Privacy Policy

Last updated — to be confirmed

Our contact details

• Name: Legal entity — to be confirmed, trading as Handled
• Address: Postal address — to be confirmed
• Email: privacy@handledproperty.co.uk
• ICO registration number: ICO number — to be confirmed

Two different roles — please read this first

Handled is used by landlords and by accountancy firms. That means we handle two quite different kinds of personal information, and our legal role differs between them.

1. Information about you, our account holder. When you sign up as a landlord, an accountant, or a member of firm staff, we decide how and why your information is used. For this, we are the data controller, and the rest of this notice explains what we do.

2. Information you enter about other people. When you record a tenant, a contractor, or a supplier in Handled, you decide what to record and why. We simply store and process it on your instructions. For that information, you (or your firm) are the data controller and we are the data processor.

This distinction matters because tenants and contractors never signed up to Handled. If you are a tenant or a contractor and your details are in Handled, the landlord or agent who holds the account is responsible for them, and it is them you should contact first — although we will always help you reach the right person.

The type of personal information we collect

About account holders (we are the controller)

• Identity and contact details: name, email address, phone number
• Account details: your role (landlord, accountant, firm staff), your permissions, which firm you belong to, whether your account is active
• Firm details, where you register a practice: firm name, company number, FCA number, business address, phone, email, website
• Tax reference details for the businesses you manage: Unique Taxpayer References (company and partnership), VAT registration numbers, company numbers
• Your notification preferences
• Security and audit information: IP address, browser user-agent string, and a record of changes made to records in your account, including what the values were before and after

About people you record in Handled (you are the controller; we process on your behalf)

• Tenants: first and last name, email address, phone number, tenancy dates, rent and deposit amounts, deposit scheme and reference, and any notes you add
• Contacts such as contractors, agents and suppliers: name, company name, phone, email, website, postal address, trade, and any notes you add
• Property information: addresses, purchase and sale dates and prices, and ownership shares — which can identify individual owners
• Financial records: income and expense transactions, references and descriptions
• Documents you upload: tenancy agreements, gas safety certificates, EICRs, EPCs, receipts and invoices. These are stored in private, non-public storage. Because the content is chosen by you, they may contain personal information beyond the fields listed above.

Technical information

Handled sets only strictly necessary cookies, used to keep you signed in. We do not use advertising or tracking pixels, we do not sell or share your information with advertisers, and we do not track you across other websites. Because these cookies are strictly necessary to provide a service you have asked for, we do not need to ask your consent for them, and there is no cookie banner.

We do use two measurement tools from Vercel, our hosting provider: one measures how quickly pages load, and the other counts page views and visits, so we can see which parts of the service are used and which are slow. Neither sets a cookie or stores anything on your device, and neither follows you to other websites. Visits are counted using a short-lived value derived from the request itself, which is discarded after 24 hours. What we see are aggregate totals — pages viewed, approximate location by country, browser and device type — not a record of what any individual did. Where a page address contains an identifier, such as the reference for a landlord an accountant manages, we remove it before the address is sent.

How we get your personal information and why we collect it

Most of the personal information we process is provided to us directly by you, when you:

• create an account and set up your profile
• register an accountancy firm, or are invited to one as a member of staff
• add properties, tenancies, contacts, transactions and documents
• upload a bank or agent statement to import transactions
• contact us for support

We also receive personal information indirectly in one scenario: if your accountant registers you as a client, they may enter your name and email address in order to invite you to the service.

We use the information you give us in order to:

• provide the service — keeping records of properties, tenancies, rent, expenses and compliance dates, and producing quarterly and annual figures
• create and secure your account, and send service emails such as email confirmation and password resets
• send reminders you have asked for, about compliance expiry, rent arrears, lease renewals and MTD deadlines
• keep an audit record of changes, so account holders can see who changed what
• protect the service against unauthorised access and diagnose faults

We do not sell personal information, and we do not use it for advertising.

Who we share it with

We do not share your information with other organisations for their own purposes. We use the following service providers, who process data strictly on our instructions:

We may also disclose information where we are legally required to do so.

Lawful bases

Under the UK GDPR, the lawful bases we rely on are:

• (b) Contract — for providing the service to you and administering your account. Without this information we cannot provide the service.
• (f) Legitimate interests — for security, audit logging, fault diagnosis and protecting the service against misuse. Our legitimate interest is in running a secure and reliable service; we have considered this against your rights and consider the processing limited and expected.
• (c) Legal obligation — where we are required to retain or disclose information by law.

We do not rely on consent for the core service, so there is no consent to withdraw.

International transfers

Your database records, files and the app itself are hosted in the United Kingdom.

However, all three of our providers are companies incorporated in the United States, and one of them — Resend — holds email delivery logs, which include recipient email addresses, in the United States. These transfers are covered by the providers' standard contractual clauses and, where applicable, their certification under the EU–US Data Privacy Framework.

How we store your personal information

Your information is stored in a database hosted in London, United Kingdom, and in private file storage in the same region. Access is protected by authentication, and enforced at the database level by row-level security policies so that account holders can only reach records belonging to their own account or the clients their firm manages. Uploaded files are held in private storage and are not publicly accessible.

How long we keep it

When an account is closed, we delete or anonymise the associated records.

The table above covers information for which we are the controller. For the information you enter about other people — tenants, contacts, and the tenancy, transaction and document records attached to them — you decide how long it is kept, because you are the controller for it. We hold it for as long as it remains in your account, and delete it when you delete it or close your account. Retention of those records, and our obligations to you in respect of them, are dealt with in our Data Processing Agreement.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access — you have the right to ask us for copies of your personal information.
• Your right to rectification — you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure — you have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing — you have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing — you have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at privacy@handledproperty.co.uk if you wish to make a request.

If you are a tenant or a contractor whose details are held in Handled by a landlord or agent, please direct your request to them in the first instance, as they decide what is recorded about you. Contact us at the address above and we will help you reach them.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at privacy@handledproperty.co.uk.

You can also complain to the ICO if you are unhappy with how we have used your data.

Changes to this notice

We keep this privacy notice under review. This version has not yet been formally published. Where we make significant changes, we will tell account holders by email.