Privacy Policy
How PropertyFlow Technologies Ltd collects, uses, stores, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: 25 March 2026
Contents
1. Data Controller
The data controller responsible for your personal data is:
PropertyFlow Technologies Ltd
Registered Office: 20-22 Wenlock Road, London, N1 7GU
Trading from Edinburgh, Scotland
Company Registration Number: 16927756 (Registered in England & Wales)
ICO Registration Number: ZC088419
Email: info@propertyflow.uk
Phone: +44 204 577 2084
You can verify our ICO registration at ico.org.uk.
2. Data We Collect
We collect personal data through the following channels:
2.1 Information You Provide via Website Forms
When you submit a form on our website (e.g., the contact form, property audit request, or early adopter sign-up), we collect:
- First name
- Last name
- Email address
- Phone number
- Property details (address, type, location)
- "What best describes you" selection (landlord, investor, developer, agent, or other)
- Number of properties
- Any additional information you provide in the message field
2.2 Information Collected Automatically via Cookies and Third-Party Services
When you visit our website, certain data is collected automatically through cookies and third-party services embedded on our pages:
- HubSpot tracking cookies -- page views, session duration, referral source, form interactions, and return visits
- Google Fonts (Inter) -- your IP address may be transmitted to Google servers when fonts are loaded
- Tailwind CSS CDN -- your IP address may be transmitted to Cloudflare when the stylesheet is loaded
2.3 Information Stored in Our CRM (HubSpot)
If you engage with PropertyFlow as a lead, enquiry, or client, we store the following data within our CRM system (HubSpot, EU1 region):
- Contact details (name, email, phone)
- Deal pipeline data (enquiry stage, property details, service type, contract status)
- Email engagement data (opens, clicks, replies to emails sent via HubSpot)
- Notes from calls or meetings
- Associated property and service records
3. Legal Basis for Processing
Under Article 6 of the UK GDPR, we process your personal data on the following legal bases:
| Purpose | Legal Basis | Details |
|---|---|---|
| Responding to enquiries | Legitimate interest | Necessary to respond to your contact form submission or property audit request |
| Marketing communications | Legitimate interest | Sending relevant service updates and market intelligence to property owners who have enquired. You can opt out at any time |
| Newsletter and email subscriptions | Consent | You explicitly opt in to receive our newsletter. You can withdraw consent at any time by clicking "unsubscribe" or contacting us |
| Service agreements and onboarding | Contractual necessity | Necessary for the performance of a management agreement, corporate let agreement, or other service contract between you and PropertyFlow |
| Website analytics and tracking | Legitimate interest | Understanding how visitors use our website to improve our service and user experience |
| Legal and regulatory compliance | Legal obligation | Retaining records as required by UK law, including tax, anti-money laundering, and property management regulations |
4. How We Use Your Data
We use the personal data we collect for the following purposes:
- ✓ To respond to your enquiry, provide a property audit, or send a yield estimate
- ✓ To manage your property under a corporate let or managed service agreement
- ✓ To send you relevant market data, compliance updates, and service information
- ✓ To manage our CRM pipeline and track enquiry progress
- ✓ To improve our website, services, and user experience through analytics
- ✓ To comply with legal obligations, including tax, anti-money laundering, and regulatory requirements
We will never sell your personal data to third parties. We do not share your data with any party except those listed in Section 5 below, and only for the purposes described in this policy.
5. Data Processors & Third Parties
We use the following third-party services to process your data. Each operates under a data processing agreement (DPA) in accordance with UK GDPR requirements:
HubSpot, Inc.
Purpose: CRM, form capture, email marketing, deal pipeline management, website analytics tracking
Data hosted: EU1 region (European Union data centre)
Portal ID: 147879634
Privacy policy: legal.hubspot.com/privacy-policy
Google LLC (Google Fonts)
Purpose: Delivery of web fonts (Inter) used on our website
Data processed: IP address, browser user-agent, referrer URL at the time of font request
Privacy policy: policies.google.com/privacy
Cloudflare, Inc.
Purpose: Content delivery network (CDN) for Tailwind CSS framework and Cloudflare Workers
Data processed: IP address, browser user-agent, request metadata
Privacy policy: cloudflare.com/privacypolicy
GitHub, Inc. (Microsoft)
Purpose: Website hosting via GitHub Pages
Data processed: IP address, browser user-agent, access logs
Privacy policy: docs.github.com/privacy
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
| Data Category | Retention Period | Reason |
|---|---|---|
| Contact form submissions | 3 years | From the date of submission, to allow follow-up and service conversion |
| Marketing and newsletter data | Until consent is withdrawn | Retained for the duration of your subscription. Deleted within 30 days of unsubscribing or withdrawal of consent |
| Service agreement records | 7 years | Legal requirement for contractual, tax, and regulatory compliance (HMRC, Companies Act) |
| Website analytics data (HubSpot) | 13 months | Aligned with HubSpot cookie expiry. Anonymised aggregate data may be retained longer |
| CRM deal pipeline data | Duration of business relationship + 3 years | Necessary for ongoing service management and post-contract reference |
When data reaches the end of its retention period, it is securely deleted or anonymised. You may request earlier deletion at any time (see Section 9).
8. International Data Transfers
Your personal data may be transferred outside the United Kingdom in the following circumstances:
HubSpot (EU1 Region)
Your CRM data is hosted on HubSpot's EU1 infrastructure within the European Union. The EU has been granted an adequacy decision by the UK Government under the UK GDPR, meaning EU data protection standards are considered equivalent to UK standards. No additional safeguards are required for this transfer.
Google Fonts (United States)
When loading web fonts, your IP address is transmitted to Google servers, which may be located in the United States. This transfer is protected by Standard Contractual Clauses (SCCs) as approved by the UK Information Commissioner's Office, and Google's participation in the EU-US Data Privacy Framework.
Cloudflare (Global CDN)
Cloudflare operates a global content delivery network. When loading the Tailwind CSS framework, your request may be served from the nearest Cloudflare edge server, which could be located outside the UK. Cloudflare maintains Standard Contractual Clauses and has been certified under the EU-US Data Privacy Framework.
GitHub Pages (United States)
Our website is hosted on GitHub Pages. Server access logs (IP address, user-agent) may be processed by GitHub (Microsoft) in the United States. This transfer is protected by Standard Contractual Clauses and Microsoft's participation in the EU-US Data Privacy Framework.
9. Your Rights Under UK GDPR
Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you. We will respond within one calendar month of receiving your request.
Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You have the right to request deletion of your personal data where there is no compelling reason for its continued processing. This is also known as the "right to be forgotten."
Right to Restriction
You have the right to request that we restrict processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have challenged.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object
You have the right to object to processing based on legitimate interest or direct marketing. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds.
How to Exercise Your Rights
To exercise any of these rights, please contact us at:
Email: info@propertyflow.uk
Email: info@propertyflow.uk
We will respond to your request within one calendar month. In complex cases, we may extend this by a further two months, but we will notify you of any extension within the first month.
There is no fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
10. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:
- ● Encryption in transit: All data transmitted between your browser and our website is encrypted using HTTPS/TLS
- ● Secure CRM: HubSpot (our CRM provider) maintains SOC 2 Type II certification, ISO 27001 compliance, and encrypts data at rest and in transit
- ● Access controls: Access to personal data is restricted to authorised PropertyFlow staff on a need-to-know basis
- ● Regular review: We regularly review our data processing activities and security measures to ensure ongoing compliance
While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. If you become aware of any security breach affecting your data, please contact us immediately.
11. Automated Decision-Making
Under Article 22 of the UK GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on you.
PropertyFlow uses automated systems in the following areas:
- ● Cognito Pricing Engine: Our AI-powered pricing tool analyses market data, demand patterns, competitor rates, and seasonal trends to recommend nightly rates for short-term let properties. These recommendations are advisory and are reviewed and approved by PropertyFlow staff before being applied. No pricing decision is made solely by automated means without human oversight.
- ● Compliance Tracking: Our compliance dashboard uses automated reminders and deadline tracking for licence renewals, safety certificates, and regulatory requirements. These are informational alerts, not decisions that produce legal effects.
None of these automated processes make decisions that produce legal effects or similarly significant effects on individuals without human involvement. If you have concerns about how automated tools are used in relation to your data, please contact us at info@propertyflow.uk.
12. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to the UK's supervisory authority for data protection:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
We would appreciate the opportunity to address your concerns before you approach the ICO. Please contact us first at info@propertyflow.uk so we can try to resolve the matter directly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify existing contacts via email where the change materially affects how their data is processed
- Publish the updated policy on this page
We recommend reviewing this page periodically to stay informed about how we protect your data.
This policy was last updated on 25 March 2026.
14. Contact Us
If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your rights, please contact us:
PropertyFlow Technologies Ltd
Registered Office: 20-22 Wenlock Road, London, N1 7GU
Email: info@propertyflow.uk
Phone: +44 204 577 2084
Company No.: 16927756
ICO Registration: ZC088419