Privacy Policy & UK GDPR Compliance

1. Who We Are & Controller Details

This website and application (thisestate.co.uk, referred to as “This Estate”, “we”, “us”, or “our”) provides digital community infrastructure and legal resources for residential leaseholders, freehold property owners on managed estates, and Resident Management Companies (RMCs) across the United Kingdom.

Under the UK GDPR and the Data Protection Act 2018:

• Data Processor: This Estate acts as a Data Processor providing software hosting, database management, and email infrastructure to your estate.
• Data Controller: The Board of Directors of your specific Resident Management Company (RMC), Right to Manage (RTM) company, or Residents' Association acts as the Data Controller responsible for determining the purpose of resident communications on your estate.

2. The Personal Information We Collect

We only collect personal information that is strictly necessary to operate your estate portal and deliver community updates:

3. Lawful Bases for Processing Under UK GDPR

Under Article 6 of the UK GDPR, we rely on the following lawful bases to process your information:

• • Consent:(Article 6(1)(a)) When you tick the consent checkbox to receive estate newsletters, general maintenance bulletins, and community notices. You may withdraw consent at any time.
• • Contract:(Article 6(1)(b)) Processing necessary to provide you with secure access to your estate portal, verify your residence on the estate, and issue your community access code.
• • Legitimate Interest:(Article 6(1)(f)) Necessary for the proper governance, security, and maintenance of your residential development, including urgent fire risk notifications, emergency service works, and preventing unauthorized portal access.
• • Legal Obligation:(Article 6(1)(c)) Where company law (Companies Act 2006) or landlord and tenant legislation requires Resident Management Companies to maintain records of members and statutory notices.

4. Data Storage, Security & Encryption

We implement rigorous technical and organisational measures to ensure your data is safeguarded:

• Encrypted in Transit: All communications between your web browser and our servers are encrypted using modern Transport Layer Security (TLS 1.3) with HTTPS enforcement.
• Encrypted at Rest: Data is hosted within Google Cloud / Firebase Firestore facilities in certified European/UK data centers, protected by enterprise-grade AES-256 encryption at rest.
• Strict Tenant Isolation: Databases are partitioned by unique estate slugs. Security rules prevent cross-estate querying or data leakage between developments.
• BCC Blind Copy Guarantee: When directors dispatch broadcast announcements, recipient emails are always sent via Blind Carbon Copy (BCC) to protect your email address from being exposed to other residents.

5. Third-Party Sub-Processors

We work exclusively with trusted, GDPR-compliant infrastructure partners to deliver our services:

We do not transfer personal data outside the UK or European Economic Area (EEA) without appropriate safeguards (such as UK International Data Transfer Agreements or Standard Contractual Clauses).

6. Your Legal Rights Under UK GDPR

Every resident and director has comprehensive statutory rights regarding their personal data:

• • Right of Access: You can request a copy of all personal records we hold about you (Subject Access Request) free of charge.
• • Right to Rectification: You may request that incorrect or incomplete details (such as a misspelled name or updated phone number) be corrected immediately.
• • Right to Erasure (“Right to be Forgotten”): When you move away from the estate or no longer wish to have an account, you can request that all your records be permanently deleted.
• • Right to Restrict or Object to Processing: You have the right to object to processing based on legitimate interests or request a pause on processing.
• • Right to Withdraw Consent: You can opt out of non-essential email bulletins at any time by contacting your director or emailing us.
• • Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format (CSV/JSON).

7. Cookies & Local Storage

This Estate uses minimal, strictly essential cookies and browser local storage solely to provide core website functionality. Specifically:

• Community Portal Unlock State: We store a local session token so you don't have to re-enter your estate password every time you navigate pages.
• UI State Preferences: Remembering which estate directory tab you last selected.

We do not use invasive third-party cross-site advertising cookies, behavioral tracking pixels, or data brokering scripts.

8. Contact Us & ICO Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your UK GDPR statutory rights, or wish to submit a Data Deletion Request, please contact our Data Protection Team:

If you are dissatisfied with how we handle your request, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:
Website: ico.org.uk • Telephone: 0303 123 1113.