Privacy Policy

Privacy Policy

Last updated: August 2025

This privacy policy explains how MaintenanceFlow ("we", "us") processes personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

The company that created your MaintenanceFlow account is the data controller for the personal data entered into the platform (property and contact details, job information, and audit records). MaintenanceFlow acts as a data processor on their behalf. If you are unsure which company is acting as controller, contact us using the details below.

2. What data we collect

  • Account data: your name, email address, role, and company (tenant) association.
  • Property contact data: names, email addresses, and phone numbers for property owners, surveyors, facilities and building managers, landlords, and other contacts entered by the controller company.
  • Job and audit data: job descriptions, types, priorities, status history, comments, notes, photos, attachments, costs, and the names of people who reported or are assigned to work.
  • Contractor data: contractor name, email, and phone number, plus job updates they submit through the contractor portal.
  • Activity data: audit logs recording who created, updated, or deleted records.
  • Billing data: handled by Stripe — we store only a Stripe customer identifier, never card details.

3. How we use your data and the legal basis

  • Providing the maintenance management service (job tracking, audits, reporting) — necessary for the contract with the controller (UK GDPR Art. 6(1)(b)).
  • Sending operational emails (job cards, urgent reminders, weekly reports, asset alerts) — based on the controller's legitimate interests (Art. 6(1)(f)).
  • Keeping audit trails for accountability and dispute defence — based on legitimate interests and, where applicable, legal obligation (Art. 6(1)(c)).
  • Processing payments — necessary for the contract (Art. 6(1)(b)); payment data is processed by Stripe.

4. Who we share data with

  • The controller company and their authorised users.
  • Contractors assigned to jobs, via a secure portal link.
  • Stripe, for payment processing.
  • Our hosting and infrastructure providers (cloud and database services).

We do not sell personal data.

5. International transfers

Your data may be processed on servers located outside the UK (for example, in the United States). We only transfer personal data where appropriate safeguards are in place, such as Standard Contractual Clauses and the UK extension to the EU-US Data Privacy Framework, or where another recognised adequacy mechanism applies.

6. How long we keep data

  • Completed jobs and their audit trails: up to 6 years.
  • Email and upload logs: up to 12 months.
  • Orphaned property contact details (no active jobs): up to 2 years.
  • Account data: kept for as long as the account is active, then removed. We review these periods regularly and delete data when it is no longer needed.

7. Your rights

Under UK GDPR you have the right to:

  • be informed about how your data is used,
  • access the personal data we hold about you,
  • rectify inaccurate data,
  • erase your data (subject to legal exceptions),
  • restrict or object to processing,
  • data portability, and
  • withdraw consent where consent is the basis. To exercise any of these rights, contact us using the details below. We respond within one month.

8. Unsubscribing from emails

Non-user recipients (such as property contacts and contractors) can unsubscribe from non-operational emails using the unsubscribe link in each message. Operational job-related communications required to deliver a service may still be sent where necessary.

9. Data security

We protect personal data using access controls, tenant-level data isolation, encrypted transmission, and audit logging. Access is limited to authorised personnel.

10. Data protection complaints

You have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we handle your data. Visit ico.org.uk or call 0303 123 1113.

11. Contact

For privacy questions, data subject requests, or to unsubscribe, contact the data protection contact configured for your account, or email us using the address provided on the Privacy Request page.

Submit a data subject request