Privacy notice

Last updated 20 October 2026. Questions: support@tinyfreeholder.co.uk

Who we are

Tiny Freeholder is run by Northside Software Ltd, registered in England and Wales, company number 17527774, 114 Clapham Common North Side, London SW4 9SW. We are the controller of the personal data described under “Waiting list”, “Your account” and “Visiting the website”. Contact us at support@tinyfreeholder.co.uk.

The records of a building company (its members, directors, flats, accounts and so on) belong to that company. We hold and handle them on its behalf, only to provide Tiny Freeholder, and not for any purpose of our own. If you are named in those records, “People named in a building’s records” below tells you what is held and where it came from.

Waiting list

• What: your email address, the time you joined, and what you run if you chose to say.
• Why: to email you when the service opens, with the price and date. The form also uses your internet (IP) address briefly, to stop repeated or automated submissions.
• Lawful basis: your consent. You can withdraw it at any time by replying “remove” to any email from us, or by emailing support@tinyfreeholder.co.uk. Withdrawing is as easy as joining.
• How long: until you ask us to remove it. Giving us your address is optional, but we cannot tell you when we open without it.

Your account

What we collect

• Your email address, and your password as a salted hash (never in readable form).
• The buildings you add or manage, and everything you enter or upload for them: flats, people, service charge budgets and demands, accounts, documents, compliance records (fire, asbestos, gas, lift, insurance, water), consultations and resolutions.
• Records of what happened: sign-in sessions, the emails we sent you, and for each payment, the amount, date, and who started it.

Why, and our lawful basis

• To provide the service you asked for and to keep your account working: contract (Article 6(1)(b) of the UK GDPR).
• To email you about it: confirming your address, resetting your password, signing requests, and deadline reminders (insurance, fire safety, Companies House and tax). Reminders are on by default and you can switch them off in your account settings. Lawful basis: contract. We do not send marketing to account holders.
• To keep the service secure and prevent abuse (limiting repeated sign-in or form attempts): our legitimate interests (Article 6(1)(f)) in running a safe service. You can object, see “Your rights”.
• To take payment and keep our own accounts and tax records: contract, and legal obligation (Article 6(1)(c)).

You do not have to create an account, but without one we cannot provide the service. We do not make decisions about you by automated means, and we do not profile you.

We do not ask for special category data (such as health information). Free-text boxes could hold anything you type, so please do not put sensitive details about people in them.

People named in a building’s records

You may be reading this because a director or manager added you to a building on Tiny Freeholder: as a director, secretary, member, shareholder, leaseholder, resident, or the person to receive a notice, and you did not give us your details yourself. Under the law we must tell you that.

• What is held: your name and, if given, your email address, phone number, correspondence address, your flat, your role and its dates, and shares held. For directors, secretaries and people with significant control, we also keep what we take from the public register at Companies House: their name, their Companies House identifiers and their appointment dates.
• Where it came from: the person who set up or manages the building, or the public register at Companies House. Companies House is a public source, but that does not stop its details being personal data, so we tell you how we use them.
• Why we use it: to keep the building company’s statutory records and run its administration: registers, notices, consultations, resolutions, accounts and filings. We hold these records on the company’s behalf under our data processing terms. The lawful basis belongs to the building company, and is usually legal obligation (a company must keep these records and file them) or its legitimate interests in running the building.
• If you sign something online: a record of your typed name, the time, a fingerprint of the document, and the internet address and browser details used, so the company has proof of who signed what.
• Who sees it: the building’s managers, you (through the links we email you), and the services in “Who else handles your data”. If you are a director or secretary, your details may be filed with Companies House, where they become public.
• How long: for as long as the building is on the service. Past members, directors and residents stay in the record as history, because company law expects it. Everything goes when the last manager of the building deletes their account (after 30 days).
• Your rights: as below. Because the records belong to the building company, the quickest route may be to ask the building’s directors, but you can email us at support@tinyfreeholder.co.uk and we will pass it on and help.

Visiting the website

• We count page views with Cloudflare Web Analytics, to learn whether the site is used and where it is broken. Cloudflare does this for us and may use the information only for that. It does not use cookies or localStorage, does not track you across other sites, and gives us totals (pages, referrers, countries, devices), not a profile of you. Lawful basis: legitimate interests. Stop counting my visits (or set Global Privacy Control or Do Not Track in your browser, which we also respect). It is free and takes effect at once.
• We set one cookie, to keep you signed in. It is strictly necessary for the service, so it needs no consent, and it lasts up to 30 days or until you sign out. There are no advertising or analytics cookies.

Who else handles your data

• Cloudflare hosts the site, the database and your uploaded documents, and provides our analytics.
• Resend sends our emails, so sees the address, subject and content of each one.
• Stripe takes card payments. Your card details go to Stripe and never reach us. We keep only the payment reference, amount and date. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties, so it is responsible for that use: see Stripe’s privacy policy.
• Companies House: we send a company number to look the company up. If you connect your Companies House account, we use the access it gives to file for the company.
• Companies House and HMRC receive the accounts, tax return and officer changes you choose to file through us, because filing is the service. This includes the names of directors.
• The people you serve notices on (leaseholders, directors, residents) receive the notice or signing request by email or post.
• We may disclose information if the law requires it.

Cloudflare and Resend are our processors: they may use your data only on our instructions. Cloudflare, Resend and Stripe all process data outside the UK, including in the United States. Their published terms cover those transfers through the UK–US data bridge (the UK extension to the Data Privacy Framework) where they are certified, and otherwise through standard contract clauses with the ICO’s UK addendum. Email support@tinyfreeholder.co.uk for details, or a copy.

How long we keep it

• Accounts you never confirm are deleted after 7 days.
• When you ask to delete your account (in your account settings, or by email), it is deleted 30 days later, along with any building that nobody else manages. Until then you can change your mind.
• Sign-in sessions last up to 30 days. Attempt counters used against abuse last minutes to hours and are cleared daily.
• Records of payments are kept for as long as we need them for our own accounts and tax records.
• Waiting-list addresses are kept until you ask us to remove them.

Your rights

You have the right to:

• be told what we hold about you and get a copy of it;
• have wrong details corrected, and incomplete ones completed;
• have your data deleted, in many cases;
• restrict how we use it, in some cases;
• receive the data you gave us in a portable form;
• withdraw consent, where we rely on it (the waiting list), at any time.

You also have the right to object to our using your data for our legitimate interests (security and analytics). If you do, we will stop unless we can show a compelling reason that overrides your interests, or we need it to defend a legal claim.

To use any of these, email support@tinyfreeholder.co.uk or write to us at the address above. We will reply within one month and do not charge. We may need to check who you are first.

Complaints

If you are unhappy with how we have handled your personal data, tell us: email support@tinyfreeholder.co.uk or write to us at the address above, or use any other way you reach us. We will acknowledge your complaint within 30 days, look into it, keep you informed, and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at any time, without telling us first, at ico.org.uk/make-a-complaint (helpline 0303 123 1113).

Changes

If we start using your data for something new, we will update this page and tell you before it starts. The date at the top shows when it last changed.