Privacy Policy
Last updated: 13 May 2026 · Version 1.0
1. Who We Are (Data Controller)
PropCrew Ltd("we", "us", "our") is the Data Controller for the personal data collected through Property Communication Hub ("the Platform"). We are registered with the Information Commissioner's Office (ICO) under registration number ZA000000.
Registered address: 123 Example Street, London, EC1A 1BB, United Kingdom
Privacy enquiries: privacy@propcrew.co.uk
2. What Data We Collect
We collect only the minimum personal data necessary to provide our services:
- Account data: full name, email address, password (hashed — never stored in plain text), and your role (Agent, Housing Agency, or Tenant).
- Agency data: the name of the property agency you create or join.
- Property data: property addresses and descriptions you add to the Platform.
- Communications: messages sent within property chat rooms.
- Consent records: the version of these terms you accepted and the date of acceptance.
- Usage data: last login timestamp, IP address, and browser type (collected automatically by our infrastructure provider, Supabase).
We do not collect sensitive personal data (as defined by UK GDPR Article 9).
3. Purpose and Legal Basis for Processing
| Purpose | Legal Basis (UK GDPR Art. 6) |
|---|---|
| Providing the Platform and its core features | Performance of a contract (Art. 6(1)(b)) |
| Sending service-related notifications (email/SMS) | Consent (Art. 6(1)(a)) — you may withdraw at any time |
| Ensuring platform security and preventing fraud | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Data Minimisation and Privacy by Design
We apply the principle of data minimisation. Specifically:
- Tenants can only see the profile information of agents and owners directly associated with their managed properties. Tenants cannot see the profiles of other tenants or unrelated agency staff.
- Agents and Owners can see profiles within their own agency only. Cross-agency data is strictly isolated.
- All data access is enforced at the database level using Row Level Security (RLS) — it is not merely an application-layer restriction.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and profile data | For the duration of your account, plus 90 days following deletion |
| Messages | For the duration of the associated property tenancy, plus 6 years (UK landlord–tenant record-keeping requirements) |
| Consent records | 6 years from the date of consent (ICO guidance) |
| Server logs (IP, browser) | 90 days (managed by Supabase) |
6. Your Rights Under UK GDPR
You have the following rights. To exercise any of them, contact us at privacy@propcrew.co.uk. We will respond within 30 days.
- Right of access (Art. 15): Request a copy of all personal data we hold about you.
- Right to rectification (Art. 16): Ask us to correct inaccurate data. You may also update your name and email directly in your account settings.
- Right to erasure (Art. 17 — "right to be forgotten"): Request deletion of your account and associated personal data. You can initiate this directly from your Settings page. We will complete erasure within 30 days, subject to any legal retention obligations.
- Right to restrict processing (Art. 18): Ask us to pause processing of your data while a dispute is resolved.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
- Right to object (Art. 21): Object to processing based on legitimate interests, including direct marketing.
- Right to withdraw consent: Where processing is based on consent (e.g. marketing communications), you may withdraw at any time via your Settings page, without affecting the lawfulness of prior processing.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
7. Data Sharing and Third Parties
We do not sell your personal data. We share data only with the following sub-processors:
- Supabase Inc. — database hosting, authentication, and real-time services. Data is processed under a Data Processing Agreement in accordance with UK GDPR. Supabase stores data in the EU (Frankfurt region) under Standard Contractual Clauses.
We may also disclose data where required by law or to protect the rights and safety of our users.
8. Cookies and Tracking
We use essential cookies only to maintain your authenticated session. These are strictly necessary and cannot be disabled. With your consent, we may also set optional analytics cookies to improve the Platform. You can manage your cookie preferences at any time via the banner that appears on your first visit or in your account Settings.
9. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Passwords are hashed using bcrypt and never stored in plain text. Access to personal data within the Platform is enforced via database-level Row Level Security policies.
10. Changes to This Policy
We will notify registered users of material changes to this policy by email at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the revised policy.
11. Contact Us
For any privacy-related questions or to exercise your rights, please contact our Data Protection Officer:
PropCrew Ltd
123 Example Street, London, EC1A 1BB, United Kingdom
privacy@propcrew.co.uk