Privacy Policy

1. The Data Controller & Contact Details

UABODE Ltd. is the Data Controller responsible for your personal data.

  • Company Name: UABODE Ltd.
  • Registered Address: Enterprise House, Station Street, Bishop's Castle, Shropshire, SY9 5AQ, United Kingdom
  • General Support: support@uabode.co.uk
  • Data Protection Lead: Andy@uabode.co.uk (Owner)

2. The Data We Collect

To create a basic account, we strictly require your email address. However, because our Service acts as a comprehensive property management tool and guides sellers through the UABODE Up-Front Information (UUFI) process, as you choose to use more features of the HomeHub, we may collect the following data based on what you voluntarily provide:

  • Identity & Contact Data: When you sign up, we strictly collect your email address. You also have the option to provide your full name, phone number, and personal address.
  • Lead Generation Data (Meta Lead Ads): We also collect personal data when you interact with lead generation features on third-party platforms, specifically Meta Lead Ads. This may include your full name, email address, phone number, property preferences, and any inquiry details you choose to provide.
  • Property Characteristics & Utilities: Address, postcode, UPRN, construction type, property features (bedrooms, bathrooms, garden, parking, size), property images, Energy Performance Certificate (EPC) rating, Council Tax band, utility connections, meter locations (including photographs), and details of any smart home systems.
  • Financial Data (Property Related): Details regarding ground rents, service charges, shared maintenance contributions, and confirmation on whether sale proceeds will cover existing mortgages.
  • Sensitive Property History & Legal Disclosures: Data required for legal property disclosure, including details of neighbour disputes, boundary changes, planning notices, structural faults (e.g. subsidence, damp), environmental issues (flooding, Japanese knotweed), and whether the property has been subject to crime, burglary, or violent death.
  • Third-Party Occupier Data: If non-owners (aged over 17) or tenants reside at the property, we collect their full names, ages, and tenancy statuses to facilitate the legal sale process.
  • Smart Home Handover Intent: Confirmation of whether you are willing to transfer access and logins to smart home systems to the buyer on completion. (Note: We do not collect, store, or process your actual passwords or digital credentials).
  • User-Generated Content & AI Interactions: Any data you choose to input into your "home hub" for property management (such as utility reminders, maintenance records, and personal notes), messages sent to other users on the platform, free-text answers to UUFI questions, and interactions with our AI Assistant.
  • Uploaded Documents & Files: Copies of physical or digital documents you choose to upload to your HomeHub Document Safe to support your property records or UUFI (such as certificates, title plans, guarantees, warranties, and tenancy agreements).
  • Technical Data: Internet Protocol (IP) addresses used to connect your computer to the internet, browser type, and interaction data regarding how you use our application.

(Note: We plan to introduce Identity (ID) Verification checks in the future. This policy will be updated prior to that feature going live).

3. Purposes & Lawful Basis for Processing

Under the UK GDPR, we must have a lawful basis to process your data. We process this extensive data for the following reasons:

  • To Provide Our Service (Contractual Necessity): To create and manage your account, allow you to manage your property via the HomeHub, generate your UUFI pack, and facilitate the sale of your home.
  • To Comply with Legal Obligations (Legal Obligation): The UUFI is designed to help sellers meet their disclosure obligations under the Consumer Protection from Unfair Trading Regulations 2008.
  • To Fetch Property Data (Legitimate Interest): We use your property address to query the Open EPC API to retrieve Energy Performance Certificate data for your listing.
  • To Power AI-Assisted Features (Legitimate Interest): We use an AI Assistant to help you frame free-text answers clearly and to help generate your public listing descriptions using your property details.
  • To Facilitate Legal Conveyancing (Legitimate Interest & Contractual Necessity): We process your property history, financial disclosures, and third-party occupier data to pass to your chosen conveyancer, the buyer's conveyancer, and their valuer to speed up the legal transfer of the property.
  • To Ensure Security and Prevent Fraud (Legal Obligation & Legitimate Interest): We monitor IP addresses and retain encrypted records of user messages to ensure platform safety and to comply with Anti-Money Laundering (AML) regulations where applicable.
  • To Send Service Notifications (Contractual Necessity / Legitimate Interest): We will send you essential transactional emails required for the Service to operate, such as notifications when you receive a UFI request, account security alerts, or password resets.
  • For Marketing and Automated Reminders (Consent): If you explicitly opt-in, we will send you automated property management reminders and promotional communications. You can withdraw your consent and opt out of these emails at any time via your account settings.
  • To Respond to Property Inquiries (Consent / Legitimate Interest / Contractual Necessity): Where you submit an inquiry via a Meta Lead Form, we process this data under Consent (for opted-in marketing) or Legitimate Interest/Contractual Necessity (to respond to your inquiry or request).

4. Data Sharing & Third Parties

Due to the nature of a property transaction and the marketplace, your data is shared with specific parties at different stages:

  • The Public P2P Marketplace: When you publish a listing, basic property details, images, and a non-sensitive snapshot of your UFI data will be visible to other users and the public on our HomeMatch platform.
  • Prospective Buyers (With Your Explicit Consent): While basic property details are visible on the public marketplace, the comprehensive UUFI information pack contains detailed and potentially sensitive property history. We will only share the full UUFI pack with prospective buyers if you explicitly grant them access to view it. You maintain full control over who receives this detailed information during the negotiation process, how long they can access it for, and can revoke their access at any time.
  • Conveyancers and Valuers: Your completed UUFI, including all highly sensitive property history, dispute details, financial obligations, and uploaded documents, is securely transmitted to your chosen conveyancer, the buyer's conveyancer, and their valuer to form part of the contract of sale.
  • The Ultimate Buyer (HomeHub Transfer): Upon successful completion of your sale, your HomeHub digital property logbook will be duplicated and transferred seamlessly to the buyer. Basic property details, service records, and property photos will be transferred automatically. However, you maintain full control over which pieces of sensitive, personal, or user-generated data are included in this final handover.
  • Service Providers: We use trusted third-party providers to run our application, specifically Google Cloud Platform (GCP), which hosts our web application, SQL databases, and secure document/image storage buckets. We also utilise third-party AI APIs to power our AI Assistant features.
  • Legal and Regulatory Authorities: We may disclose your data if required by law, such as to UK law enforcement or regulatory bodies, to comply with AML regulations, fraud investigations, or court orders.
  • Data Processors: We strictly do not sell, rent, or trade your personal data to any third party. We may share it with trusted processors who help us deliver our services (e.g. CRM software, email dispatch providers), bound by data protection agreements.

5. International Data Transfers

Your data is securely hosted on Google Cloud Platform servers located in the UK. We strive to keep all personal data within the UK. If we utilise third-party services (such as AI generation APIs) that process data outside the UK, we ensure that appropriate legal safeguards (such as Standard Contractual Clauses or UK Addendums) are in place to protect your data.

6. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

  • Active Accounts: We retain your profile, property data, and home hub records for as long as your account remains active.
  • Deleted Accounts & AML Compliance: If you delete your account, we will delete your user-generated home hub data and standard profile data. However, to comply with UK Anti-Money Laundering (AML) regulations and financial tracking, we may be legally required to retain transaction records, encrypted messages, and core identification data for up to 5 years after the closure of your account.
  • Direct Inquiries: Retained for up to 12 months from submission, after which it's securely deleted if no transaction or active engagement occurs.

7. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way:

  • All data transmitted between your browser and our servers is secured using HTTPS.
  • Our Google Cloud SQL databases and storage buckets are encrypted at rest.
  • Messages sent between users are secured using envelope encryption. We maintain the encryption keys strictly to allow secure decryption only when legally necessary (e.g. for AML audits or fraud investigations).
  • Access to our backend systems is restricted via service accounts with minimum necessary permissions.

8. Automated Decision-Making

We do not currently use your personal data for any automated decision-making or profiling that would have a legal or similarly significant effect on you.

9. Your Legal Rights under UK GDPR

Under UK data protection laws, you have rights relating to your personal data:

  • The right to be informed about how your data is used.
  • The right of access to request a copy of the personal data we hold about you.
  • The right to rectification to correct any inaccurate or incomplete data.
  • The right to erasure (the "right to be forgotten"), allowing you to ask us to delete your data where there is no good reason for us continuing to process it.
  • The right to restrict processing of your personal data.
  • The right to data portability, allowing you to request the transfer of your data to you or a third party.
  • The right to object to the processing of your personal data.

If you wish to exercise any of these rights, please contact us at support@uabode.co.uk.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

10. Cookies and Similar Technologies

Our application uses cookies to distinguish you from other users, provide secure logins, and ensure the basic functionality of the site.

  • .AspNetCore.Antiforgery.* (Session duration): Set by Microsoft AspNet to prevent Cross-Site Request Forgery (CSRF) attacks.
  • Identity.External & .AspNetCore.Mvc.CookieTempDataProvider (Past duration): Used for secure authentication and temporary data state management.
  • _fbp (Facebook Browser Pixel): Used to store a unique browser identifier to track user sessions across the site.
  • _fbc (Facebook Click ID): Captures and stores Facebook Click ID from the URL when a user arrives on the site from a Meta ad.

These cookies help us secure your session and understand site usage. Cookies set directly by our application do not store personally identifiable information. Where you interact with Meta Lead Ads or Meta pixel features, Meta may use _fbp and _fbc to link your browsing activity to your Meta account for ad tracking purposes — see Meta's own privacy policy for how they handle that data.

11. Children's Privacy (Age Limitations)

Our Service is designed for adults dealing with property management and real estate transactions. It is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@uabode.co.uk, and we will take immediate steps to delete such information from our systems.

12. Third-Party Links

Our application may contain links to third-party websites, plug-ins, and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our application, we encourage you to read the privacy policy of every website you visit.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our technology, features, or legal requirements. If we make material changes to how we process your personal data, we will notify you via email to the address associated with your account. We encourage you to review this policy periodically to stay informed about how we are protecting your information.