Data privacy notice

Last updated: 9 October 2026.

This notice explains how the Customer handles personal information about you: what is held, why, who can see it, how long it is kept, and what you can ask for.

It covers tenants and guests, the people living with them, staff and contractors, and visitors recorded at the gate.

the Customer decides what is collected and why, and is therefore the controller of it — under the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, and the other privacy law that applies where the Customer and you are. The software is operated on its behalf by Web and Cloud Innovation Ltd, of 30/1 Kenilworth Court, Sir Augustus Bartolo Street, Ta' Xbiex XBX 1093, Malta, which acts only on the Customer's instructions and is its processor — its "service provider", in the words of the United States state laws.

1What Is Collected

If you are a tenant or a guest — your name and contact details; your unit and the dates of your tenancy; who lives with you, where you told us; your identification document and the details printed on it; your billing details and payment history; the charges raised against your unit; documents you upload; photographs of the unit and of anything reported as damaged or broken; your vehicle and its plate, where you gave it; and, when you use the portal, the time, device and network address of your sign-ins.

If you work here — everything the employment requires: your contract and its terms, your pay, the tax and social-security identifiers your pay needs, your attendance and shifts, your reviews, any disciplinary matter, the papers you have signed, and your emergency contact.

If you sign a document — the signature you drew, the name you typed, the time, the device, the network address, and, only where your browser asked you and you allowed it, one reading of your location. The electronic signature consent explains this in full.

If you come through the gate — the fact and time of your visit, who you came to see, and your vehicle where there is one.

Most of it comes from you. Some comes from the people who act for you — a co-tenant, an agent, a guarantor, an employer who refers you — and from the records of the property itself.

2Why It Is Collected

To prepare and perform your lease or your employment; to bill you, to receive payment, and to keep accounts; to run the property day to day — cleaning, maintenance, deliveries, access; to reach you about your tenancy or your work; to keep the building and the people in it safe; and to meet obligations under tax, employment, tenancy and data protection law.

Nothing is collected that is not needed for one of those purposes. If you do not give what a contract or the law requires — your identity for a lease, your tax details for your pay — the Customer may be unable to enter into or perform that contract with you.

3The Lawful Basis

Depending on what is being processed, the basis is: the performance of a contract with you, or steps you asked for before one (your lease, your employment); compliance with a legal obligation (tax, employment and reporting rules); the legitimate interests of the Customer in running and protecting the property and the people in it, balanced against your interests; and, for the things the law does not permit without asking — a precise location reading, a document sent for automated reading where you object to it — your consent, which you may withdraw at any time without affecting what was done before.

National identification and social-security numbers are processed only where a law provides for it — tax, employment and similar reporting rules — or with your consent, and under any national rule that sets conditions for them. Legitimate interests are never the basis for them. No information about your health, beliefs or other special categories is asked for.

Where consent is the basis, refusing it never affects your tenancy or your employment, and you will be told what the alternative is.

4Who Sees It

The people who run the property, and only as far as their work needs. Access is by named account, capabilities are granted by role, and every time a document is opened it is written into an audit log.

The processor named above, which operates the software, under the contract described in its Data Processing Agreement.

The outside services listed in the Sub-processor list: the company hosting the server, the offsite backup folder, the service that reads an uploaded document to copy its printed details, and your mail provider when a message is sent to you.

Government agencies, regulators and courts where the law requires disclosure, and professional advisers under a duty of confidence.

Nobody else. Your information is never sold, never shared for cross-context behavioural or targeted advertising, and never used to infer characteristics about you.

5Where It Is Kept, And How It Is Protected

On a server operated for the Customer, in a database that belongs to this business alone.

Uploaded identification documents, receipts and signed papers are encrypted at rest with a key held apart from the offsite backups. Traffic is encrypted in transit. Accounts can carry an authenticator-app second factor, and administrators can be required to. The security page describes all of it in detail.

Backups are taken nightly and a copy is kept offsite under restricted access.

The software is operated by Web and Cloud Innovation Ltd from Malta, and the servers that hold these records are in Germany, both in the European Economic Area. The United Kingdom and Switzerland recognise the European Economic Area as giving adequate protection. Where the Customer switches on the automated reading of uploaded documents described below, a document is sent for that one reading to the provider named in the Sub-processor list, which may process it outside the European Economic Area. Any transfer to a country without adequate protection is made under the European Commission's Standard Contractual Clauses, with the United Kingdom's Addendum and the Swiss adaptations where those apply. You may ask for a copy of the safeguards.

6How Long It Is Kept

For the life of the tenancy or the employment, and afterwards only for as long as tax, accounting, employment and limitation rules require — then it is deleted.

An identification document is kept for as long as the tenancy or employment it supports, unless the law requires longer.

Sign-in and audit records are kept for as long as they are useful for security and for answering a question about who did what.

7Automated Reading Of Documents

An uploaded document may be read once by an automated service, solely to copy its printed details into your record so that nobody has to type them.

It is not used to train any model, no decision about you is made by that reading, and a person can always check and correct what it produced. It can be switched off, and the details typed by hand instead.

There is no decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect concerning you.

8Your Rights

You may ask to see the information held about you, and to be given a copy.

You may ask for it to be corrected if it is wrong, or completed if it is missing something.

You may ask for it to be deleted, or for its use to be restricted, where the law allows — bearing in mind that some records must be kept for a fixed period whatever anybody would prefer.

You may object to processing that rests on legitimate interests, and withdraw a consent you gave.

You may ask for the information you provided to be given to you, or to somebody else, in a portable form.

If you live in a United States state with a consumer privacy law — California, for example — and that law applies to the Customer, you also have the rights it gives: to know what is collected, used and disclosed about you, to delete it, to correct it, to opt out of its sale or sharing and to limit the use of sensitive personal information (neither of which the Customer does), and not to be treated differently for using any of these rights. You may use an authorised agent, and the Customer may need to confirm who you are before it answers.

You may complain — to the Customer first, if you wish, and then to a data protection authority: the supervisory authority of the European Union country where you live or work or where the matter arose; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner; elsewhere, the privacy regulator or attorney general where you live.

Asking costs nothing. An answer is due without undue delay, and within the period the law sets: under the GDPR and the UK GDPR that is one month, which may be extended where a request is complex, in which case you will be told; under the California law it is forty-five (45) days.

9Cookies And What Your Browser Stores

One cookie is set when you sign in. It holds a session identifier and nothing else, it cannot be read by scripts, it is not sent to another site, and it is deleted when you sign out or when the session expires. It is strictly necessary for the service you asked for, which is why you are not asked to consent to it.

There is no advertising cookie, no analytics cookie and no third-party tracker anywhere in this system.

The typefaces the pages use are served by this system itself. No font service, and no other outside company, is told that you opened a page.

If you install the pages as an app on your phone, your browser keeps a copy of the interface itself so that it opens without a network. That copy holds no personal information.

10If Something Goes Wrong

If personal information is lost or disclosed in a way that is likely to put you at high risk, you will be told without undue delay, with what happened and what you can do. The supervisory authority is told within seventy-two (72) hours of the breach becoming known where the GDPR or the UK GDPR requires it, and within the period any other applicable law sets.

11Who To Ask

Requests, questions and complaints about this notice go to the person the Customer has made responsible for data protection — its Data Protection Officer, where it has appointed one — at: privacy@premises.ph

For anything concerning the software rather than the business that uses it: Web and Cloud Innovation Ltd, 30/1 Kenilworth Court, Sir Augustus Bartolo Street, Ta' Xbiex XBX 1093, Malta, legal@premises.ph