GDPR Compliance

Registered Address:

Company Registration Number (England & Wales):
16833102

AgentToolkit.co.uk complies with the UK General Data Protection Regulation (UK GDPR).

Data Controller

The data controller is Gábor Tarnai. The servers are operated on Contabo VPS, and all services run under the domain agenttoolkit.co.uk.

Data Protection Officer:[[TO BE CONFIRMED BY CLIENT: has a Data Protection Officer been appointed, and if so, what are their contact details?]] If no DPO has been appointed, this section should say so instead of leaving the question open.

Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction or deletion
• Restrict or object to processing
• Withdraw consent at any time
• Object to processing based on legitimate interests
• Request that your data be provided to you, or to another organisation, in a portable format
• File a complaint with the supervisory authority - theInformation Commissioner's Office (ICO)

To exercise any of these rights, contact us using the details in the "Contact" section below.

Collected Data, Purpose and Legal Basis

We collect and store the following data when you use our services. For each category we set out the purpose we use it for and the legal basis we rely on under UK GDPR Article 6.The legal basis stated for each category below is a draft characterisation for legal review, not a confirmed legal position.

• Full name, email address, phone number, service address (including whether the property is furnished and the number of rooms) - used to provide the booking, inspection, and reporting services you request. Draft legal basis: performance of a contract with you (Art. 6(1)(b)), or taking steps at your request prior to entering a contract.
• Billing details and invoices in PDF format stored on our server - used to charge for and account for services rendered. Draft legal basis: performance of a contract (Art. 6(1)(b)) and compliance with our accounting/tax obligations (Art. 6(1)(c)).
• Encrypted password, if you register an account - used to secure your account. Draft legal basis: performance of a contract (Art. 6(1)(b)).
• Property photographs, floor plans, and video uploaded as part of inspection, inventory, or maintenance reports - used to produce the report you or your landlord/agent requested. Draft legal basis: performance of a contract (Art. 6(1)(b)). See "Data Retention" below - the retention period for this category is different from contact/account data and, as of this draft, is not yet enforced automatically.
• Electronic signature data (signature image, timestamp, and technical identifiers) collected when you sign a report or confirm maintenance work - see theElectronic Signature Agreement for what is collected and why.

Data processors: we use the following organisations to help us provide the service, each only with the personal data they need to perform their function:

• Stripe - processes payment transactions on our behalf (see "Payment" below).
• Contabo - our hosting provider; our servers run on Contabo VPS infrastructure.
• [[TO BE CONFIRMED BY CLIENT: any other data processor used - e.g. transactional email delivery provider, SMS provider, analytics provider - together with whether any of them store or process data outside the UK/EEA and, if so, what safeguards apply]]

Cookies and Tracking

When you first visit the site, a cookie notice asks you to acknowledge that we use essential cookies. Today, that notice offers an "I understand" acknowledgement and does not yet offer a separate way to allow or refuse non-essential cookies - see the note at the end of this section.

We use, or may use, cookies and similar local storage for:

• Strictly necessary (no separate consent required): keeping you logged in during your session, remembering login sessions (via localStorage), and supporting the Stripe payment flow while you are making a payment.
• Non-essential, subject to consent under the PECR rules:[[TO BE CONFIRMED BY CLIENT: is Google Search Console / any analytics script actually deployed on the live site? As of this draft, no analytics script (Google Analytics/Tag Manager or similar) was found in the frontend source code, so this cannot be confirmed from the code alone]], and any future social media integration (for example, a Facebook plugin), if and when one is added.

Known gap, flagged for legal/product review: UK cookie rules (PECR) require that consent for non-essential cookies be freely given by an unambiguous positive action, and that it be as easy to refuse as to accept. The cookie notice on this site currently only presents an accept action. Until a "reject"/"manage preferences" option is added to the cookie notice itself, no non-essential cookie listed above should actually be set without a separate, specific consent step. This document does not claim the current cookie notice satisfies PECR - that determination is for legal review.

Payment

Payments are processed via Stripe. Neither AgentToolkit.co.uk nor Stripe stores your payment details.

Stripe may process data outside the United Kingdom.[[TO BE CONFIRMED BY CLIENT: what international transfer safeguard Stripe relies on for UK customer data (e.g. UK International Data Transfer Agreement / adequacy) - this should be confirmed against Stripe's current data processing agreement]]

SSL

All traffic is encrypted using HTTPS with certificates provided by Let's Encrypt.

Contact Forms

Messages submitted through contact forms are forwarded to our email server. The server is maintained by AgentToolkit (Gábor Tarnai) and hosted on Contabo VPS. These messages are not stored in any database.

Data Retention

Retention periods differ depending on what the data is and why we hold it. The two categories below are different from each other and should not be read as the same commitment.

Contact and account data (for example, the data listed under "Collected Data" such as your name, email, phone number, service address, and billing details): if allowed by applicable UK law, we retain this data for a minimum of one year for statistical and reporting purposes.[[TO BE CONFIRMED BY CLIENT: the exact retention period and the point at which the one-year period starts]]

Photographs and documents uploaded as part of a report (inspection, inventory, or maintenance reports): a policy of retaining these for one year from completion and then deleting them is planned, but as of this drafthas not yet been built into the system - deleting a report photo today marks it as removed in our records but does not yet trigger automatic permanent deletion or physical file removal. Until that automated process is in place, this document describes the current state (manual/soft deletion only, no automatic expiry) rather than promising a retention period we do not yet enforce. This section must be updated once the automated retention process is delivered and confirmed to be running.

Contact

For any GDPR-related inquiries, contactinfo@agenttoolkit.co.uk or call us at 01916401200.