Privacy Policy

1. Who We Are and Our Responsibilities

Premises Hub is supplied by Louise Amanda Ltd, a company registered in England and Wales with company number 11163659. Registered office address: to be updated. For privacy questions or to exercise your rights, email hello@thepremiseshub.com.

This policy explains how we handle personal information in connection with our business premises administration service. It applies to website visitors, account holders, customer representatives and people whose information is included in a customer workspace.

We are the data controller for account administration, our support communications, service security and billing administration: we determine why and how that information is used. Where a customer decides the purposes for personal information uploaded into property records or documents, the customer is the controller and we act as its processor, handling that information on its instructions to provide the service. The same organisation may have different responsibilities for different uses of information.

If your information was added by a customer, contact that organisation first about its use of your information. We can help identify the appropriate route for a request without disclosing another organisation’s confidential records.

2. Information We Handle

The information involved depends on how you and your organisation use the service. It may include:

• Account and contact information: names, email addresses, profile details, account identifiers and preferences supplied for account access and communication.
• Organisation and team information: organisation details, memberships, roles, invitations and property or information access permissions.
• Property records: premises and lease details, landlord, agent and contractor names and contact details, and other personal information entered in records or notes.
• Documents and work records: uploaded files, supporting correspondence, important dates, assigned tasks, compliance and maintenance records, and information about the people responsible for them.
• Technical and security information: information generated when the website or service is used, such as network and device information, request and error logs, and authentication or access activity where recorded.
• Support information: enquiries and correspondence you send to us, together with information needed to investigate and respond.
• Billing administration: subscription or trial status and payment-related references where payment services are offered. Payment card details are handled by the payment provider, not stored by Premises Hub.

Please only upload information that is relevant and that you are entitled to share. The service is not intended as a repository for unnecessary sensitive personal information. Customers are responsible for deciding whether their records contain special-category or criminal-offence information and for establishing any additional legal conditions required for that processing.

3. Where Information Comes From

We receive information directly from you when you create or use an account, provide records or contact us. We also receive information from your organisation and its authorised members when they invite users, manage permissions or add records and documents. Technical information is generated automatically when you access the website and service. Where billing is offered, the payment provider may supply information needed to identify a transaction and its status.

If you provide another person’s information, you must have an appropriate basis for doing so and provide them with the relevant privacy information. We do not treat a customer’s upload as that person’s consent to unrelated uses.

4. Purposes and Lawful Bases

For information we handle as controller, we use the following UK GDPR Article 6 bases, as appropriate to the particular activity:

• Providing and administering accounts: to set up access, administer the service and respond to service requests, we rely on performance of a contract with you, or steps you request before entering one (Article 6(1)(b)). Where our contract is with your organisation rather than you personally, we rely on our legitimate interests in providing and administering that organisation’s service (Article 6(1)(f)).
• Team access and customer support: we rely on contract where the request is part of our contract with you, and otherwise on legitimate interests in managing authorised access, answering enquiries and resolving problems.
• Security and service reliability: we rely on legitimate interests in protecting accounts and information, preventing misuse and investigating errors or security incidents. A legal obligation may also apply where an incident requires statutory action or reporting.
• Billing and business records, where applicable: we rely on contract to administer the agreed purchase, legitimate interests in managing an organisation’s account and resolving payment queries, and legal obligation (Article 6(1)(c)) for records required by tax, accounting or other applicable law.
• Legal requests and disputes: we rely on legal obligation where disclosure or retention is required by law, and legitimate interests where necessary to establish, exercise or defend legal claims.
• Optional activities requiring consent: where relevant, we rely on consent (Article 6(1)(a)), including for optional cookies where consent is required. We will explain the activity and obtain the required consent before it takes place. You may withdraw consent without affecting the lawfulness of earlier processing.

When relying on legitimate interests, we consider the purpose, whether the use is necessary, your reasonable expectations and the potential effect on your rights. We balance those interests against your interests and rights, limit the information used and apply appropriate protections. You may object to processing based on legitimate interests; we will consider the request in accordance with the law.

For customer-controlled workspace information, we process on the customer’s instructions to deliver the service. The customer, as controller, is responsible for determining and explaining its lawful basis, rather than relying automatically on our account-administration bases.

5. Sharing Information

Information is shared only where relevant to providing the service, carrying out the purposes above or meeting a legal requirement. Recipients may include:

• Supabase, used for authentication, database records and private file storage.
• Application hosting and technical service providers needed to run and protect the service, and email service providers where email facilities are used.
• Stripe, where payment services are enabled, for payment processing and related billing administration, under its applicable terms and privacy information.
• Authorised members of your organisation, according to their workspace and property permissions. Your organisation is responsible for deciding who should have access.
• Professional advisers where necessary for a specific business or legal matter, and courts, regulators or other authorities where disclosure is required or otherwise lawful.

Service-provider access should be limited to what is needed for its role and subject to appropriate contractual and confidentiality arrangements. Some recipients, such as payment providers or authorities, may act as independent controllers for their own legal responsibilities. This policy does not replace their privacy notices.

6. International Transfers

Depending on the services involved, personal information may be processed outside the UK. Where a transfer is subject to UK data-protection restrictions, it must be covered by appropriate safeguards as required by law, such as applicable adequacy regulations or approved contractual safeguards, with any necessary assessment and additional measures. We do not make a general promise that all information stays in the UK. Contact us for information about safeguards relevant to your data.

7. Security

We use reasonable technical and organisational measures appropriate to the information and risks, including authenticated account access, workspace and property permissions and controls on private document access. These measures are intended to reduce unauthorised access, loss and misuse, not to provide an absolute guarantee of security.

You and your organisation also have a role in protecting information: keep credentials and recovery links private, review team permissions and avoid uploading information unnecessarily. Report suspected account misuse or a privacy concern promptly using the contact above. Where a personal data breach occurs, applicable notification and assistance obligations depend on our controller or processor role and the circumstances.

8. Retention and Deletion

Account and workspace information is generally retained while the account or service relationship is active and needed for its purpose. Following closure, only limited retention should continue where justified by legal duties, support or security needs, the resolution of disputes or the orderly removal of information from backups. Different categories may need different periods.

Closure and deletion arrangements must include a documented schedule appropriate to the information, taking account of the purpose, sensitivity, applicable obligations and technical backup cycles. Contact us for the retention and deletion arrangements relevant to your account. This policy does not promise a fixed number of days after closure or immediate removal from every backup. Where information remains in backups pending their normal removal or replacement, its use should remain limited to the relevant recovery or legal need.

For customer-controlled records, return or deletion must also take account of the customer’s instructions and any applicable processing agreement. Contact us before closing an account if you need to discuss retrieval, deletion or a legal retention requirement. Deletion requests are assessed against applicable rights and duties; information needed to meet a legal obligation may not be immediately erased.

9. Your Rights and Complaints

Depending on the circumstances, you have rights to access your personal information; correct inaccurate information; request erasure; restrict processing; object to processing, including on legitimate-interest grounds; and receive or transfer certain information in a portable form. Where processing relies on consent, you may withdraw it. Rights are not absolute and may be subject to legal exceptions.

Email hello@thepremiseshub.com with enough detail for us to understand your request. We may need proportionate information to verify your identity and protect other people’s information. We will respond within the applicable legal timescales and explain any permitted extension or reason a request cannot be fulfilled. For customer-controlled records, we may refer the request to the customer and assist it as required.

You may complain to the UK Information Commissioner’s Office (ICO). See ico.org.uk/make-a-complaint/ for information. You do not have to contact us first, although we welcome the opportunity to resolve a concern.

10. Cookies and Similar Technologies

Essential cookies and similar browser storage support functions such as signing in and maintaining secure access. Blocking essential storage may prevent those functions working. Non-essential cookies or tracking, if used, require consent where the law requires it and should not be activated before that consent. Details of the technologies, purposes, duration and available choices belong in a separate cookie notice. This policy does not itself give consent to optional tracking.

11. Business Use and Children

Premises Hub is intended for business users managing premises, not for children. Please do not create an account for a child or add children’s personal information unless it is genuinely necessary, lawful and appropriate to the customer’s responsibilities. Contact us if you believe children’s information has been provided inappropriately.

12. Changes to This Policy

We may update this policy to reflect changes to the service, our practices or legal requirements. The date at the top identifies the latest version. Where a change materially affects how we use personal information, we will take appropriate steps to bring it to your attention and obtain new consent where required. Please review the policy periodically.