How Building Trust handles your data.

Who we are

Building Trust Ltd is a company registered in England and Wales under company number 17308423. Our registered office is 4A Hafer Road, London SW11 1HF.

Building Trust Ltd is the controller for personal data processed in connection with LEASE-iQ, BLOCK-iQ and this website. The purposes for which that data is processed, and the lawful bases relied on, are explained in this notice.

This policy covers LEASE-iQ, the Building Trust website and controlled BLOCK-iQ co-creation work. BLOCK-iQ is not currently offered as a public self-service product.

Data controller: Building Trust Ltd. Privacy contact: Adam Street at adam.street@building-trust.uk.

What data we collect

Website visitors

We collect standard website analytics and technical records, such as pages visited, browser type, request time and approximate location derived from an IP address. We do not use advertising trackers or sell data to third parties.

Questions typed into the website guide stay in the visitor's browser unless the visitor chooses Ask Adam. The handoff shows an editable summary and contact form before anything is sent. If the visitor approves it, Building Trust receives only the approved summary, email address, any optional name and organisation, the page address and a reference number. The rest of the guide conversation is not sent or stored by the website.

The BLOCK-iQ interest route also shows an editable summary before anything is sent. Building Trust receives the approved summary, name, email address, any organisation supplied, the page address and a reference number. The route does not accept building records or attachments.

If you subscribe to the monthly digest, Twilio SendGrid collects your email address, your selected role and limited technical records associated with the form submission. Building Trust uses the role only to tailor the digest.

LEASE-iQ users

When you use LEASE-iQ, you upload a lease document. We process the document to provide your analysis. We also collect your email address and account information when you create an account.

BLOCK-iQ co-creation

Where building information is supplied during controlled BLOCK-iQ co-creation, it may include building details, leaseholder names, unit information, compliance records, service charge data and consent records. The information is supplied by the building director, managing agent or another authorised representative.

Contact and access requests

If you contact us, use the website-guide handoff, register interest in BLOCK-iQ or request access, we collect your name, email address, organisation, building description and any information you choose to provide. Do not attach a lease to the first access-request email or include leases, building records or third-party personal data in a website summary.

How we use your data

We use personal data to provide the service requested, including lease analysis, controlled co-creation work and responses to enquiries. We also use technical records to operate, secure and diagnose the website and products.

If you choose the monthly digest, we use your email address to manage the subscription, send the digest and honour an unsubscribe request.

We do not sell, rent or share personal data with third parties for their marketing.

LEASE-iQ produces informational analysis. It does not make a solely automated decision about a person that has a legal or similarly significant effect.

Lawful basis for processing

Under Article 6 of the UK GDPR, the lawful bases we rely on are:

• Contract, Article 6(1)(b): processing necessary to provide LEASE-iQ or an agreed Building Trust service under the applicable terms.
• Legitimate interests, Article 6(1)(f): operating and improving the service, answering enquiries, handling access requests and protecting the website and products.
• Consent, Article 6(1)(a): optional newsletters and marketing communications. Consent can be withdrawn at any time.
• Legal obligation, Article 6(1)(c): retaining records where UK law requires us to do so.

You are not required to send an access request. The website access route does not make a solely automated decision about you.

Lease documents

Lease documents uploaded to LEASE-iQ are processed by its AI engine to provide the requested analysis. Documents are encrypted in transit using TLS 1.2 or later and at rest.

LEASE-iQ processing runs on Google Cloud Platform in the europe-west2 London region. A lease does not leave the UK during processing and is not used to train Building Trust, Google or third-party AI models.

Documents are not shared with other users. A user must have the right to upload any document submitted.

Deletion

A lease is retained while the account is active so the user can continue conversations and run further analysis. A user can delete a document through My Leases → Delete. The file and associated conversation history are removed within 30 days.

If an account is closed, its documents and chat history are deleted within 30 days. Backups containing deleted data are purged within a further 60 days.

BLOCK-iQ building data

Where BLOCK-iQ co-creation involves building-management data, the management company, RTM company, share-of-freehold company or RMC is the controller for leaseholder personal data it supplies. Building Trust acts as a processor on its behalf.

Leaseholder personal data is made available only to authorised users with the appropriate role. The controller remains responsible for ensuring that the data was collected lawfully and is accurate.

Business customers and data processing agreements

Where Building Trust processes personal data on behalf of a business customer, it does so as a processor under a written data processing agreement. Business customers can request a copy at adam.street@building-trust.uk.

Data storage, security and retention

Data is stored on secured, encrypted infrastructure. The application uses PostgreSQL databases hosted on infrastructure with industry-standard security controls. Access to production data is restricted and logged.

• Account data: for the life of the account, then deleted within 30 days after closure.
• Lease documents and chat history: for the life of the account, subject to the deletion periods above.
• Transactional emails and audit logs: 12 months.
• Website-guide handoff emails: 12 months, unless the enquiry becomes part of an active customer, complaint or legal record that must be kept for longer.
• BLOCK-iQ interest emails: 12 months, unless the enquiry becomes part of controlled co-creation, an active customer, complaint or legal record that must be kept for longer.
• Newsletter contact records: while subscribed. A limited suppression record may be retained after an unsubscribe request so the person is not emailed again.
• Anonymised analytics: up to 26 months.
• Records required by law, including UK tax records: for the period the law requires.

Your rights

Under UK GDPR, you may have rights to be informed, access personal data, correct inaccurate data, request erasure, restrict processing, receive portable data, object to legitimate-interest processing and receive information about automated decision-making and profiling.

To exercise a right, contact adam.street@building-trust.uk. We normally respond within one calendar month.

If you are a leaseholder whose information was supplied by a building-management organisation, that organisation is normally your first point of contact as controller. Building Trust will assist it with the request. You can also contact Building Trust directly if the controller does not respond within a reasonable time.

Complaints and the ICO

Send a data-protection complaint to adam.street@building-trust.uk. We will investigate without undue delay, keep you informed and explain the outcome.

You can complain to the Information Commissioner's Office at any time. The ICO is the UK supervisory authority for data protection.

Cookies and website data

The Building Trust website does not use advertising cookies or behaviour-tracking scripts that identify individual users.

The monthly-digest signup form loads only after a visitor chooses Subscribe. The form sends the email address and selected role to Twilio SendGrid through a protected Building Trust endpoint.

IONOS provides the public web hosting and building-trust.uk email route. IONOS says its Web Hosting product anonymises visitor data when it is collected, keeps it for eight weeks, does not pass it to third parties and does not transfer it outside the EU. Its SiteAnalytics service is active by default and uses a pixel or log data, not cookies.

Third-party services

Building Trust uses service providers to operate its website and products:

• IONOS: public website hosting and the building-trust.uk email route.
• Twilio SendGrid: transactional emails, monthly-digest signup and email delivery.
• Codapt: application hosting used in controlled BLOCK-iQ work.
• Google Cloud Platform: hosting and AI processing infrastructure for LEASE-iQ. AI inference runs in europe-west2 London.
• Stripe: payment processing where a paid subscription applies. Stripe acts as a separate controller for payment data.

Each provider processes data under its applicable privacy terms and the contractual controls held with Building Trust.

International processing

LEASE-iQ lease-document and conversation processing runs in Google Cloud Platform's europe-west2 London region. IONOS says the website visitor data described above is not transferred outside the EU.

Twilio SendGrid and Stripe are global services and may process limited email, device, account or payment information outside the UK. Their current data-protection terms include transfer mechanisms for personal data that leaves the UK. You can ask Building Trust for information about the transfer route that applies to a particular service.

Changes and contact

We may update this policy. Material changes will be communicated through the website, and the date at the top of this page will change.

For privacy questions or requests, contact Adam Street at adam.street@building-trust.uk.