Legal
Privacy Notice
Version 1.0, last updated · Draft
Draft. This document is being reviewed by a solicitor before RunYourBlock opens to customers, and may change. Questions: [email protected].
This notice explains how Scoritz Limited, trading as RunYourBlock, uses personal data. It covers our website, our sign-up and account area, our emails and the RunYourBlock app.
Who we are
Scoritz Limited, company number 03426573, registered office The Loft Unit 11, Hunthay Business Park, Axminster, Devon, England, EX13 5RJ.
- Email: [email protected] (put "Privacy" in the subject line)
- Registration with the Information Commission (ICO): ZA186916
We are a small company and haven't appointed a data protection officer. Phil, the founder, is responsible for data protection and reads every privacy email.
Two roles: controller and processor
| Information | Who decides how it's used | What that means for you |
|---|---|---|
| Your RunYourBlock account, billing, website visits, emails to us, our newsletter and waiting lists | Scoritz Limited (controller) | This notice applies. Contact us about it. |
| Everything a block's company puts into its workspace in the app: directors, members, leaseholders, occupiers, contractors, service-charge records, repairs, documents and meetings | The block's company (controller). We are its processor. | The company's own privacy notice applies. Contact the company (usually its directors) first. |
If you are a leaseholder or occupier and you contact us about data held in your block's workspace, we will pass your request to the block's company and help it respond. We won't decide on it ourselves, because the company is responsible for that data. Our Data Processing Agreement sets out what we do for block companies.
What we collect, and why
When you create or manage an account
- Your name, email address, and the block's name, web address, company type and number of flats.
- Security details: a two-factor authentication key (stored encrypted), sign-in records, and the IP address and device used to sign in.
- If you subscribe: the company's billing name and address, VAT number if any, plan, invoices and payment status. Card details go straight to Stripe. We never see or store your full card number.
When you contact us
Your name, email address, what you tell us, and our replies.
When you join our newsletter, waiting list or founding-member list, or use a free tool
Your email address, what you signed up for, and when and how you confirmed it. If you use the free takeover checklist, we also keep the date you entered so we can send your dated plan.
When you visit our website
Our servers and our network provider (Cloudflare) record technical details of each request, such as IP address, browser type, the page requested and the time, to deliver the site and protect it from attack. We don't use these to build profiles of visitors.
Our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6(1)) |
|---|---|
| Creating and running your account and providing the Service | Contract (b) |
| Billing, invoices and keeping tax and accounting records | Contract (b) and legal obligation (c) |
| Keeping the Service secure, preventing fraud and abuse, keeping security logs | Legitimate interests (f): protecting our customers, their residents and our systems |
| Service emails, such as security alerts, payment problems and changes to our terms | Contract (b), or legitimate interests (f) in running the Service properly |
| Newsletter, waiting list, founding-member list and free-tool emails | Consent (a). You can withdraw at any time using the link in every email. |
| Answering your questions and complaints | Legitimate interests (f) in responding to people who contact us |
| Dealing with legal claims and complying with the law | Legal obligation (c) or legitimate interests (f) |
We don't use personal data for automated decisions that have legal or similarly significant effects on you.
Who we share it with
- Our service providers, who process data for us under contract: Amazon Web Services (hosting in the UK, and email delivery), Hetzner Online (our mail server), Stripe (billing) and Cloudflare (website delivery and security). The current list, with what each does and where, is on our sub-processors page.
- Stripe also uses some payment data for its own purposes, such as preventing fraud and meeting its legal obligations as a regulated payment provider. For those purposes Stripe is a separate controller; see Stripe's privacy policy at https://stripe.com/gb/privacy.
- Professional advisers, such as our accountant and solicitors, where needed.
- Authorities, such as HMRC or the police, where the law requires it.
- A buyer of our business, if RunYourBlock is ever sold, under the same protections. We'd tell you first.
We never sell personal data or share it for advertising.
Where your data is stored
- Customer data in the app is hosted on servers in the United Kingdom (Amazon Web Services, Europe (London) region), as are our account and billing records.
- Our public website is hosted in the United Kingdom too, in the same Amazon Web Services region.
- Email. Our mail server, which sends our emails and holds our own mailbox (such as messages you send to [email protected]), runs on a Hetzner Online server in Germany. It delivers email through Amazon Simple Email Service (SES) in the AWS Europe (Ireland) region. The UK treats countries in the European Economic Area, including Germany and Ireland, as providing adequate protection. Amazon Web Services is a US company. Our contract with it includes the UK International Data Transfer Addendum, and Amazon Web Services, Inc. is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge").
- Payments. Stripe processes billing data in the United States through Stripe, LLC, which is certified under the UK-US data bridge. Stripe's contract also provides the UK International Data Transfer Addendum as a fallback.
- Cloudflare carries traffic to our website and app through its global network, normally through the data centre nearest the visitor. Cloudflare, Inc. is certified under the UK-US data bridge, and its contract with us includes standard contractual clauses with the UK Addendum.
How long we keep it
| Information | How long |
|---|---|
| Account details | While the account is open, then 12 months after it closes (so we can deal with any questions), unless needed longer for one of the reasons below |
| Invoices, payments and other financial records | 6 years after the end of the financial year they relate to, as tax and VAT rules require |
| Security and sign-in logs | 12 months |
| Web server and network logs | Up to 30 days, unless needed to investigate an attack |
| Emails and support messages | 2 years after our last contact with you |
| Newsletter and list sign-ups | Until you unsubscribe. We then keep your email address on a "do not contact" list so we don't email you again. |
| Customer data in a block's workspace | As our Terms of Service and Data Processing Agreement set out: for the subscription, then 90 days for export, then deleted within a further 30 days, with backups overwritten within 35 days after that |
Your rights
You have the right to:
- see the personal data we hold about you and get a copy;
- correct it if it's wrong;
- delete it, in some circumstances;
- restrict how we use it, in some circumstances;
- object to our using it on the basis of legitimate interests, and to direct marketing at any time;
- move it to another provider, where we hold it under contract or consent;
- withdraw consent at any time, where we rely on consent. This doesn't affect what we did before.
To use any of these rights, email [email protected]. We'll reply within 1 month. If a request is complex, we may extend this by up to two further months, and we'll tell you why within the first month. We may ask you to confirm your identity first. There is normally no fee.
For data in a block's workspace, contact the block's company. We'll help it respond.
Complaints
If you're unhappy with how we've handled your data, please tell us first at [email protected]. We'll acknowledge your complaint within 30 days and tell you what we will do. See our complaints page.
You also have the right to complain to the UK regulator, the Information Commission (still known as the ICO):
- online at https://ico.org.uk/make-a-complaint/
- by phone on 0303 123 1113
Security
We protect personal data with encryption in transit, two-factor authentication, strict access controls, a tamper-evident audit trail and tested backups. See our security page.
Children
RunYourBlock is for adults running or living in blocks of flats. It isn't aimed at children, and we don't knowingly collect data from anyone under 18.
Cookies
We use only cookies and browser storage that are needed for the site to work or that you choose (such as your colour theme). See our cookie policy.
Changes to this notice
We'll update this notice when our practices change, and change the date and version at the top. If a change materially affects you, we'll tell you by email.