Privacy Policy

Data Controller: iPO Hub Limited, a company incorporated in England and Wales.

Registered Office: Available on request and via Companies House.

Contact: [email protected]

iPO Hub Limited is the HoldCo for the iPO Hub platform. We operate iPO Core (portfolio management), iPO Comply (compliance engine), and iPO Autonomy (operations engine) as integrated product lines under a single platform.

We collect the following categories of personal data:

• Identity data:Full name, date of birth, Companies House registration number (for landlord entities).
• Contact data:Email address, telephone number, postal address.
• Account data:Login credentials (passkey public keys, magic-link tokens), session identifiers.
• Property data:Property addresses, tenancy terms, rent amounts, compliance certificate dates.
• Tenant data:Tenant names, contact details, tenancy agreements — processed on behalf of landlord clients.
• Financial data:Subscription billing details (processed by our payment processor; we do not store card numbers). We never hold rental income.
• Usage data:Log data, IP addresses, browser type, pages visited, feature usage analytics.
• Communications:Support tickets, email correspondence, contact form submissions.

We process personal data under the following UK GDPR lawful bases:

• Contract:Processing necessary to perform our subscription agreement with you.
• Legal obligation:Processing required to comply with statutory landlord obligations (Housing Act 1988, Deregulation Act 2015, Renters' Rights Act 2025, Awaab's Law, etc.).
• Legitimate interests:Platform security, fraud prevention, product improvement, and analytics — balanced against your rights.
• Consent:Marketing communications (you may withdraw consent at any time).

• Providing and operating the iPO Hub platform and its product lines.
• Generating statutory compliance notices, certificates, and evidence bundles.
• Sending transactional communications (magic-link emails, compliance alerts, renewal reminders).
• Processing subscription payments via our payment processor.
• Maintaining the SHA-256 hash-chained audit ledger for CPR Part 39 compliance.
• Detecting and preventing fraud, abuse, and security incidents.
• Improving platform features through aggregated, anonymised analytics.
• Responding to support requests and legal enquiries.

We do not sell your personal data. We share data only with:

• Infrastructure providers:Cloudflare (edge compute, storage, DDoS protection) — data processed under Cloudflare's DPA.
• Payment processor:Our PCI-DSS compliant payment processor for subscription billing. We do not store card data.
• Email delivery:Transactional email provider for magic-link and compliance notification delivery.
• Legal authorities:Where required by law, court order, or regulatory obligation.
• Professional advisers:Solicitors, accountants, and auditors under confidentiality obligations.

All third-party processors are bound by data processing agreements compliant with UK GDPR Article 28.

• Account data:Retained for the duration of your subscription plus 7 years (Companies Act 2006 accounting records requirement).
• Compliance records:Retained for 6 years post-tenancy end (Limitation Act 1980) or longer where statutory obligations require.
• Audit ledger:SHA-256 hash-chained entries are immutable by design; retained indefinitely for evidentiary integrity.
• Marketing data:Retained until you withdraw consent or request erasure.
• Support communications:Retained for 3 years from last interaction.

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data where no legal basis for retention exists.
• Right to restriction — request we limit processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects.

To exercise any right, contact [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We implement appropriate technical and organisational measures including:

• TLS 1.3 encryption in transit; AES-256 encryption at rest.
• Passkey (WebAuthn) and magic-link authentication — no passwords stored.
• SHA-256 hash-chained audit ledger — tamper-evident by design.
• Cloudflare edge infrastructure with DDoS protection and WAF.
• Role-based access controls and principle of least privilege.
• Regular security assessments and penetration testing.

For full details, see our Security page.

We use the following cookies:

• Strictly necessary:Session authentication tokens. Cannot be disabled.
• Analytics:Aggregated, anonymised usage analytics to improve the platform. No cross-site tracking.
• Preferences:UI preferences (theme, language). Stored locally.

We do not use advertising or third-party tracking cookies.