VERSION 2026-09-24-v6

Privacy Notice

Last updated 2026-09-28T05:45

1. Who is responsible

Configured operator: Mayfair Atrium Limited (Companies House no. 13505902), registered office: 167 - 169 Great Portland Street, Fifth Floor, London, England, W1W 5PF. Privacy contact: not configured. ICO registration: Configure if applicable. For tenant information entered by a landlord, the landlord may be a controller and the SaaS operator may act as its processor for parts of the service. These roles must be confirmed in the production contract.

2. Information we may process

Account identity/contact details; authentication and security records; property and tenancy information; rent/payment status; deposit information; maintenance requests and photos; messages; documents; device/browser and audit information; subscription/billing references; and privacy-request records. Full payment-card numbers and CVV values should not be stored by this platform.

3. Why we use information and lawful basis

Core account, tenancy and workflow processing is generally performed because it is necessary to provide the contracted service, comply with legal obligations, or pursue documented legitimate interests such as service security, fraud prevention and record integrity. Consent is used only where genuine choice is appropriate, such as optional marketing or optional device permissions. The required registration checkbox is therefore an acknowledgement of this notice and necessary processing, not a misleading claim that all processing depends on consent.

4. Sharing

Information may be shared with authorised landlords, tenants, agents, contractors, accountants or advisers as the workflow requires, and with contracted hosting, messaging, payment and security providers. Production deployment must list material subprocessors and international-transfer safeguards where relevant.

5. Payment information

Card/wallet details should be collected by the chosen payment provider or app store. The platform should retain only limited references such as customer ID, subscription ID, payment status, amount and timestamps needed for billing and reconciliation.

6. Retention

Personal data is kept only as long as necessary for the purpose for which it is used. Active account data is reviewed on closure. Tenancy/rent/maintenance records use a default six-year review point after relevant tenancy or claim activity ends, subject to the actual legal purpose. Property-business tax records may need to be retained for at least five years after the relevant 31 January Self Assessment filing deadline. Security records have a shorter default review period unless an incident requires longer preservation. The Privacy Centre shows the operational schedule.

7. Your rights

Depending on the processing and lawful basis, individuals may have rights of access, rectification, erasure, restriction, portability and objection. Optional consent can be withdrawn without affecting prior lawful processing. A request can be submitted from the Privacy Centre.

8. Account closure and erasure requests

An erasure or closure request is logged immediately. The account can be disabled as appropriate, but information subject to an overriding tax, legal, contractual-claim, fraud-prevention or security need may be restricted and retained until that need expires. The remainder should be deleted or irreversibly anonymised.

9. Security

The production service should use HTTPS, MFA, encrypted secrets/storage, least-privilege access, backups, logging, vulnerability management, upload scanning and secure payment-provider tokenisation. Users should not share passwords, Authenticator codes or recovery codes.

10. Complaints

Users should first contact the production privacy contact. The final notice should also explain the right to complain to the UK Information Commissioner's Office (ICO) and provide the current ICO contact route.

11. Changes to this notice

Material privacy changes are versioned, summarised in the Update Centre and, where required, presented for renewed acknowledgement. Historical acceptance records are retained so the operator can evidence which notice was presented.