How we handle your data.

1. Who we are

LeaseFlow Ltd ("LeaseFlow", "we", "us", "our") is a UK-registered software supplier providing case-management tooling to SRA-regulated and equivalent UK conveyancing law firms.

• Registered office: 1 Cinnamon Street, London E1W 3NJ
• Company number: 15287443
• ICO registration: ZB582143
• Data protection contact: privacy@leaseflow.uk

2. Our role under UK GDPR

For data about the subscribing firm's own personnel (fee-earners, paralegals, partners using LeaseFlow), we act as data controller.

For data about the firm's clients and their matters uploaded to the platform, we act as data processor. The subscribing firm remains the controller and retains ultimate responsibility for lawful basis, retention and data subject rights handling.

A Data Processing Agreement (DPA) compliant with UK GDPR Article 28 is available on request for all paid plans.

3. What we collect

Account & billing data (we are controller):

• Name, work email, password hash (bcrypt, 12 rounds)
• Firm name, role, team size
• Billing address & payment method tokens (handled by Stripe — see section 6)
• Service logs (login times, IP addresses, browser strings — for security & audit)

Matter & client data (we are processor):

• Case file information input by the firm (parties, statutory dates, status history)
• Documents uploaded by the firm or by clients via the portal
• Client contact details, where the firm chooses to add them
• Audit trail of fee-earner actions within the matter file

4. Where we store it

• Primary infrastructure: AWS eu-west-2 (London)
• Database backups: encrypted, retained 30 days, same region
• Documents at rest: AES-256 encrypted
• Transit: TLS 1.2 minimum, modern cipher suites only
• No data is transferred outside the UK or EEA.

5. Lawful basis

• Contract: account creation, billing, providing the service to the subscribing firm.
• Legitimate interests: security logging, fraud prevention, service improvement (with appropriate safeguards).
• Legal obligation: HMRC tax records, SRA audit assistance where required.
• Consent: marketing emails (always opt-in, always revocable).

6. Sub-processors

We use a small, curated list of sub-processors. Each is GDPR-compliant and UK/EEA-hosted unless noted:

• Amazon Web Services — hosting (eu-west-2, London)
• Stripe Payments UK Ltd — subscription billing (UK-regulated)
• Resend — transactional email delivery (US-hosted, SCC + UK Addendum in place)
• MongoDB Atlas — managed database (eu-west-2)

A current sub-processor list is provided as part of the DPA on request.

7. What we don't do

• Sell firm or client data to third parties
• Use firm or client data to train third-party AI models
• Share matter data with anyone except the subscribing firm and its authorised users
• Operate cookies for advertising or third-party tracking

8. Retention

• Active subscription: retained for as long as the firm uses the service.
• On cancellation: matter data retained for 90 days then permanently deleted, unless the firm requests earlier deletion or longer SRA-mandated retention.
• Billing records: retained 7 years (HMRC requirement).
• Security logs: retained 12 months.

9. Your rights

Under UK GDPR you have the right to:

• Access your personal data (subject access request)
• Correct inaccurate data
• Erase your data ("right to be forgotten") — subject to overriding legal obligations
• Restrict processing
• Data portability (export in a structured format)
• Object to processing based on legitimate interests
• Withdraw consent at any time for consent-based processing

To exercise any of these rights, email privacy@leaseflow.uk. We respond within one calendar month. If you are dissatisfied with our response, you may complain to the UK Information Commissioner's Office at ico.org.uk.

10. Cookies

LeaseFlow uses only strictly-necessary cookies for authentication (httpOnly session cookies) and to remember your login. No advertising, analytics or third-party tracking cookies are set on our marketing site.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified to the billing email address held on the firm's account at least 30 days before they take effect.

12. Contact

Privacy / data subject requests: privacy@leaseflow.uk

Security disclosures: security@leaseflow.uk

Postal: LeaseFlow Ltd, 1 Cinnamon Street, London E1W 3NJ, United Kingdom