Last updated: August 2025
This Privacy Policy explains how Maintenance Flow ("we", "us", or "our") processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The company that creates and manages your Maintenance Flow account is generally the data controller for the personal data entered into the platform, including property information, contact details, job records, audit information, and other operational data.
Maintenance Flow acts as a data processor on behalf of that company and processes personal data in accordance with its instructions.
In certain circumstances, Maintenance Flow may act as a data controller for personal data relating to:
If you are unsure which organisation is acting as the controller of your personal data, please contact us using the details provided below.
Your name, email address, role, user permissions, and company (tenant) association.
Names, email addresses, telephone numbers, and other business contact details relating to property owners, surveyors, facilities managers, building managers, landlords, contractors, and other contacts entered by the controller company.
Job descriptions, maintenance records, priorities, status updates, comments, notes, photographs, attachments, costs, completion records, and information about users involved in the work.
Contractor names, email addresses, telephone numbers, and job updates submitted through contractor portals or related communications.
Audit logs and activity records showing when users create, modify, view, or delete data within the platform.
Subscription and billing information required to manage customer accounts. Payment processing is provided by Stripe. We do not store payment card details.
Information such as IP addresses, browser type, device information, login records, security logs, and diagnostic information generated through the use of our platform or website.
We process personal data for the following purposes:
To deliver maintenance management functionality including job tracking, reporting, contractor management, notifications, audits, and platform administration.
Where Maintenance Flow acts as a controller, this processing is necessary for the performance of a contract under Article 6(1)(b) UK GDPR.
Where we act as a processor, we process personal data on behalf of the controller company in accordance with its instructions.
To send job cards, maintenance updates, asset alerts, password resets, account notifications, contractor requests, service notices, and other communications necessary to operate the platform.
These communications are sent on behalf of the controller company or, where appropriate, as part of our legitimate interests in operating, maintaining, and securing the service under Article 6(1)(f) UK GDPR.
To maintain security, investigate incidents, prevent unauthorised access, detect misuse, maintain audit trails, and resolve disputes.
This processing is based on our legitimate interests and, where applicable, compliance with legal obligations under Articles 6(1)(f) and 6(1)(c) UK GDPR.
To manage subscriptions, invoices, payments, account administration, and customer support.
This processing is necessary for the performance of a contract under Article 6(1)(b) UK GDPR.
We may share personal data with:
We do not sell personal data and do not share personal data with third parties for their own marketing purposes.
Some of our service providers may process personal data outside the United Kingdom.
Where personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements. These safeguards may include:
You may contact us for additional information about the safeguards used for international data transfers.
We retain personal data only for as long as necessary for the purposes for which it was collected.
Our current retention periods are:
We review retention periods regularly and securely delete or anonymise personal data when it is no longer required.
Under UK GDPR, you have the right to:
To exercise these rights, please contact us using the details below.
We may request reasonable information to verify your identity before responding to a request. We normally respond within one month.
Users of the platform may receive communications relating to:
Property contacts, contractors, and other recipients may unsubscribe from non-essential communications where an unsubscribe mechanism is provided.
Certain service-related communications may still be sent where necessary to provide the service, fulfil contractual obligations, comply with legal requirements, or maintain platform security.
Our website and platform use cookies and similar technologies to support functionality, security, and performance.
These technologies may be used to:
Some cookies are essential for the operation and security of the platform and cannot be disabled.
Where required by law, we will obtain consent before placing non-essential cookies or analytics technologies on your device.
Most web browsers allow you to manage or disable cookies through browser settings. Disabling certain cookies may affect the functionality of the website or platform.
Maintenance Flow is intended for use by businesses and professionals and is not designed for or directed at children under the age of 18.
We do not knowingly collect personal data from children. If we become aware that personal data relating to a child has been submitted to the service without appropriate authorisation, we will take reasonable steps to delete that information promptly.
If you believe a child has provided personal data through the service, please contact us using the details below.
We implement appropriate technical and organisational measures designed to protect personal data from accidental loss, unauthorised access, disclosure, alteration, or destruction.
These measures include:
No system can guarantee absolute security, but we continually review and improve our safeguards to protect personal data.
If you have concerns about how your personal data has been handled, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Further information is available from the ICO at Information Commissioner's Office or by telephone on 0303 123 1113.
For privacy enquiries, data subject requests, complaints, or questions about this Privacy Policy, please contact us.
If your request relates to information entered into the platform by a customer company, we may direct you to the relevant data controller where appropriate.
To request access to your personal data or ask for its erasure, submit a request through our secure form.
Submit a data subject request