Privacy policy

The data controller is Gateway Estate Maintenance Ltd, 693 Green Lane, Dagenham RM8 1UU, United Kingdom, trading as The Property Operators by GEM. For any privacy matter, contact us at hello@tpo.estate or by post to the address above, marked “Data protection”.

• Enquiry and review data: name, email address, phone number, portfolio size, property postcodes and what you tell us when you request a package or book a property review, with the time of submission and a hashed record of the submitting network address, used for rate limiting and abuse prevention.
• Subscription and account data: the properties you subscribe, their plans and billing cadence, agreed portfolio pricing, billing details, renewal and cancellation history, and your correspondence with the operations desk.
• Portal account data: the email address you sign in with, a hashed password or your sign-in provider identifier, the role you hold, and a log of privileged actions taken in the account.
• Property records: condition reports, compliance certificates and their renewal dates, job history, quotations, invoices and the photographs filed against each visit.
• Tenant data: where a landlord subscribes a tenanted property, the contact details needed to arrange access, and, on plans that offer it, the issues a tenant reports directly and the correspondence that follows.
• Payment data: invoices, payment status and the reference returned by our payment providers. Card details are entered on the provider’s systems; we never see or store a full card number.
• Website data: limited technical data and, with your consent, analytics as described in our cookie policy.

• Contract: to quote for and operate your subscription, to give you portal access, to coordinate attendances, to report back and to take payment.
• Legal obligation: to keep accounting records, to hold safety certificates and compliance documentation, and to meet health and safety duties.
• Legitimate interests: to run and secure the portal and this website, to prevent abuse, to keep records for guarantee and dispute purposes, and to contact business customers about services relevant to their portfolios. We balance these against your rights.
• Consent: for optional analytics cookies and, where required, for marketing to individuals. You can withdraw consent at any time.

Your landlord or their agent gives us your contact details so we can arrange access and keep you informed about appointments. Where your landlord’s plan lets you report issues directly, we hold what you report and the correspondence about it, and we share the issue and its outcome with the landlord or agent, because they are the person responsible for the property. We do not use tenant details for marketing, and we do not report on you to your landlord beyond what is needed to resolve the matter and to record access.

We share personal data only where it is needed to deliver the service: with the Gateway Estate Maintenance operatives and vetted partners attending the property; with payment processors handling your transactions; with the IT, hosting and communication providers that process data under contract for us; and with professional advisers, insurers or authorities where the law requires it. We do not sell personal data. Where a provider processes data outside the UK, we rely on an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement.

• Enquiries that do not become subscriptions: up to 24 months from the last contact.
• Subscription, property, job and billing records: 6 years after the subscription ends, reflecting tax and limitation periods.
• Portal accounts: closed when the subscription ends; the audit log of privileged actions is retained with the account record.
• Safety certificates and compliance records: the statutory retention period for each certificate type.
• Website analytics: the periods stated in the cookie policy.

When data is no longer needed it is deleted or irreversibly anonymised.

Personal data is held on access-controlled systems with role-based permissions, encrypted transport, audit logging of privileged actions and documented incident procedures. Portal accounts see only their own properties, and staff access is limited to what a role requires.

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no continuing basis to hold it;
• restrict or object to processing, including any direct marketing;
• data portability for data you provided under contract or consent;
• withdraw consent where processing relies on it.

To exercise any right, contact hello@tpo.estate. We respond within one month, and may need to verify your identity first.

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, via ico.org.uk or 0303 123 1113.

We review this policy at least annually and update it when our processing changes. Material changes are highlighted here with a new effective date.