Legal

Privacy policy

This policy explains how EstateHQ collects, uses, and protects your personal data in accordance with UK GDPR and the Data Protection Act 2018.

Last updated: May 2026

Disclaimer: This document is provided for informational purposes. We recommend seeking independent legal advice to ensure your compliance with applicable laws.

Data controller

Who we are

EstateHQ is the trading name of the company operating this platform. We provide a SaaS compliance management platform for UK estate agencies. We are the data controller for the personal data described in this policy.

Company registration number: 17209704 (registered in England and Wales). ICO registration: EstateHQ Ltd is registered with the Information Commissioner's Office as a data controller (registration reference to be inserted on this page once confirmed).

You can contact us at any time by email: hello@estatehq.co.uk

Data categories

What data we collect

We collect and process the following categories of data when you use EstateHQ:

Account data

Your name and email address when you create an account
Your organisation name and branch details
Billing information (payment method details are processed by Stripe and not stored by us)
Role and access level within your organisation

Property and client data

Landlord client names, contact details, and AML risk assessment records that you enter into the platform
Property addresses and certificate records
Sales and lettings instruction details
Offer, viewing, and pipeline data

Usage and analytics data

Pages visited and features used within the platform
Browser type, operating system, and device information
IP address and approximate location (country/region)
Session duration and interaction events

We use essential, functional, and analytics cookies. Please see our Cookie policy for full details of the cookies we use and how to control them.

UK GDPR Article 6

Legal basis for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

Article 6(1)(b) — Contract

Processing is necessary to perform our contract with you (providing the EstateHQ platform) and to take steps at your request prior to entering into a contract.

Article 6(1)(c) — Legal obligation

We may be required to process certain data to comply with legal obligations, including record-keeping requirements under UK tax law.

Article 6(1)(f) — Legitimate interests

We rely on our legitimate interests for the following activities: (i) improving the EstateHQ platform using aggregated usage analytics; (ii) detecting and preventing fraud, abuse, and security threats; and (iii) sending you service-related communications relevant to your subscription. For each activity we have conducted a balancing assessment and concluded that our legitimate interests are not overridden by your rights and interests. You may object to this processing at any time by contacting us.

Article 6(1)(a) — Consent

Where you have provided explicit consent, we process usage and analytics data for product improvement purposes via PostHog, our EU-hosted analytics provider. You may withdraw consent at any time by contacting us at hello@estatehq.co.uk or by adjusting your cookie preferences.

Processing purposes

How we use your data

To provide, operate, and maintain the EstateHQ platform
To manage your account and subscription
To send transactional emails (account notifications, certificate expiry alerts, staff invitations)
To process payments via Stripe
To respond to support requests and enquiries
To improve platform performance and fix issues
To detect and prevent fraud and abuse
To comply with applicable law

We do not sell your personal data to third parties. We do not use your data for automated profiling that produces legal or similarly significant effects.

Article 28 UK GDPR

Who we share data with

We use the following sub-processors to operate the platform. Each is bound by a data processing agreement and appropriate safeguards. For full details of how we process your data as a data processor, see our Data Processing Agreement.

Sub-processor	Purpose	Location
Supabase	Database hosting, authentication, and file storage	EU (London)
Stripe	Payment processing and subscription management	USA (SCCs)
Resend	Transactional email delivery	USA (SCCs)
Vercel	Platform hosting and edge network	USA / EU (SCCs)

SCCs = UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses, as approved by the UK ICO for international data transfers under UK GDPR.

We may also disclose your data to law enforcement or regulatory authorities where required by law.

Data retention

How long we keep your data

We retain personal data only for as long as necessary:

Account and subscription data: for the duration of your subscription, plus 90 days after account closure to allow data export, then deleted
Billing records: 7 years from the end of the relevant tax year, to comply with HMRC requirements
AML and compliance records: we recommend your agency retains AML records for a minimum of 5 years under the Money Laundering Regulations 2017; you are responsible for your own retention obligations
Usage and analytics data: aggregated and anonymised within 13 months
Support correspondence: 2 years from the date of the last communication

Data type	Statutory minimum	Platform action
AML risk assessment records	5 years — MLR 2017 reg. 40	Retained for statutory period; erasure available on request after expiry
Instruction and transaction records	6 years — Limitation Act 1980	90 days after account closure, then deleted (statutory minimum takes precedence where applicable)
Billing records	6 years — HMRC requirements	Retained for 6 years from end of relevant tax year
Marketing consent records	None (PECR)	Until consent is withdrawn or account is closed

UK GDPR Articles 12–22

Your rights

Under UK GDPR, you have the following rights regarding your personal data. Please see our GDPR & Your Rights page for full details of how to exercise each right.

Right of access — obtain a copy of the personal data we hold about you
Right to rectification — ask us to correct inaccurate or incomplete data
Right to erasure — ask us to delete your data in certain circumstances
Right to restriction — ask us to restrict processing of your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests
Right not to be subject to automated decision-making with legal or significant effects

Supervisory authority

Contact us & complaints

To exercise any of your rights, or if you have any questions about this policy, please contact us at hello@estatehq.co.uk. We will respond within 30 calendar days.

EstateHQ does not meet the thresholds requiring a mandatory Data Protection Officer under UK GDPR Article 37. All data protection queries and rights requests are handled by our data protection team at hello@estatehq.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)

Website: ico.org.uk

Telephone: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Questions about your data?

We are committed to handling your data transparently and responsibly. Get in touch with any questions.