Contents
- 1. Introduction
- 2. Who we are
- 3. What data we collect
- 4. How we use your data
- 5. Our legal basis for processing
- 6. Who we share data with
- 7. Tenant & contractor data
- 8. Data retention
- 9. International transfers
- 10. Security
- 11. Your rights
- 12. Cookies
- 13. Children
- 14. Changes to this policy
- 15. Contact & complaints
1. Introduction
This Privacy Policy explains how Slatebase collects, uses, shares, and protects personal data when you use our property management platform. We take data protection seriously, particularly given the sensitive nature of tenancy and financial information stored in Slatebase, and we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who we are
Slatebase is provided by RJP Group Ltd, a company registered in England and Wales. For the purposes of UK GDPR, RJP Group Ltd is the data controller in respect of your account data, and acts as a data processor on your behalf in respect of the tenant, contractor, and property data you store within the platform.
3. What data we collect
| Category | Examples |
|---|---|
| Account data | Name, email, phone number, correspondence address, password (hashed), 2FA method |
| Property data | Property addresses, tenure, features, photos, inventory items |
| Tenancy data | Tenant names and contact details, tenancy dates, rent amounts, deposit details |
| Financial data | Income and expense records, bank transaction data (if you connect a bank account via TrueLayer), landlord bank details used to populate tenancy agreements |
| Compliance documents | Certificates, inspection reports, and related documents you upload |
| Communications | Messages exchanged between landlords, tenants, and contractors within the platform |
| Usage data | Log data, device information, and analytics collected automatically when you use Slatebase |
4. How we use your data
We use personal data to: provide and maintain the Slatebase service; process payments via Stripe; send transactional emails and, where enabled, SMS/WhatsApp alerts via Twilio; generate legal documents and facilitate e-signature via Signable; provide customer support, including via our live chat widget and phone line, powered by HighLevel (GoHighLevel); detect and prevent fraud or misuse; and comply with our legal obligations.
We do not sell personal data to third parties, and we do not use tenant or contractor data stored on your behalf for our own marketing purposes.
5. Our legal basis for processing
We process account data on the basis of performance of our contract with you (providing the Slatebase service) and, for marketing communications, your consent, which you may withdraw at any time. Where you use Slatebase to store personal data about your tenants and contractors, you (the landlord or agent) are the data controller for that data, and Slatebase processes it as your data processor, on your instructions, under our terms of service.
6. Who we share data with
We share data with the following categories of third-party processors, only as necessary to provide the service:
- Supabase — database hosting and authentication;
- Stripe — payment processing (we do not store your card details);
- Resend — transactional email delivery;
- Twilio — SMS and WhatsApp messaging, where enabled (processed in the United States);
- TrueLayer — Open Banking connections, where you choose to connect a bank account;
- Signable — electronic signature processing for documents you choose to send;
- HighLevel (GoHighLevel) — website live chat, contact form submissions, and our phone support line, including AI-assisted call handling (processed in the United States);
- Vercel — hosting of our marketing website.
We may also disclose data where required by law, to protect our legal rights, or in connection with a business transfer such as a merger or acquisition.
7. Tenant & contractor data
If you are a tenant or contractor whose data has been added to Slatebase by a landlord or agent, your data is controlled by that landlord or agent, not by Slatebase. Requests to access, correct, or delete your data should be directed to your landlord or agent in the first instance. Slatebase acts as a processor and will support the landlord in fulfilling such requests.
If you are a tenant with your own Slatebase portal login, the data you submit directly (such as messages or maintenance requests) is also processed on behalf of your landlord as data controller.
8. Data retention
We retain account and property data for as long as your account is active. If you close your account, we retain data for a limited period to allow you to reactivate or export it, after which it is deleted in accordance with UK GDPR Article 17, typically within 30 days, save where we are required to retain records for longer for legal, accounting, or regulatory reasons (for example, financial transaction records).
9. International transfers
Some of our processors may store or process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or adequacy regulations, to protect your data to UK GDPR standards. In particular, Twilio processes SMS and WhatsApp message content and recipient phone numbers in the United States; this transfer is covered by Twilio's standard contractual clauses and UK International Data Transfer Addendum. Similarly, HighLevel (GoHighLevel) processes website chat conversations, contact form submissions, and phone support data (including call handling) in the United States; this transfer is covered by HighLevel's data processing agreement, which incorporates standard contractual clauses, and HighLevel's certification under the EU-U.S. and UK-U.S. Data Privacy Framework.
10. Security
We use industry-standard measures to protect personal data, including encryption in transit and at rest, role-based access controls, and regular security review of our infrastructure. No system is completely secure, and we encourage you to use a strong, unique password and enable two-factor authentication on your account.
11. Your rights
Under UK GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; restrict or object to certain processing; request data portability; and withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at hello@slatebase.co.uk, or use the self-service export tool at Account → Data → Export all data.
12. Cookies
Our marketing website and app use cookies and similar technologies. See our Cookie Policy for full details of what we use and how to manage your preferences.
13. Children
Slatebase is not intended for use by anyone under 18, and we do not knowingly collect personal data from children.
14. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice within the app before they take effect.
15. Contact & complaints
Questions or concerns about how we handle personal data can be sent to hello@slatebase.co.uk. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.