Privacy Policy

1. Introduction

Keystone ("we", "our", or "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our supported exempt accommodation management platform.

We are registered in England and Wales and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, organisation details, and job title when you register for an account.
• Property Information: Property addresses, room details, compliance documents, and related operational data.
• Tenant Information: Names, contact details, support notes, incident reports, and other information necessary for providing supported accommodation services.
• Billing Information: Billing contact and payment details for your subscription, processed by our payment provider.
• Communications: Messages, support requests, and feedback you send to us.

2.2 Information Collected Automatically

• Usage Data: How you interact with our platform, including pages visited, features used, and time spent on the platform.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Cookies and Similar Technologies: We use cookies to maintain your session, remember preferences, and analyse platform usage.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our platform and services
• To process your subscription and payments
• To enable collaboration between team members within your organisation
• To send service-related communications and updates
• To provide customer support and respond to your requests
• To detect, prevent, and address technical issues and security threats
• To comply with legal obligations and regulatory requirements
• To analyse usage patterns and improve user experience

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services and preventing fraud.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.
• Consent: Where you have given explicit consent for specific processing activities.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Within Your Organisation: With other authorised users in your organisation as configured by your administrator.
• Service Providers: With third-party vendors who assist us in operating our platform (e.g., cloud hosting, payment processing, analytics).
• Legal Requirements: When required by law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate safeguards.
• With Your Consent: When you have given explicit permission for specific sharing.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Regular backups and disaster recovery procedures
• Employee training on data protection and security
• Incident response procedures for potential breaches

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including:

• Active account data is retained while your subscription is active
• Billing and invoice records are retained for 7 years as required by law
• Support notes and tenant records are retained according to your organisation's retention policies and regulatory requirements
• After account closure, we may retain certain data for legal compliance or legitimate business purposes

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: Request limitation of how we use your data.
• Right to Data Portability: Receive your data in a structured, commonly used format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making: Request human review of automated decisions that significantly affect you.

To exercise these rights, please contact us through the support channel in your dashboard.

9. Cookies

We use cookies and similar tracking technologies to enhance your experience. Types of cookies we use:

• Essential Cookies: Required for the platform to function (authentication, security).
• Functional Cookies: Remember your preferences and settings.
• Analytics Cookies: Help us understand how you use the platform to improve our services.

You can control cookies through your browser settings. Note that disabling certain cookies may affect platform functionality.

10. International Data Transfers

Our primary data processing occurs within the United Kingdom and European Economic Area. Where we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the ICO
• Adequacy decisions where applicable
• Binding Corporate Rules where relevant

11. Special Category Data

Given the nature of supported exempt accommodation services, our platform may process special category data (such as health information) on behalf of your organisation. This processing is:

• Necessary for the provision of health or social care services
• Subject to enhanced security measures
• Processed in accordance with your organisation's policies and legal basis

Your organisation acts as the data controller for tenant data, and we act as the data processor under a Data Processing Agreement.

12. Third-Party Services

Our platform integrates with third-party services that have their own privacy policies, including:

• Stripe: For payment processing
• Supabase: For database and authentication services

13. Children's Privacy

Our platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or through the platform.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us through the support channel in your dashboard or visit our website at keystonesuite.co.uk.