic Communications Regulations 2003, as amended
• Other applicable UK data-protection and electronic-marketing legislation

3. Information we collect

Depending on how someone uses PropSure, we may collect:

• Names, job titles and employer details
• Business email addresses and telephone numbers
• Business and property addresses
• Account details and user permissions
• Login records and security information
• Enquiries, correspondence and support requests
• Subscription, billing and transaction information
• Property and building information
• Responsible-person and contractor details
• Compliance documents and certificates
• Policies, inspections and risk assessments
• Audit findings, comments and remedial actions
• Maintenance reports, locations, updates and photographs
• Contractor attendance records, reports and costs
• IP addresses, browser types and device information
• Website activity and system logs
• Cookie choices and analytics information
• Marketing preferences and consent records
• Information contained in documents submitted for AI-assisted processing

Payment-card information is entered directly into Stripe's payment system. PropSure Ltd does not intend to collect or store complete payment-card details.

4. Sensitive information

The platform is not designed for the routine storage of special-category personal information, such as:

• Medical or health information
• Biometric information
• Racial or ethnic origin
• Religious or philosophical beliefs
• Political opinions
• Trade-union membership
• Information about a person's sex life or sexual orientation

Users must not upload sensitive or excessive personal information unless it is genuinely necessary, lawful and permitted by their organisation.

Where special-category information is processed, the relevant data controller must identify both a lawful basis under Article 6 and a valid condition under Article 9 of the UK GDPR.

Information about criminal allegations, offences or convictions must not be uploaded unless there is a clear legal basis and appropriate safeguards.

5. How we collect information

We may collect information:

• When someone contacts us or completes a website form
• When someone requests a demonstration or quotation
• When a client creates or manages an account
• When an authorised user uploads information
• When staff report maintenance issues
• During audits, site visits, meetings and support work
• From a client, employer, contractor or professional adviser
• When Stripe processes a payment or subscription
• Automatically through essential cookies, security logs and approved analytics
• When someone subscribes to marketing communications

6. How we use information

We may use personal information to:

• Respond to enquiries
• Arrange demonstrations and meetings
• Prepare quotations and proposals
• Create and manage client accounts
• Provide compliance, audit and maintenance services
• Store and organise compliance evidence
• Manage policies, certificates and inspections
• Record maintenance issues
• Track faults through to completion
• Manage actions, contractors and renewal dates
• Provide reminders and service updates
• Process subscriptions, invoices and payments
• Provide technical and customer support
• Investigate faults and security incidents
• Protect accounts from unauthorised access
• Maintain platform security and service availability
• Improve the website, platform and customer service
• Meet tax, accounting, legal and regulatory duties
• Send marketing where legally permitted
• Establish, exercise or defend legal claims

We will not use personal information for an incompatible purpose unless there is a lawful basis for doing so.

7. Our lawful bases

PropSure Ltd will identify an appropriate lawful basis for each use of personal information.

We may rely on:

Contract

Where processing is necessary to:

• Provide a requested service
• Set up or manage an account
• Process a subscription or payment
• Take steps before entering a contract
• Meet our contractual obligations

Legal obligation

Where processing is necessary to comply with:

• Tax and accounting requirements
• Court orders
• Regulatory duties
• Other legal obligations applying to PropSure Ltd

Legitimate interests

Where processing is reasonably necessary to:

• Operate and improve PropSure
• Maintain business records
• Protect the platform and its users
• Prevent fraud and misuse
• Respond to business enquiries
• Communicate with relevant business contacts
• Establish or defend legal claims

Before relying on legitimate interests, we will consider the necessity of the processing, the reasonable expectations of the individual and the possible effect on their rights.

Consent

We may rely on consent for:

• Optional marketing
• Non-essential cookies
• Certain analytics technologies
• Other optional processing where a genuine choice is available

Consent can be withdrawn at any time.

Withdrawing consent will not affect processing that took place before consent was withdrawn.

8. Client-uploaded information

PropSure clients decide what information their authorised users place in their compliance centre.

This may include:

• Staff and contractor names
• Responsible-person details
• Compliance documents
• Maintenance photographs
• Comments and updates
• Audit evidence
• Inspection records
• Contractor reports
• Remedial actions

For this information:

• The client is normally the data controller
• PropSure Ltd normally acts as the data processor
• PropSure Ltd processes information only to provide the platform, agreed support and related services
• The client is responsible for having a lawful basis for collecting and uploading the information
• The client is responsible for giving appropriate privacy information to affected individuals
• The client controls user access and permissions
• Users must not upload excessive, irrelevant or unlawfully obtained information

PropSure Ltd will enter into appropriate data-processing terms with clients where required by Article 28 of the UK GDPR.

These terms will cover:

• Documented processing instructions
• Confidentiality
• Security
• Sub-processors
• Data-subject requests
• Breach assistance
• Deletion or return of information
• Audits and compliance information

9. AI-assisted processing

PropSure may use AI-assisted tools to read, classify, summarise or extract information from uploaded compliance documents.

AI results may be incomplete or incorrect. Important findings must be reviewed by a suitably competent person before being relied upon.

PropSure Ltd does not intend to use AI to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

Information submitted for AI-assisted processing will only be used for:

• Providing the requested feature or service
• Extracting relevant document information
• Supporting the user's compliance review
• Maintaining system security
• Meeting legal obligations

Clients should remove unnecessary personal and sensitive information before submitting documents for AI processing.

PropSure Ltd will review the privacy terms, security arrangements and international-transfer safeguards of AI providers before using them to process client information.

Client information must not be used to train general-purpose AI models unless this has been expressly agreed, lawfully authorised and clearly disclosed.

10. Who we share information with

Where necessary, we may share personal information with:

• Base44, which provides application, hosting, database and platform services
• Stripe, which processes payments and subscriptions
• Approved website analytics providers
• Cookie-consent providers
• Email and communication providers
• Marketing-service providers
• AI and document-processing providers
• IT, security and technical-support providers
• Accountants, insurers, consultants and solicitors
• Contractors or specialists engaged to provide an agreed service
• Regulators, courts, law-enforcement bodies and public authorities
• A purchaser or successor if PropSure Ltd is sold, transferred or reorganised

We only share information where it is necessary, proportionate and legally permitted.

Providers processing information on our behalf must be subject to suitable data-protection, confidentiality and security requirements.

PropSure Ltd does not sell personal information.

11. Sub-processors

PropSure Ltd may use approved sub-processors to provide hosting, payment, communication, analytics, security or AI services.

Where PropSure Ltd acts as a processor for a client, sub-processors will be appointed in line with the relevant client agreement and Article 28 of the UK GDPR.

A current list of material sub-processors will be made available to clients on request.

12. International transfers

Some PropSure service providers may process or store information outside the United Kingdom.

Base44 currently stores application data in the United States by default. Stripe, analytics providers, email providers and AI providers may also process information internationally.

Where personal information is transferred outside the UK, PropSure Ltd will use an appropriate safeguard where required. This may include:

• UK adequacy regulations
• The UK International Data Transfer Agreement
• The UK Addendum to approved Standard Contractual Clauses
• Another lawful transfer mechanism

We will also consider whether further technical, contractual or organisational safeguards are required.

For information about the safeguards applying to a particular transfer, contact privacy@prop-sure.co.uk.

13. How long we keep information

We keep personal information only for as long as reasonably necessary.

Our general retention periods are:

• Enquiries that do not become customers: up to 24 months
• Client account records: for the contract term and up to six years afterwards
• Contracts and service records: for the contract term and up to six years afterwards
• Invoices, transactions and tax records: at least six years where required
• Support correspondence: normally up to 24 months
• Security and system logs: normally up to 12 months, unless needed for an investigation
• Marketing records: until consent is withdrawn or the individual objects
• Suppression records: for as long as needed to respect an opt-out
• Cookie and analytics information: for the period stated in the cookie settings
• Unsuccessful or expired trial accounts: normally deleted or anonymised within 12 months

Client-uploaded information will be kept for the contract term and handled according to:

• The client agreement
• The client's lawful instructions
• Agreed retention settings
• Applicable legal requirements

At the end of a client contract, personal information processed on behalf of the client will be returned, exported, deleted or anonymised as agreed, unless the law requires it to be retained.

Backup copies may remain for a limited period until they are securely overwritten through the normal backup cycle.

We may keep information for longer where required because of a dispute, investigation, insurance requirement or legal claim.

14. Marketing

PropSure Ltd may send relevant information about its services where:

• The recipient has provided valid consent
• The communication is permitted under applicable business-to-business marketing rules
• The soft opt-in applies to an existing individual customer, where legally available

Marketing sent to sole traders and certain partnerships will be treated differently from marketing sent to corporate bodies where required by PECR.

Every electronic marketing message will include a clear way to unsubscribe.

You can object to direct marketing at any time by emailing privacy@prop-sure.co.uk.

We may keep a minimal suppression record after an opt-out to ensure that no further marketing is sent.

Messages concerning account security, payments, platform availability or contracted services are service communications rather than marketing.

PropSure Ltd does not buy or sell marketing lists.

15. Cookies and analytics

The PropSure website may use:

• Strictly necessary cookies required for security, account access and essential website functions
• Preference cookies that remember choices
• Analytics cookies that help us understand how the website is used
• Marketing cookies, if these are introduced

Non-essential cookies must not be placed before the user has provided valid consent, unless a specific legal exemption applies and all conditions of that exemption have been met.

The website must provide equally clear options to:

• Accept optional cookies
• Reject optional cookies
• Manage cookie preferences
• Change or withdraw consent later

Rejecting optional cookies must be as easy as accepting them.

Strictly necessary cookies may be used without consent where they are genuinely necessary, but users must still be told about them.

A separate Cookie Policy or cookie settings panel must identify:

• The cookie or technology
• Its provider
• Its purpose
• Whether it is essential or optional
• How long it remains active
• Whether information is transferred internationally

Optional analytics, advertising or marketing tools must not load before the required consent has been recorded.

16. Security

PropSure Ltd will use appropriate technical and organisational measures to protect personal information.

These may include:

• Controlled user access
• Role-based permissions
• Secure authentication
• Encryption during transmission
• Secure hosting
• Backups and monitoring
• Provider due diligence
• Data-processing agreements
• Incident-response procedures
• Access reviews
• Staff and contractor confidentiality requirements
• Secure deletion procedures

No online service can be guaranteed completely secure.

Users are responsible for protecting their passwords, limiting account access and reporting suspected unauthorised activity promptly.

17. Personal-data breaches

Where PropSure Ltd acts as a data controller, it will assess suspected personal-data breaches and notify the Information Commissioner's Office without undue delay and, where required, within 72 hours of becoming aware of the breach.

Where a breach creates a high risk to individuals, affected people will also be notified where required.

Where PropSure Ltd acts as a data processor, it will notify the relevant client without undue delay after becoming aware of a personal-data breach affecting that client's information.

PropSure Ltd will keep appropriate records of breaches, assessments and actions taken.

18. Your data-protection rights

Depending on the circumstances and lawful basis, individuals may have the right to:

• Be informed about the use of their information
• Request access to their personal information
• Have inaccurate information corrected
• Have incomplete information completed
• Request erasure
• Request restriction of processing
• Object to processing based on legitimate interests
• Object to direct marketing at any time
• Receive certain information in a portable format
• Withdraw consent
• Request safeguards relating to qualifying automated decisions
• Complain to the Information Commissioner's Office

These rights are not absolute and exemptions may apply.

Requests can be made by emailing privacy@prop-sure.co.uk.

We may ask for information needed to confirm the requester's identity. We will normally respond within one month, subject to any lawful extension.

Where PropSure Ltd holds information only on behalf of a client, the request may be referred to that client as the data controller.

19. Right to object

You have the right to object at any time to the use of your personal information for direct marketing.

You may also object where we rely on legitimate interests. We will stop processing the information unless we can demonstrate compelling legitimate grounds that override your rights or the information is required for legal claims.

To object, email privacy@prop-sure.co.uk.

20. Complaints

If you have concerns about how PropSure Ltd has handled your information, contact:

Email: privacy@prop-sure.co.uk

Registered office: Available once PropSure Ltd's separate registered office has been confirmed.

You also have the right to complain to the Information Commissioner's Office.

Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113

21. Children

PropSure is a business service and is not intended for children.

We do not knowingly invite children to create accounts or submit personal information.

If we learn that a child's information has been submitted unnecessarily, we will take reasonable steps to remove it.

22. Third-party websites

The PropSure website may contain links to websites operated by other organisations.

PropSure Ltd is not responsible for the content, security or privacy practices of those websites. Users should review the privacy information provided by the relevant organisation.

23. Changes to this policy

We may update this policy when our services, providers, processing activities or legal obligations change.

The latest version will be published on the PropSure website with the date it was last updated.

Where a change materially affects registered users, we may also provide notice through the platform or by email.

24. Contact us

For privacy questions, requests or complaints, contact:

PropSure Ltd Trading as PropSure Company number: To be confirmed Registered office: Available once PropSure Ltd's separate registered office has been confirmed Email: privacy@prop-sure.co.uk