1. Introduction
Fretwell & Co ("we", "us", or "our") operates the Fretwell & Co property compliance platform at fretwellcompliance.uk (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.
We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who We Are
Fretwell & Co is a property compliance tracking service for UK property managers and letting agents. For data protection enquiries, contact us at support@fretwellcompliance.uk.
3. Information We Collect
We collect the following categories of information:
- Account information: email address, password (stored securely hashed), and name if you provide it in your profile settings.
- Property and compliance data: property addresses, property types, bedroom counts, certificate details (types, issue and expiry dates, notes), and uploaded certificate documents (PDF or JPEG).
- Contractor information: names, company names, phone numbers, email addresses, and certificate types handled, as entered by you.
- Usage data: information about how you interact with the Service, including pages visited and features used, collected through standard server logs.
- Communications: emails we send to you (such as expiry alerts and welcome messages) and any correspondence you send to our support team.
4. How We Use Your Information
We use your information to:
- Provide, operate, and maintain the Service
- Track compliance certificates and calculate expiry statuses
- Send automated expiry alerts at 60, 30, and 7 days before deadlines
- Generate compliance reports and landlord sharing links at your request
- Respond to your support enquiries
- Improve and develop the Service
- Comply with legal obligations
5. Legal Basis for Processing
Under UK GDPR, we process your data on the following bases:
- Contract: processing necessary to provide the Service you have subscribed to.
- Legitimate interests: improving the Service, ensuring security, and sending service-related communications.
- Consent: where you have opted in to specific notification preferences.
- Legal obligation: where we are required to retain or disclose data by law.
6. Data Sharing and Third Parties
We do not sell your personal data. We share data only with trusted service providers who help us operate the Service:
- Supabase: database hosting, authentication, and secure file storage for certificate documents.
- Resend: transactional email delivery for alerts and account communications.
- Vercel: application hosting and content delivery.
- Anthropic: powering the Compliance News feature when you request regulatory updates (no personal property data is sent).
All third-party providers are bound by data processing agreements and process data only on our instructions.
7. Data Retention
We retain your account and property data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.
Certificate documents stored in our secure storage are deleted when you remove the associated certificate or property, or when your account is closed.
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), secure authentication, row-level security on database records so each user can only access their own data, and private storage buckets for uploaded documents.
No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.
9. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict certain processing
- Request data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Information Commissioner's Office (ICO)
To exercise any of these rights, contact support@fretwellcompliance.uk. We will respond within one month.
10. Landlord Sharing Links
When you generate a landlord sharing link for a property, a read-only view of that property's compliance information becomes accessible to anyone with the link. You are responsible for sharing links only with authorised recipients.
11. Cookies
We use essential cookies required for authentication and session management. We do not use advertising or third-party tracking cookies.
12. International Transfers
Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.
13. Children
The Service is intended for business use by property professionals and is not directed at individuals under 18. We do not knowingly collect data from children.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.
15. Contact Us
For questions about this Privacy Policy or your personal data, contact: