Privacy policy

Sanderson x Holdings Ltd, trading as Arxela Property Management (“Arxela”, “we”, “us” and “our”), is registered in England and Wales under company number 16576471. Our registered office is 2 Worthington View, Hartford, Northwich, England, CW8 2HF. We are registered with the Information Commissioner’s Office under number ZB617526. Contact us at hello@arxela.co.uk.

Arxela is the controller when we decide why and how to process website, account, identity, service administration, security, support, waiting-list and business-contact data.

A landlord or property organisation is normally the controller for property-management records it enters about tenants, guarantors, owners, contractors, occupants and properties. For those records, Arxela normally acts as its processor and follows its documented instructions. The controller must provide its own privacy information to the people whose data it puts into Arxela.

Landlords can use our Landlord Privacy Notice Template as a starting point, but must adapt and review it for their own data use.

This policy covers website visitors, account applicants and users, landlords, property owners, tenants, guarantors, contractors, waiting-list members, people who contact us, and other people whose information we process for our own purposes.

If you are a tenant, guarantor, occupant or contractor and your data was supplied by a landlord, that landlord’s privacy notice also applies. We will help route a rights request to the relevant controller where necessary.

• Identity and account data: name, company name and number where supplied, role, email, phone number, correspondence address, account status, verification and invitation records.
• Security and technical data: IP address, browser and device information, session identifiers, login and rate-limit events, timestamps, request and error logs, audit events and reCAPTCHA results.
• Property and tenancy data: addresses, ownership and landlord links, buildings, units, rooms, assets, tenancy parties, dates, rent, deposit and agreement records.
• Compliance and document data: certificates, evidence, issue and expiry dates, notices, drafts, frozen versions, downloads and document history.
• Maintenance and communication data: reports, descriptions, photographs and files, messages, self-help responses, hazard information, appointments, contractor tenders and quotes, completion evidence, invoices, payment records and reviews.
• Support and preference data: enquiries, feedback, accessibility needs you choose to disclose, communication preferences and records of our response.
• Waiting-list data: normalised email address, consent version, source and timestamps.

We do not need you to include sensitive personal data in ordinary support messages. Do not send passwords, bank credentials or emergency information by email.

We receive data directly from you when you visit, register, sign in, join a waiting list, contact us or use the service. We also receive data from an inviting landlord or organisation, authorised portal users, guarantors, contractors and other people participating in a tenancy or maintenance workflow.

Technical and security data is generated by the service and our providers. We may receive updated delivery, storage or security status from those providers. Future third-party integrations will be added to this policy before they process live customer data.

• Provide and administer Arxela: create and verify accounts, authenticate users, display authorised records, deliver portals and messages, store documents and provide support. Our bases are performance of a contract and our legitimate interests in operating the service.
• Protect the service and its users: prevent bots, fraud, abuse and unauthorised access; enforce rate limits; investigate incidents; preserve audit evidence; and maintain reliability. Our bases are legitimate interests, recognised legitimate interests where applicable, and legal obligation.
• Meet legal and regulatory duties: respond to rights requests, complaints, court orders and lawful authority requests, and maintain required records. Our basis is legal obligation.
• Improve the product: diagnose errors, understand aggregate feature performance and develop the service using data minimisation. Our basis is legitimate interests. We do not currently use advertising or non-essential analytics cookies.
• Send service communications: verification, password reset, invitations, workflow alerts, security messages and support replies. These are necessary for the contract or our legitimate interests and are not promotional marketing.
• Full-management waiting list: record your interest and email you about that service. Our basis is consent. You may withdraw consent at any time without affecting earlier lawful processing.
• Establish or defend legal claims: preserve relevant records and deal with disputes. Our basis is legitimate interests and, where applicable, legal claims conditions under data-protection law.

Where Arxela acts only as a processor, the relevant landlord or organisation decides the lawful basis. We process that data to provide the contracted service and under its instructions.

Arxela’s launch maintenance flow is not designed to collect health, disability, pregnancy or other special-category information. Users must describe the property problem and action needed without entering diagnoses, medical details or related documents.

Do not enter criminal-offence data unless it is necessary, lawful and subject to the additional safeguards required by the Data Protection Act 2018. Arxela does not use special-category or criminal-offence data for advertising.

We do not use customer property, tenancy, document, message or maintenance data to train foundation models.

Where an AI-assisted feature is available, it may organise, summarise or draft information for an authorised user. AI output is not the legal, financial, compliance or signing source of truth and must be reviewed by a person. Arxela does not currently make solely automated decisions about people that produce legal or similarly significant effects.

Before introducing a materially different AI use or provider, we will assess the data-protection risk, update this policy and our processor terms where required, and put appropriate human oversight and contractual safeguards in place.

We share only what is needed with authorised users and service providers:

• Landlords and authorised organisations: the controller and users it authorises.
• Tenants and guarantors: records and documents made available to their scoped portal account.
• Contractors: job details, access information, messages and files required for a tender, appointment or instructed repair, using scoped access controls.
• Professional advisers and insurers: where reasonably necessary for advice, claims or disputes and subject to confidentiality.
• Public authorities and courts: where disclosure is required or permitted by law.
• A buyer or successor: if our business or assets are reorganised, financed or sold, subject to confidentiality and data-protection requirements.

We do not sell personal data.

• Vercel: application hosting, content delivery, deployment and operational/security logs.
• Supabase: the documented production PostgreSQL database and private object storage for documents, compliance evidence and maintenance files, configured for the London region. Current account evidence must be completed before public signup.
• Neon: a restricted frozen pre-cutover database copy retained only while its documented migration-evidence or legal-hold purpose remains; it is not used for current application writes.
• Resend: transactional email delivery, including account verification, password resets, invitations and workflow messages.
• Google reCAPTCHA: bot, fraud and abuse prevention during public signup. It receives a reCAPTCHA token and may receive your IP address and device/browser information when the widget runs.

These providers process data under their contracts and data-protection terms. Our public Subprocessor Register records their purposes, locations and change process and is updated before a new provider processes customer service data.

Tools considered for future use—including AI, e-signing, banking, SMS, deposit and contractor-directory providers—are not treated as current subprocessors unless and until they are activated with live personal data.

Our primary database is configured in the United Kingdom, but some providers, support teams or group companies may process data outside the UK. Where a restricted transfer occurs, we use an available UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and any necessary supplementary measures.

You may ask for more information about the safeguards relevant to your data by emailing hello@arxela.co.uk.

We keep personal data only for as long as needed for the purpose for which it was collected, taking account of account status, contractual and legal requirements, security, dispute and claims periods, controller instructions, backup cycles and the sensitivity of the data.

• Account and operational records are kept while the account is active and then for the period needed to close, return or delete the service data and resolve legal or security issues.
• Operational records moved to the in-product Bin are normally restorable for 30 days before the scheduled purge, subject to a lawful hold or exemption.
• Authentication tokens expire according to their security purpose. The Arxela sign-in session cookie expires after seven days; short-lived verification and reset tokens expire separately.
• Security, audit and request logs are kept for a proportionate period based on risk, investigation and legal-claims needs.
• Waiting-list data is kept until you withdraw consent, the relevant launch communication is complete, or it is no longer needed. We may retain a minimal suppression record so we respect an opt-out.
• A reCAPTCHA response token is used for server-side verification and is not retained by Arxela as an account record.

Where we act as processor, the controller’s instructions and Data Processing Agreement also govern deletion or return. Residual copies may remain in protected backups until they rotate out and are not restored for ordinary use. Our Data Retention Schedule gives the standard periods and criteria.

We use technical and organisational measures designed to protect data, including role- and scope-based access, signed and expiring access paths where appropriate, private file storage, password hashing, secure HTTP-only sessions, rate limiting, server-side reCAPTCHA verification, audit records and restricted administrator access.

No internet service is completely secure. Please use a unique password, protect your devices and tell us promptly if you suspect an account or data-security incident.

Depending on the circumstances, you may have rights to be informed; obtain access; correct inaccurate data; request deletion; restrict processing; receive portable data; object to processing based on legitimate interests or direct marketing; withdraw consent; and obtain safeguards relating to automated decisions.

Email hello@arxela.co.uk to exercise a right. We may need to verify your identity and clarify your request. We normally respond within one month, although the law permits an extension for a complex request.

If Arxela holds the data only on a landlord’s behalf, we may send the request to that landlord or ask you to contact it directly, while providing the assistance required of us as processor.

Please contact us first at hello@arxela.co.uk so we can investigate. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Arxela is not directed to children and a person under 18 cannot create a landlord account. A landlord may need to record limited information about a child occupant or guarantor-related household circumstances. It must minimise that data, provide the required privacy information and use an appropriate lawful basis.

We may update this policy when the service, providers or law changes. We will publish the updated version and date and give additional notice where a change materially affects how we use personal data.