This Privacy Policy explains how Unit Manager Pro ("we", "us", "our") collects and uses personal data when you use our website and platform. It applies to facility operators who hold an account with us and to tenants of those facilities whose data we process on the operator's behalf.
1. Who we are
- Controller: Unit Manager Pro Ltd, United Kingdom.
- Privacy contact: privacy@unitmanagerpro.com
- Security contact: security@unitmanagerpro.com
- We are not currently required to appoint a statutory Data Protection Officer; the privacy contact above handles all data-protection enquiries.
2. Our roles
We are the controller for data about facility operators (account, billing, usage) and the processor for tenant personal data that facility operators enter into the platform. Operators act as the controller for their tenant data — see ourData Processing Agreementfor the processor terms that govern that relationship.
3. Data we process and why (legal basis)
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the platform to operators | Name, email, password hash, role, facility data | Contract (Art 6(1)(b)) |
| Process subscription payments | Billing details (via Stripe) | Contract (Art 6(1)(b)) |
| Tenant onboarding & rent collection | Tenant name, contact, ID document, lease, payments | Operator's contract with tenant; processed on operator's instructions |
| Service security & fraud prevention | IP address, device, logs | Legitimate interests (Art 6(1)(f)) |
| Transactional emails & SMS | Email, phone, notification preferences | Contract / legitimate interests |
| Analytics on our marketing site | Coarse device info, page views | Consent (Art 6(1)(a)) |
| Measuring the performance of our advertising and account sign-ups (Google Ads) | Cookie / advertising identifier, pages viewed, ad interaction, successful operator sign-up event and random event reference | Consent (Art 6(1)(a)) |
| Product newsletter | Consent (double opt-in) | |
| Legal/tax records | Invoices, signed agreements | Legal obligation (Art 6(1)(c)) |
For tenants, the source of data is normally the facility operator who entered it on your behalf, or your own submission via a booking form.
4. Who we share data with (sub-processors)
We use the sub-processors listed at /legal/sub-processors, including:
- Lovable Cloud / Supabase — hosting, database, authentication, storage (EU).
- Cloudflare — CDN, DDoS protection, custom-domain TLS (global).
- Stripe — card payments and Connect payouts (US/EU).
- Resend / Mailgun — transactional email delivery (EU/US).
- Twilio — SMS notifications (US/EU).
- Google (Google Ads) — measuring how well our advertising on unitmanagerpro.com works (US). The Google Ads tag is switched off by default and only records anything once you have accepted marketing cookies in our consent banner; if you reject or withdraw that choice, no advertising cookies are set and no data is sent to Google Ads.
We do not sell personal data. We do not use it for cross-context behavioural advertising and we do not run advertising or marketing trackers on facility websites, the tenant portal or the dashboard. Where you have consented to marketing cookies, Google Ads may measure how visitors reached unitmanagerpro.com from our adverts and report aggregated campaign performance to us. We report successful new operator account registrations and saved demo enquiries as separate conversions, only with marketing consent. Opening a page or clicking a demo button is not a conversion. This event does not include your name, email address, password or account ID, and does not measure tenant registrations. We keep a record of your cookie choices and the notice version shown; you can withdraw marketing consent at any time through Cookie Preferences without affecting your account.
With analytics consent, we keep the first public page and campaign labels for your current browsing journey in session storage, expiring after 30 minutes of inactivity. When you request a demo, we save that attribution with your enquiry to understand which pages and campaigns generate interest. We do not include URL query strings, return-link tokens or advertising click IDs in this record. Planner unit counts and any facility details you choose to submit are included with your enquiry. Withdrawing analytics consent clears the browser journey record; it does not delete an enquiry already submitted.
5. International transfers
Personal data is hosted in the EU/UK by default. Where a sub-processor processes data outside the UK/EEA (e.g. US-based Stripe, Cloudflare, Twilio, Resend, Google), transfers rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary technical measures (TLS in transit, encryption at rest, scoped service keys).
6. Retention
- Account & facility data: while the account is active. After deletion, removed from active systems within 30 days and from backups within 90 days.
- Tenant documents (ID, address proof): 30 days after lease end, unless the operator records a lawful reason to keep them longer.
- Signed rental agreements & invoices: 6 years (UK statutory limitation / HMRC).
- Website analytics and Google Ads measurement: 13 months.
- Email & SMS send logs: 12 months.
- Marketing newsletter: until you unsubscribe, then up to 24 months suppression record to honour your opt-out.
- Contact form submissions: 24 months after last activity.
- Tenant invitation tracking: 90 days after acceptance or expiry.
A daily automated job enforces these retention periods.
7. Your rights (UK GDPR / GDPR)
You have the right to:
- Access the personal data we hold about you (Art 15);
- Have inaccurate data corrected (Art 16);
- Have your data erased (Art 17);
- Restrict or object to processing (Art 18, 21);
- Receive your data in a portable format (Art 20);
- Withdraw consent at any time without affecting prior processing;
- Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Account-holders can self-serve export and deletion from Account → Privacy & data. Tenants: ask your facility operator first, or contact us if they do not respond.
8. Automated decision-making
We do not make automated decisions producing legal or similarly significant effects about you.
9. Cookies and advertising measurement
See our Cookie Policy and manage your choices at /legal/cookie-preferences. Non-essential analytics and marketing (Google Ads) cookies only fire after you have given consent. Advertising permissions start switched off using Google Consent Mode, so rejecting marketing cookies means Google Ads receives no data about your visit.
10. Security
TLS in transit, row-level security in the database, encryption at rest, scoped service keys, audit logging for tenant-document access, and breach notification to the ICO within 72 hours of becoming aware of a notifiable incident.
11. Children
The service is not intended for children under 16.
12. Changes
We will notify users of material changes by email or in-app at least 14 days in advance, and re-prompt consent where required.