Privacy Policy

Property Portfolio Suite Limited ("we", "us", "our") is a private limited company incorporated in England and Wales under company number 17411633, with its registered office at 66 Paul Street, London, EC2A 4NA, United Kingdom. We operate the Property Portfolio Suite private client portal and act as the data controller for the personal data you provide when registering, submitting an enquiry, or using the portal.

For any privacy-related query, contact us at support@propertyportfoliosuite.com.

ICO registration: Application pending. The company is being registered with the UK Information Commissioner's Office; the reference will be published here once granted.

Data protection contact: A dedicated Data Protection Officer has not been appointed as no processing meets the UK GDPR Article 37 statutory threshold. Data protection enquiries are handled by the company's data protection lead at support@propertyportfoliosuite.com.

We collect only what is necessary to deliver the service:

• Account information: name, email, phone number, encrypted password, role.
• Property information: addresses, photos, service contacts, security codes, maintenance records, documents, calendar events and other structured data you choose to enter.
• Technical data: IP address, browser, operating system, approximate location (city-level) captured automatically when you sign in, used for login-alert security notifications.
• Payment data: billing address and subscription details. Full card numbers and bank details are handled exclusively by our payment processors (Stripe, GoCardless) and never stored on our servers.
• Enquiry data: name, email, number of properties, country, language, submitted when requesting a pricing overview.

Under UK GDPR, we rely on the following legal bases:

• Contract: to provide the service you have signed up for.
• Legitimate interest: to secure your account (2FA, login alerts, session tracking) and prevent fraud.
• Consent: for optional marketing emails, which you can withdraw at any time.
• Legal obligation: to retain records required by tax, accounting, or anti-money-laundering law.

• All traffic is encrypted in transit using TLS/SSL.
• Sensitive fields (security codes, alarm codes, key-holder contacts) are encrypted at rest using AES-256 with server-side key management.
• Access to account data requires two-factor authentication (email or WhatsApp code) on every new device.
• Passwords are hashed with bcrypt and never stored or logged in plaintext.
• We maintain session-level audit trails and allow you to revoke any active session at any time.

Your data is strictly private to you and the team members you explicitly invite. It is never sold, shared, or disclosed to third parties for marketing or other commercial purposes.

We use the following carefully-vetted sub-processors to deliver the service, each under data protection agreements:

• Google Workspace (Gmail SMTP): transactional email delivery only (login codes, service notifications).
• Twilio: WhatsApp message delivery for 2FA and critical alerts.
• Stripe: subscription card payments (PCI-DSS Level 1 certified).
• GoCardless: direct-debit processing (FCA authorised).
• MongoDB Atlas: encrypted database hosting within the UK/EU.
• ip-api.com: anonymous geolocation lookup for login security alerts (IP only, no personal identifiers transmitted).

• Active accounts: for the lifetime of your subscription.
• After cancellation: your property data is retained for 30 days to allow export, then permanently deleted on request.
• Billing records: retained for 7 years to satisfy UK tax and accounting law.
• Security logs: retained for 90 days for fraud prevention, then purged.

Under UK GDPR, you have the right to:

• Access a copy of all personal data we hold on you.
• Correct any inaccurate data directly through your profile, or by contacting us.
• Erase ("right to be forgotten"), request permanent deletion, subject to legal retention requirements.
• Restrict or object to specific processing activities.
• Export your data in a machine-readable format (JSON / PDF).
• Withdraw consent for optional processing at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email support@propertyportfoliosuite.com. We respond within 30 days.

We use only strictly necessary cookies for session management (keeping you logged in) and basic anti-fraud protection. We do not use third-party advertising cookies, behavioural tracking, or analytics that identify individual users.

Your data is primarily stored and processed within the UK and EU. Where any sub-processor operates outside the UK (e.g., Twilio, USA), transfers occur under the UK International Data Transfer Agreement (IDTA) and the EU Standard Contractual Clauses, ensuring an equivalent level of protection.

We may update this policy to reflect changes in law, service features, or sub-processors. Material changes will be notified by email at least 30 days before taking effect. The "Last updated" date at the top of this page always reflects the most recent revision.