Your Data is safe.

Cambridge Labs Limited (trading as Alor) ("we," "us," "our") respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, store, and share your information, as well as your rights under the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Cambridge Labs Limited (trading as Alor) provides a property management platform to landlords, tenants, and property managers. We process personal data to facilitate tenancy management, rent tracking, financial reporting, and related services.

Company Registration Number (CRN): 15528445
Registered Address: 30 High Street, Colliers Wood, SW19 2AB

For any questions about this notice, you can contact our Data Protection Officer (DPO):
Name: Tohid Ismail
Email: privacy@alorproperty.com

What Data We Collect

We may collect the following categories of personal data:

• Tenant Data: Name, contact details, property address, payment information, tenancy agreement details, maintenance requests, and communication records.

• Landlord Data: Name, contact details, bank account details, property ownership information, and financial reporting data.

• Supplier and Contractor Data: Name, contact details, payment details, and contractual information.

• Platform User Data: Login credentials, access logs, and system activity records.

  
  

We do not collect special category data (e.g., health, race, or religion) unless explicitly required and with your consent.

How We Use Your Data

We process personal data only for the following purposes:

• Managing tenancy agreements, rent collection, and property maintenance.

• Providing financial tracking, reporting, and compliance services to landlords.

• Facilitating communication between landlords, tenants, and contractors.

• Meeting legal and regulatory requirements, such as tax reporting or dispute resolution.

• Improving our platform’s functionality and user experience (using aggregated and anonymised data).

  
  

We will not use your personal data for marketing purposes without your explicit consent.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: To perform the services outlined in tenancy agreements and property management contracts.

• Legitimate Interests: To manage and improve our platform, ensure security, and provide support services.

• Consent: For any processing activities not covered by contractual or legal obligations, such as optional marketing communications.

• Legal Obligations: To comply with tax, financial, or regulatory requirements.

How We Share Your Data

We only share your data with trusted third parties for the purposes outlined above. These include:

• Open Banking API Providers: To access financial data for rent tracking and expense monitoring.

• Payment Processors: To facilitate secure rent transactions.

• Contractors and Suppliers: To handle property maintenance requests.

• Regulatory Authorities: To comply with legal or regulatory requirements.

All third parties are bound by data processing agreements and required to comply with GDPR.

How Long We Retain Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations. Retention periods are as follows:

• Tenant and landlord data: Retained for the duration of the tenancy plus six years for tax and legal purposes.

• Supplier data: Retained for the duration of the contract plus six years.

• System logs: Retained for up to one year for security auditing.

Data is securely deleted at the end of its retention period.

Your Rights

You have the following rights under GDPR:

• Access: Request a copy of the personal data we hold about you.

• Rectification: Correct inaccurate or incomplete data.

• Erasure: Request deletion of your data when it is no longer necessary for the purposes collected.

• Restriction: Limit how we process your data under certain circumstances.

• Portability: Receive your data in a structured, commonly used, machine-readable format.

• Objection: Object to data processing based on legitimate interests or direct marketing.

• Withdraw Consent: If processing is based on consent, you can withdraw this at any time.

To exercise your rights, contact our DPO at privacy@alorproperty.com. We will respond within one month of receiving your request.

How We Protect Your Data

We implement robust technical and organisational measures to secure your personal data, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2 or higher).

• Role-based access controls and multi-factor authentication.

• Regular vulnerability scans, penetration testing, and security audits.

• Secure backup systems tested quarterly for reliability.

Data Breaches

In the event of a data breach, we will:

1. Notify the Information Commissioner’s Office (ICO) within 72 hours if the breach poses a risk to your rights.

2. Inform affected individuals promptly with details of the breach and steps to mitigate risks.

3. Take immediate containment and remediation measures to prevent recurrence.

How to Make a Complaint

If you have concerns about our processing of your personal data, you can contact our DPO at privacy@alorproperty.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk
Phone: 0303 123 1113

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on our platform, and significant changes will be communicated directly.

Last Updated: 25 November 2024