Last updated: 14 October 2026
This policy explains how BlockHub52 collects, uses and protects personal information when you visit blockhub52.co.uk, use our application at blockhub52.ai (including the Handover Tracker), sign up for our newsletter or free resources, or contact us. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, because our company is based in Estonia, the EU General Data Protection Regulation (EU GDPR).
BlockHub52 is a trading name of Streamshare DM OÜ, a private limited company registered in Estonia.
We are registered with the Information Commission (the ICO), registration number ZC258019.
We provide compliance and service charge management software for Right to Manage (RTM) companies and Residents' Management Companies (RMCs) in England and Wales.
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/12295221442
Our appointed UK representative is Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom.
We are the controller of personal data we collect for our own business: your app account, billing, newsletter and free resource sign-ups, help and updates emails, onboarding calls, live chat and emails you send us. This means we decide how that data is used.
We are a processor for the data your RTM or RMC company enters about its building, such as leaseholder names, contact details, service charge demands, payments, arrears and compliance records. Your company is the controller of that data. We only use it to run the application for your company, following your company's instructions and our data processing agreement with it.
If you are a leaseholder and have a question about your data, please contact the directors of your RTM or RMC company first. We will help them respond.
To sign up, or to get the 'RTM Handover Pack' or our newsletter, you need to give us your name and email address. To get the result of a free tool by email, you need to give us your email address. To set up a building, you need to give us the building's and the company's details. To subscribe, your company needs to give its payment details to Stripe. Without these details, we cannot provide that part of the service. Anything else you give us is optional.
We do not use passwords. You sign in with a link that we email to you.
When you agree to our 'Terms of Service' and our data processing agreement, we record your name, email address, the date and time, the version you agreed to, and the IP address and browser used. If you sign up for the Handover Tracker, we record your agreement again when you finish setting up your building, with the name and Companies House number of the RTM company you named. Lawful basis: legitimate interests (being able to show what was agreed, and defending legal claims).
Lawful basis: legitimate interests (giving the directors and other people your company authorises access to the application, under our contract with your company, and keeping accounts secure and detecting misuse).
Lawful basis: for your company's details, our contract with your company. For the name and email address of the person who deals with billing, legitimate interests (running our contract with your company). We keep invoices and payment records for 7 years because Estonian accounting law requires it. For the EU GDPR, the lawful basis for keeping them is legal obligation. For the UK GDPR, it is legitimate interests (complying with the accounting law that applies to our company).
Lawful basis: legitimate interests (providing the service under our contract with your company). Freeholder contact details and the building's bank account details are held for your RTM or RMC company, as your company's processor (see section 2). If you invite someone, please let them know you have added their details.
Our role: processor. Your RTM or RMC company decides the lawful basis for this data. Please do not record health or other sensitive personal information in notes unless it is truly necessary.
Service emails are emails about your account and your building, such as sign-in links, reminders about your acquisition date (the day your RTM company takes over) or your 45 days of free use, and emails telling you that records or an account will be deleted. They are sent through Resend. Service charge demands and reminders that your company sends to leaseholders through BlockHub52 are sent for your company, as your company's processor (see section 2). Lawful basis: legitimate interests (running the service your company uses, and telling you about your account).
If you sign up for the Handover Tracker, service emails also include: the free 'RTM Handover Pack', which we email once you have opened your sign-in link; if you have opened your sign-in link but not finished setting up, up to two reminders to finish setting up your Handover Tracker, 2 and 7 days after you sign up, each with a link to stop them; and reminders before your handover dates (the day to post by, the access date, the Handover Deadline and the reply-by date), which go to every director of the building with a sign-in.
Help and updates emails are occasional emails promoting the BlockHub52 service, with practical tips and news, such as a reminder to book your onboarding session or tips during your 45 days of free use. They are sent through Resend. Who gets them depends on how you joined BlockHub52:
To decide which help and updates emails to send, and what each email says, we use:
This does not have any legal or similarly significant effect on you. It only changes which emails you receive.
Some emails ask "Is the acquisition still going ahead?". If a director answers, we record the answer, which director gave it and when. The answer shows in the building's Audit Log.
If you sign up, we store your name and email address with Sender.net. These emails record whether they are opened and which links are clicked. Lawful basis: consent. You can unsubscribe at any time using the link in every email. Unsubscribing from the newsletter stops the newsletter only. To stop help and updates emails as well, use the link in a help and updates email, or email privacy@blockhub52.co.uk.
If you ask for the free 'RTM Handover Pack' on our website, we use your first name and email address to email you the pack through Resend. If you do not tick the box, we do not keep your details in our own systems. Resend keeps a copy of the email for 30 days, then deletes the copy. Lawful basis: legitimate interests (sending you the pack you asked for).
If you tick the box that says “Yes, email me practical tips, updates and occasional news from BlockHub52. Unsubscribe any time.”, we:
Lawful basis: consent. You can unsubscribe at any time, using the link in every newsletter, or by replying to the email that sends you the pack.
Our free tools, such as the service charge demand checker and the 18 month calculator, work in your browser. Text you paste into the demand checker stays in your browser. We never receive the text or keep the text.
If you ask us to email you the result of the demand checker, we use your email address to send the result through Resend. We do not save the result in our own systems. Resend keeps a copy of each email it sends for 30 days, then deletes the copy. To stop misuse, our server also holds your email address and IP address in its memory for a short time, to limit how many results are sent. We do not write your email address or IP address to our database for this. Lawful basis: legitimate interests (sending you the result you asked for, and stopping misuse of the tool).
If you also tick the newsletter box, we add your email address to our newsletter with Sender.net, and we keep a record that you asked for the newsletter: your email address, the date and time, the page you were on, your IP address and your browser type. Lawful basis: consent. You can unsubscribe at any time, using the link in every newsletter.
If you book a call, Calendly collects your name, email address, chosen time and any answers you give. Lawful basis: legitimate interests (helping your company set up BlockHub52).
If you apply for one of the twelve places, we keep your application: your company's name and Companies House number, the month in which the building's service charge year ends, and which account or sign-up made the application. Lawful basis: legitimate interests (running the offer). If your company takes a place, we keep written notes of the monthly feedback calls with the place in BlockHub52, so that we can improve BlockHub52 and keep a record that the conditions of the place were met. Lawful basis: legitimate interests (improving BlockHub52 and running the offer). We do not record the calls. If the directors give us a review, we use a director's name with the review only if that director agrees. Lawful basis for using a director's name: consent. The director can withdraw consent at any time, and we will then stop using the director's name with the review in new material.
If you use the live chat, Crisp stores the conversation and any details you give. Emails you send us are held in our Namecheap business mailboxes. Lawful basis: legitimate interests (answering your questions).
We use Plausible Analytics to count visits to blockhub52.co.uk and to our application at blockhub52.ai. Plausible Analytics shows us how many people visit, which pages they look at and how they found us, so that we can improve the website and the application. Plausible Analytics does not use cookies and does not tell us who you are.
When a page loads, a small piece of code from Plausible Analytics runs in your browser. The code sends Plausible Analytics:
Your browser also sends your IP address and browser details with every page request. Plausible Analytics uses the IP address and browser details to work out:
Plausible Analytics does not store your IP address or your full browser details. We only see totals, such as the number of visitors to a page. We do not use Plausible Analytics for advertising, and we do not use Plausible Analytics to build a profile of you.
Who handles the data: Plausible Insights OÜ, a company registered in Estonia. Plausible Analytics acts as our processor under its data processing agreement, and holds the data on servers in the European Union.
Lawful basis: legitimate interests (understanding how our website and application are used, so that we can improve them).
Your choice: you can turn off visit counting at any time, free of charge.
Turning off visit counting stores a small note in your browser that tells the Plausible Analytics code not to count your visits. The note only applies to the browser and the website where you turned visit counting off, so you need to turn it off on each website and each browser you use. The note stays until you turn visit counting back on or clear your browser's stored data. If your browser or an ad blocker stops the Plausible Analytics code, your visits are not counted.
We do not sell personal data. We only share it with service providers we need to run BlockHub52. These providers may only use it on our instructions, except Stripe, which also uses some payment data for Stripe's own purposes, such as preventing fraud and meeting Stripe's legal duties, under Stripe's own privacy policy.
| Provider | What they do | Where data is held |
|---|---|---|
| Supabase | Application database, sign-in and file storage | London, UK |
| Vercel | Application hosting | London, UK (company based in the USA) |
| Stripe | Payments | Ireland and USA |
| Resend | Service emails, help and updates emails, the 'RTM Handover Pack' email, and free tool results | Ireland (company based in the USA) |
| Sender.net | Newsletter and free resource emails | Lithuania |
| Crisp | Live chat | France |
| Calendly | Booking onboarding calls | USA |
| Namecheap | Business email accounts and domain names | USA |
| Xero | Invoicing and accounts | New Zealand, Australia and USA |
| DigitalOcean | Website hosting | London, UK (company based in the USA) |
| Plausible Analytics | Counting visits to our website and application, without cookies | European Union (company based in Estonia) |
| Mailgun | Website system emails | EU (company based in the USA) |
| Dropbox | Business documents and website backups | USA |
AI assistants. We use AI assistants (Anthropic's Claude, and OpenAI's ChatGPT and Codex) to help build and maintain the software. We never put your personal data, or the personal data we hold for your RTM or RMC company, into these AI assistants. Where our work with the AI assistants needs examples of people's details, we use made-up test data. So Anthropic and OpenAI do not receive your personal data from us, and they are not in the list above.
We look up public company information from Companies House. We may also share information where the law requires it.
Some providers are based in, or store data in, countries outside the UK and the European Economic Area (EEA). When data is transferred, we rely on one of these safeguards:
You can ask for more details at privacy@blockhub52.co.uk.
| What | How long we keep the data |
|---|---|
| Your sign-in details (name, email address, phone number, role) | While your account is open. Your sign-in details are deleted when the account is deleted, or when every building you are a director of is deleted. If a director's sign-in is deleted, the director's name stays on records the RTM or RMC company keeps in BlockHub52, such as reviews of the year end accounts, signed minutes (with the name of the chair who signed the minutes) and budget approvals. Those records belong to the company and are deleted with the building's records. |
| Sign-in records (time, device and browser type, IP address) | 12 months, then deleted. |
| Building, flat, leaseholder and landlord details, service charge demands, and the Handover Tracker with its letters and files (we hold these for your RTM or RMC company) | While your company uses BlockHub52, including on Free. Deleted: 15 months after the last director sign-in on a Free account (read-only for the last 3 months); 30 days after the directors confirm a deletion; or 90 days after Companies House shows the company as dissolved. We email the directors before each deletion. |
| Documents, compliance records, leases, bank and accounting records, payments, budgets, meetings, Section 20 records, Section 20B records, the records of how and when each demand was sent, stored copies of sent demands and proof of posting (we hold these for your RTM or RMC company) | While your company subscribes, during the 45 days of free use, and during the free 12 months of a first twelve place. When any of these ends without a subscription, these records are read-only for 90 days and are then deleted. We email the directors at least 14 days before. |
| Accounts whose 45 days of free use have not started (for example, an RTM company that has not entered its acquisition date) | We review the account 12 months after sign-up, and email at least 14 days before deleting it. |
| Sign-ups that were not finished (for example, a Handover Tracker sign-up where the building was never set up, or a sign-in link that was never opened) | Deleted 12 months after sign-up, with the sign-in, if no building was set up. |
| Record of changes (Audit Log) | Kept with the building's records, and deleted with them. After 12 months we remove the IP address and browser details from each entry, but keep who made each change and when. If a person's sign-in is deleted, we keep the change and when it was made, but the Audit Log no longer shows who made it. |
| Invoices and payments | 7 years from the end of the financial year in which the payment was recorded, as Estonian accounting law requires. If your company never paid us, we delete your record with Stripe when your account is deleted. |
| Record that you agreed to our 'Terms of Service' (and, for the Handover Tracker, the company you named) | 6 years after your account is closed or deleted, because a claim about the contract can be made for 6 years. The IP address and browser details are removed after 12 months. |
| Record of a deleted account | The date, the company's name and Companies House number, the reason, and how many records were deleted, for 6 years. The record holds no names or contact details of people. |
| First twelve applications | While the application is considered. An application we decline, an application you withdraw, and applications still waiting when all twelve places are taken: deleted as soon as we have sent the email that tells you. A place given: until 6 years after the free 12 months end, then deleted. |
| Feedback call notes and reviews (first twelve buildings) | Call notes: kept with the place in BlockHub52 until 6 years after the free 12 months end, then deleted. A director's name with a review: while we use the review, and until the director withdraws consent. |
| Record of a director's agreement to be named with a review | While we use the review, and for 6 years after we stop using the review, so we can show we had permission. |
| Help and updates emails | we send them until you unsubscribe or your account is deleted. If you unsubscribe, we keep your email address on a do-not-contact list so that we do not send you help and updates emails again. We keep the record of your choice (the answer, the form and the time, and for the Handover Tracker sign-up the wording version, IP address and browser) for 6 years after the last help and updates email we sent to you, so we can show that we had your permission or respected your refusal. |
| Newsletter and free resource sign-ups | While you stay subscribed, and for 6 years after the last newsletter we send you, so we can show that we had your permission. |
| The 'RTM Handover Pack' from our website | If you did not tick the box, we keep nothing in our own systems, and Resend deletes its copy of the email after 30 days. If you ticked the box, we keep the record that you asked while you stay subscribed to the newsletter, and for 6 years after the last newsletter we send you, so we can show that we had your permission. |
| Free resource downloads (other than the 'RTM Handover Pack') | if you did not ask for our newsletter, we keep your name, email address and download record for 12 months after your download, then delete them. If you asked for our newsletter, we keep them until you unsubscribe. |
| Free tools (the Demand Checker) | We do not keep the results of our free tools. If you asked for our newsletter on a free tool, we keep the record that you asked (your email address, the date and time, the page, your IP address and your browser type) while you stay subscribed, and for 6 years after the last newsletter we send you, so we can show that we had your permission. |
| Do-not-contact lists (emails) | For as long as we send emails. The list holds only the email address and the reason, because its only purpose is to make sure we do not contact you again. |
| Business email | 6 years for customer and contract email, 2 years otherwise. |
| Data protection requests and complaints | 2 years after the request or complaint is closed. |
| Live chat conversations | 12 months. |
| Onboarding call bookings that don't go ahead | 12 months. |
| Emails sent by the application | Our email provider, Resend, keeps a copy of each email for 30 days after sending, then deletes the copy. |
| Backups | Overwritten on a rolling basis within 7 days, so deleted data leaves our backups within 7 days. |
You have the right to:
We do not make automated decisions that have a legal or similarly significant effect on you.
To use any of these rights, email privacy@blockhub52.co.uk, or contact our UK representative, Prighter, through its portal. We will reply within one month.
If you think we have not handled your personal data properly, you have the right to complain to us. To complain, email privacy@blockhub52.co.uk, write to us at our registered address in section 1, or contact our UK representative, Prighter, through its portal. We will:
You also have the right to complain to a data protection authority. You do not have to complain to us first.
Cookies are small files that a website stores in your browser. A website can also store information in your browser in other ways, such as "local storage", or run code that reads information from your browser. The law treats these technologies in the same way as cookies.
We only use these:
We do not use advertising cookies or tracking cookies, and we do not use any technology to follow you across other websites.
If a personal data breach affects personal data we are responsible for ourselves and is likely to put your rights at risk, we will tell the ICO within 72 hours and let the people affected know without undue delay. If a breach affects data we hold for your RTM or RMC company, we tell the company within 48 hours, and the company decides whether to tell the ICO and the people affected (see our 'Data Processing Agreement').
BlockHub52 is a professional tool for adults. We do not knowingly collect data from anyone under 18. If you think a child's data has been added, contact privacy@blockhub52.co.uk and we will delete it.
We may update this policy from time to time. The date at the top always shows the latest version. We will email active users about important changes.
The BlockHub52 Newsletter
I write about the things that are important to directors of self-managing blocks in England and Wales. Service charges, Section 20, reserve funds, the compliance calendar.
The newsletter is in plain English with no jargon. It is written to help directors without accounting or legal expertise manoeuvre around the legal and financial side of running a building, and it always points at the legislation behind it so you can check for yourself.
We use essential cookies to keep the site working. No tracking or advertising cookies. Privacy Policy