Privacy Policy

1. Controller Information (Art. 13 GDPR)

PROPERTY WORKS APP LIMITED ("Property Works", "we", "us", "our") is the Data Controller within the meaning of:

• UK GDPR
• EU General Data Protection Regulation (Regulation (EU) 2016/679)
• German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)

For users located in Germany and the European Union, we act as a non-EU controller offering services to EU data subjects under Article 3(2) GDPR.

Contact: info@propertyworksapp.com

2. Scope of This Policy

This Privacy Policy applies to:

• Website visitors
• Registered users
• Property Owners
• Property Managers
• Tradespeople
• Business contacts
• Prospective users

3. Categories of Users & Plans

Property Owners

• Free — £0 per month
• Pro — £19 per month
• Portfolio — £49 per month

Property Managers

• Professional — £49 per month
• Business — £149 per month
• Enterprise — £299 per month

Tradespeople

• Free — £0 per year + 4.5% lead generation fee
• Professional — £4.99 per month + 3% lead generation fee
• Premium — £11.99 per month + 2% lead generation fee

4. Categories of Personal Data (Art. 13(1)(c))

We process the following categories:

4.1 Identification Data

• Full name
• Email address
• Phone number
• Account role
• Subscription tier

4.2 Business Data (where applicable)

• Company name
• Business registration number
• VAT ID (including German USt-IdNr if provided)
• Registered address

4.3 Property & Project Data

• Property addresses
• Maintenance records
• Uploaded documentation
• Photographs
• Communications between users

4.4 Payment Data

Processed via Stripe.

We do not store:

• Full card numbers
• CVV numbers

We store:

• Stripe customer ID
• Subscription ID
• Invoice references
• Payment status

4.5 Technical & Usage Data

• IP address
• Device type
• Operating system
• Browser type
• Log files
• Access timestamps
• Session data

4.6 Communications Data

• Support emails
• Platform messages
• Feature requests

5. Purposes & Legal Bases (Art. 6 GDPR)

We process personal data under the following lawful bases:

Contract (Art. 6(1)(b))

To:

• Provide platform access
• Manage subscriptions
• Enable project coordination
• Calculate applicable lead generation fees

Legitimate Interest (Art. 6(1)(f))

To:

• Improve platform functionality
• Prevent fraud
• Enforce contractual rights
• Maintain IT security
• Analyse usage behaviour

We conduct balancing tests where required.

Legal Obligation (Art. 6(1)(c))

To comply with:

• UK Companies Act
• German tax retention requirements
• Anti-fraud regulations
• Accounting obligations

Consent (Art. 6(1)(a))

For:

• Marketing communications
• Non-essential cookies

Consent may be withdrawn at any time.

6. Special Categories of Data (Art. 9 GDPR)

We do not intentionally process special category data.

Users must not upload:

• Health data
• Criminal record data
• Biometric data
• Sensitive personal information

If uploaded, it will be removed where detected.

7. Automated Decision-Making

We do not conduct automated decision-making within the meaning of Article 22 GDPR.

Lead generation fee calculations are mechanical and based on subscription tier.

8. Payment Processing & Financial Clarification

Payments are processed through Stripe.

We:

• Do not administer client funds
• Do not act as a payment institution
• Do not provide regulated financial services
• Are not FCA authorised
• Do not provide BaFin regulated financial services

All financial agreements remain between users.

Stripe acts as an independent Data Controller for payment processing data.

9. Data Sharing (Art. 13(1)(e))

We may share data with:

• Stripe (payment processing)
• Hosting providers
• Cloud infrastructure providers
• Analytics services
• IT service providers
• Legal authorities where legally required
• Accountants and professional advisers

We do not sell personal data.

10. International Transfers (Chapter V GDPR)

As a UK company offering services to Germany:

• Data may be processed in the UK
• UK is subject to an EU adequacy decision

Transfers outside UK/EU use:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Equivalent safeguards

11. Data Retention (Art. 5 & 13 GDPR)

We retain data:

• While account is active
• 6 years after account closure (UK accounting laws)
• 10 years where German tax law applies (if applicable to invoicing records)
• Longer where required by law

Deleted accounts are anonymised where possible.

12. Technical & Organisational Measures (Art. 32 GDPR)

We implement:

• TLS/SSL encryption
• Encrypted password hashing
• Secure cloud infrastructure
• Role-based access controls
• Limited administrative access
• Regular software updates
• Logging & monitoring
• Payment tokenisation via Stripe

13. Cookies & Tracking

We use:

Strictly Necessary Cookies

Authentication & security.

Analytics Cookies

Usage analysis.

Functional Cookies

Session preferences.

Non-essential cookies require opt-in consent for EU and German users.

A cookie banner compliant with UK PECR and German TTDSG must be implemented.

14. Your Rights (UK & Germany)

Under UK GDPR & EU GDPR you have:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent

To exercise rights: info@propertyworksapp.com

We respond within 1 month.

15. Right to Lodge a Complaint

United Kingdom

Information Commissioner's Office (ICO)
www.ico.org.uk

Germany

You may contact your local Landesdatenschutzbehörde (State Data Protection Authority).

16. Data Protection Representative (EU)

If required under Article 27 GDPR, we will appoint an EU representative.

[Insert EU Representative details if appointed]

17. Data Processing Role Clarification

Property Works provides a digital infrastructure platform.

Contracts are formed directly between:

• Property Owners
• Property Managers
• Tradespeople

We do not assume liability for contractual performance between users.

18. Security Incidents & Breach Notification

In the event of a personal data breach:

• We will assess risk
• Notify relevant supervisory authorities within 72 hours where required
• Notify affected users where legally necessary

19. Marketing Communications

We may send:

• Service announcements
• Billing updates
• Product updates

Marketing emails require opt-in consent.

Unsubscribe link included in every marketing email.

20. Children

The platform is not intended for individuals under 18.

21. Changes to This Policy

We may update this policy.

Material changes will be communicated via email.