Privacy Policy

1. Who We Are

EstatePass Ltd ("EstatePass", "we", "us", "our") is a limited company registered in England and Wales. We operate the EstatePass platform, a commercial property information and management system accessible at app.estatepass.co.uk and through QR codes displayed at managed properties.

If you have any questions about this policy or how we handle your data, please contact us at:

2. What This Policy Covers

This privacy policy explains how EstatePass Ltd collects, uses, stores and protects personal data in connection with the EstatePass platform. It covers:

• Property managers and their staff who use the EstatePass dashboard to manage property information
• Tenant contacts whose details are stored in the platform by property managers
• Members of the public who scan QR codes to access property portals

EstatePass acts as a data controller in relation to the data of property managers who use the platform, and as a data processor in relation to tenant contact data that property managers upload on behalf of their clients.

3. What Data We Collect

3.1 Property Manager Accounts

When a property management company signs up to use EstatePass, we collect and store:

• Full name and work email address of the account holder
• Company name, address, VAT number and company registration number
• Contact telephone and mobile numbers
• Billing address and invoicing details
• Login credentials (passwords are encrypted and never stored in plain text)

3.2 Tenant Contact Data

Property managers may upload contact information for their tenants and occupiers. This may include:

• Full name
• Email address
• Telephone and mobile numbers
• Unit or property reference

This data is uploaded by property managers acting as data controllers in their own right. EstatePass processes this data only on the instructions of the property manager and in accordance with our Data Processing Agreement.

3.3 Portal Visitors

When someone scans a QR code to access a property portal, we do not require them to create an account or provide any personal information. We may collect limited technical data including:

• IP address and device type (for security and analytics purposes)
• Pages viewed and time of access

This data is collected anonymously and is not linked to any individual.

3.4 Contact Enquiries

If you submit a contact or demo request via our website (estatepass.co.uk), we collect your name, email address, company name and any message you provide. This is used solely to respond to your enquiry.

4. How We Use Your Data

We use personal data for the following purposes:

• To provide and operate the EstatePass platform
• To create and manage property manager accounts
• To send transactional emails — including access request notifications, tenant onboarding emails, and estate updates — on behalf of property managers
• To respond to support and sales enquiries
• To improve the platform through anonymised usage analytics
• To comply with our legal and regulatory obligations

We do not use personal data for marketing purposes without explicit consent, and we do not sell personal data to third parties under any circumstances.

5. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

• Contract: processing necessary to provide the EstatePass service to property managers who have agreed to our Terms of Use
• Legitimate interests: processing necessary for the security and improvement of the platform, and for responding to enquiries
• Legal obligation: processing required to comply with applicable law
• Consent: where we rely on consent (e.g. optional communications), you may withdraw it at any time

6. Who We Share Data With

We do not sell or rent personal data. We may share data with the following categories of third parties, solely as necessary to operate the platform:

• Supabase Inc: our database and authentication infrastructure provider. Data is stored in the EU (London region). Supabase acts as a data processor under a Data Processing Agreement.
• Resend Inc: our transactional email delivery provider, used to send access request and notification emails on behalf of property managers.
• Anthropic PBC: our AI provider, used to power the optional "Improve with AI" copy assistance feature. Text entered into AI-assisted fields may be processed by Anthropic. No tenant contact data is passed to Anthropic.
• Vercel Inc: our hosting and deployment provider.

Where any of the above providers are based outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

7. How Long We Keep Your Data

• Property manager account data is retained for the duration of the account and for up to 7 years thereafter for legal and financial record-keeping purposes
• Tenant contact data is retained for as long as the property manager's account is active. Managers may delete tenant records at any time through the platform
• Portal access logs are retained for 90 days
• Contact enquiry data is retained for 2 years

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate data
• Right to erasure: to request deletion of your data in certain circumstances
• Right to restrict processing: to request that we limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data Security

We take the security of personal data seriously and implement appropriate technical and organisational measures including:

• Encrypted data storage and transmission (TLS/HTTPS)
• Row-level security policies on our database
• Password hashing using industry-standard algorithms
• Access controls limiting which staff can access personal data
• Regular security reviews

In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay.

10. Cookies

The EstatePass platform uses essential cookies only — specifically, session cookies to maintain logged-in state for property managers. We do not use tracking, advertising or analytics cookies. No cookie consent banner is currently displayed as we rely solely on strictly necessary cookies.

Our marketing website (estatepass.co.uk) may use analytics cookies. A separate cookie policy is available at estatepass.co.uk/cookie-policy.

11. Changes to This Policy

We may update this privacy policy from time to time. The date at the top of this document reflects when it was last revised. Where changes are material, we will notify property managers by email.

12. Contact Us

If you have any questions, concerns or requests relating to this privacy policy or the way we handle personal data, please contact:

You may also contact the Information Commissioner's Office (ICO):