Privacy notice

1. Who is responsible

PROPERTYSOURCE.PRO LTD, company number 17552051, is the controller for the marketplace information described here. Registered office: Suite 34, Cariocca Business Park, 2 Sawley Road, Manchester, England, M40 8BB. Use the contact form at /contact or write to our registered office. Privacy contact: [TODO: confirm the responsible privacy contact and public contact details]. ICO status: [TODO: ICO registration number or confirmed exemption].

2. Information we use

Depending on how you use the service, we process identity and contact details, account and role information, company and compliance details, listings, introductions, messages, agreements, reservation and transaction references, support enquiries and technical/security logs. Optional analytics may record interactions when you consent. Payment-card details are handled by the payment provider; do not send card details or identity documents through messages or our contact form.

Information may come from you, another participant in your deal, identity/payment providers or relevant public registers. Only request verification information through the designated secure process. Provider selection and the scope of any verification must be confirmed before live use.

3. Purposes and lawful bases

• Account administration, marketplace introductions, agreements and requested deal workflows: steps before entering a contract and performance of the contract, where applicable.
• Security, fraud prevention, service administration and dispute handling: legitimate interests, after considering necessity and your rights. You can object where this basis applies.
• Accounting, tax, legal claims and applicable compliance duties: legal obligations where a specific obligation applies, or legitimate interests as appropriate. A draft policy does not establish regulated status.
• Non-essential analytics: your consent, which you can withdraw through the cookie controls without affecting earlier lawful processing.

If information is necessary to fulfil your request or an applicable legal duty, we explain this when requesting it; withholding it may prevent that service. Marketing must have an appropriate lawful basis and a way to opt out. No new marketing permission is created by this notice.

4. Who receives information

We share relevant information with deal counterparties when needed for the service, service providers supporting the platform, professional advisers and authorities where lawfully required. We restrict disclosure to what is necessary. Providers may act as processors or independent controllers depending on their services; their role and contractual terms must be checked.

• Amazon Web Services (AWS): Application hosting, identity and storage in eu-west-2 (London). [TODO: confirm contracting entity, other processing locations and transfer safeguards]
• Stripe: Payment processing and connected-account services. Stripe's role depends on the service. [TODO: confirm enabled products, contracting entity, processing locations and contractual safeguards]
• KYC provider: [TODO: confirm selected verification provider, enabled scope, locations and retention; a mock adapter is not a live verification provider]
• Analytics: An optional PostHog EU adapter is present and requires consent and configuration before sending product events. [TODO: confirm whether enabled, contracting entity, event retention and processing locations]

5. International transfers and security

The application hosting region is London. A UK hosting region does not guarantee that every provider processes data only in the UK. Before a restricted transfer, the controller must identify a valid transfer mechanism, assess any necessary safeguards and make information about those safeguards available on request. We use access controls and private storage to reduce unauthorised access; no service can guarantee absolute security.

6. Retention

Keep information only for as long as necessary for the stated purpose, applicable legal duties and the establishment, exercise or defence of claims. Account closure does not automatically erase records that must lawfully be retained. The schedule must distinguish active records, archives, backups and legal holds. [TODO: approve a category-specific retention schedule for accounts, listings/deals, agreements/payment records, verification records, messages, complaints, analytics and security logs, including legal holds and deletion/anonymisation].

7. Your rights

Subject to applicable conditions and exemptions, you may request access, correction, erasure, restriction or portability; object to processing based on legitimate interests; and withdraw consent. Use our contact form or registered office. We may reasonably verify your identity. We normally respond within one month; if an extension is permitted, we explain the delay and your options.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to complete our complaints process before contacting the ICO.

8. Automated decisions

Security and eligibility checks may restrict an action. If you believe a restriction is wrong, contact us for review. Any proposed solely automated decision with legal or similarly significant effects requires a separate assessment, appropriate information and applicable safeguards before use; this draft does not authorise it.

9. Cookies and updates

Read our cookie policy for storage categories and controls. We will date material changes and explain them where appropriate. This draft must be completed against actual processing before it is treated as an approved live notice.