Data Protection & GDPR Policy

Effective date: 16.08.26
Last reviewed: 16.08.26
Policy owner: IM Digital Systems LTD t/a The Compliance Register
Contact email: Info@thecomplianceregister.com

Purpose of this Policy

The Compliance Register (“The Compliance Register”, “we”, “us” or “our”) is committed to protecting personal information and respecting the privacy of everyone who uses or interacts with our services.

This policy explains how we collect, use, store, protect, share and otherwise process personal data in connection with The Compliance Register platform, website and associated services.

We process personal data in accordance with applicable UK data protection legislation, including:

the UK General Data Protection Regulation (“UK GDPR”);
the Data Protection Act 2018;
the Data (Use and Access) Act 2025; and
other applicable UK privacy and electronic communications legislation.

This policy applies to our employees, contractors, customers, account holders, authorised users, visitors to our website and individuals whose personal data may be recorded within The Compliance Register platform.

2. About The Compliance Register

The Compliance Register provides a digital platform that enables organisations to manage and maintain records relating to properties, buildings, locations, maintenance, cleaning, servicing, inspections, compliance activities and other site visits.

The platform may be used by organisations including:

landlords;
estate and letting agents;
managing agents and building managers;
local authorities;
contractors and service providers;
cleaning companies;
facilities management companies;
businesses and employers;
care and retirement organisations;
leisure, hospitality and commercial organisations; and
other organisations responsible for the management or maintenance of premises.

QR codes and other digital access methods may allow authorised users, contractors, employees, tenants, occupiers, visitors and other individuals to access or submit information relating to a particular property, site, asset or task.

3. Our Role Under Data Protection Law

Depending on the circumstances, The Compliance Register may act as either a Data Controller or a Data Processor.

3.1 Where we are the Data Controller

We normally act as Data Controller for personal information that we collect for our own business purposes, including:

customer and account registration information;
billing and payment information;
customer enquiries;
customer support;
website enquiries;
marketing preferences;
platform administration;
security and fraud prevention;
business communications; and
records required to operate The Compliance Register.

As Data Controller, we determine why and how this information is processed.

3.2 Where we are the Data Processor

Where one of our customers uses The Compliance Register to collect, upload, record or manage personal information relating to its own properties, employees, contractors, tenants, residents, customers, visitors or other individuals, the customer will normally be the Data Controller and The Compliance Register will act as its Data Processor.

Examples may include:

contractor names and contact details;
records of site attendance;
employee names;
tenant or occupier details;
maintenance reports;
photographs;
comments and messages;
inspection records;
cleaning records;
servicing records;
visitor details;
time and date records;
signatures;
evidence of completed work; and
other information uploaded to a property’s or location’s digital record.

Where we act as Data Processor, we will process personal data only in accordance with the customer’s documented instructions, our contractual obligations and applicable data protection law.

4. Data Protection Principles

The Compliance Register will ensure that personal data is:

processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
accurate and, where necessary, kept up to date;
retained for no longer than necessary;
processed securely to protect against unauthorised or unlawful processing, accidental loss, destruction or damage; and
processed in a manner that allows us to demonstrate accountability and compliance with data protection law.

5. Personal Data We May Collect

Depending upon how an individual interacts with The Compliance Register, we may process information including:

Identity information

name;
username or account identifier;
employer or organisation;
job title or role.

Contact information

email address;
telephone number;
business contact information.

Property and location information

property or site being attended;
work location;
building or asset reference;
time and date of attendance.

Work and compliance records

details of maintenance issues;
cleaning records;
inspection records;
servicing records;
job descriptions;
work completed;
comments and notes;
photographs and supporting documentation;
communications regarding a task;
contractor or operative information;
time and attendance records.

Technical information

IP address;
device information;
browser information;
login activity;
security logs;
system activity;
cookies and similar technologies where applicable.

Commercial information

customer account details;
subscription information;
invoices;
payment status;
transaction records.

We encourage customers and users not to upload personal data that is unnecessary for the relevant maintenance, compliance, cleaning, servicing or management purpose.

6. Special Category and Sensitive Information

The Compliance Register is not intended to be used routinely for storing sensitive or special category personal data.

Users should avoid uploading information concerning an individual’s:

health;
racial or ethnic origin;
religious or philosophical beliefs;
political opinions;
trade union membership;
genetic information;
biometric information used for identification; or
sex life or sexual orientation,

unless there is a legitimate and lawful reason for doing so and the appropriate legal requirements and safeguards have been satisfied.

Customers remain responsible for determining whether special category information they enter into the platform is necessary and lawful where they are acting as Data Controller.

7. How We Use Personal Data

We may process personal data for purposes including:

creating and administering user accounts;
providing access to The Compliance Register;
providing QR-code based reporting and record keeping;
recording site visits and contractor attendance;
managing maintenance, cleaning, servicing and inspection records;
allowing users to report maintenance or compliance issues;
facilitating communications between relevant parties;
sending task notifications and reminders;
producing digital job and compliance records;
providing customer service and technical support;
maintaining platform security;
preventing misuse, fraud or unauthorised access;
improving our services;
administering subscriptions and payments;
complying with legal and regulatory obligations;
establishing, exercising or defending legal claims; and
communicating with customers about our products and services where permitted by law.

We will not use personal information for purposes that are incompatible with the reason it was originally collected unless permitted by law.

8. Lawful Bases for Processing

Depending on the circumstances, we may rely upon one or more lawful bases for processing personal information.

These include:

Contract

Where processing is necessary to provide our service, administer an account or perform our contractual obligations.

Legal obligation

Where processing is necessary to comply with a legal or regulatory obligation.

Legitimate interests

Where processing is necessary for our legitimate business interests or those of another organisation, provided those interests do not override the rights and freedoms of the individual.

This may include:

maintaining platform security;
preventing fraud or misuse;
administering customer relationships;
improving our services;
maintaining appropriate business records; and
protecting our legal rights.

Consent

Where consent is the appropriate lawful basis, individuals will be provided with a genuine choice and may withdraw their consent at any time.

Other lawful bases may be relied upon where permitted by applicable data protection legislation.

9. Customer Responsibilities

Customers using The Compliance Register are responsible for ensuring that their use of the platform complies with applicable data protection legislation.

Where a customer acts as Data Controller, the customer is responsible for:

determining what personal information should be collected;
ensuring that there is a lawful basis for processing;
providing appropriate privacy information to individuals;
ensuring information entered onto the platform is relevant and proportionate;
ensuring information is accurate;
determining appropriate retention periods;
managing requests from individuals exercising their data protection rights;
ensuring authorised users only access information they legitimately require; and
ensuring staff, contractors and users understand their responsibilities.

Customers must not use The Compliance Register to collect excessive, unlawful, discriminatory or otherwise inappropriate personal information.

10. Photographs and Uploaded Documents

The Compliance Register may allow users to upload photographs, documents and other supporting evidence.

Users should take reasonable steps to avoid unnecessarily capturing identifiable individuals or unrelated personal information within photographs.

Images should primarily relate to the property, asset, maintenance issue, cleaning task, inspection, completed work or other legitimate purpose for which the record is being created.

Photographs or documents containing personal information must only be uploaded where it is necessary and lawful to do so.

11. Sharing Personal Data

Personal information may be shared with authorised parties where necessary to provide our services.

This may include:

the customer responsible for the relevant account;
authorised customer employees;
property or building managers;
authorised contractors;
service providers;
IT and hosting providers;
payment providers;
professional advisers;
regulatory or law enforcement authorities where required by law; and
other organisations where disclosure is legally required or appropriately authorised.

Access to individual records should be limited to individuals who have a legitimate reason to view them.

We do not sell personal data.

12. Service Providers and Sub-Processors

The Compliance Register may engage third-party organisations to assist with the provision of its services, such as:

cloud hosting;
database hosting;
email delivery;
communications;
payment processing;
technical support;
website hosting;
analytics;
security; and
data backup.

Where a third party processes personal information on our behalf, appropriate contractual and data protection arrangements will be maintained.

We will take reasonable steps to ensure that service providers provide appropriate security and confidentiality protections.

13. International Data Transfers

Where possible, personal information will be processed within the United Kingdom or in jurisdictions recognised as providing an adequate level of data protection.

Where personal data is transferred to a country that is subject to UK international transfer restrictions, The Compliance Register will ensure that an appropriate lawful transfer mechanism and necessary safeguards are in place.

These may include applicable adequacy regulations, an International Data Transfer Agreement, an approved UK Addendum or another legally permitted safeguard.

Where required, appropriate transfer risk assessments will be carried out.

14. Data Security

The Compliance Register takes the security of personal information seriously and will maintain appropriate technical and organisational measures proportionate to the nature of the information and associated risks.

Measures may include:

controlled user access;
password-protected accounts;
access permissions;
secure hosting;
encryption where appropriate;
system monitoring;
backups;
software and security updates;
restrictions on administrative access;
logging of system activity where appropriate;
procedures for responding to security incidents; and
appropriate contractual requirements for service providers.

Customers are responsible for keeping their login credentials secure and must not knowingly allow unauthorised individuals to access their accounts.

Suspected unauthorised access should be reported to The Compliance Register as soon as possible.

15. Data Retention

The Compliance Register will not retain personal information for longer than is reasonably necessary for the purpose for which it was collected.

Retention periods may vary depending upon:

the type of information;
contractual requirements;
customer instructions;
legal requirements;
regulatory requirements;
the need to establish or defend legal claims; and
legitimate operational requirements.

Where we act as Data Processor, retention and deletion of customer-controlled information may be determined by the relevant customer’s instructions and our agreement with that customer.

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of as appropriate.

16. Individual Data Protection Rights

Depending upon the circumstances and the lawful basis being relied upon, individuals may have rights including:

Right of access – to request access to personal information held about them.

Right to rectification – to request correction of inaccurate or incomplete information.

Right to erasure – to request deletion of personal information in certain circumstances.

Right to restriction – to request that processing is restricted in certain circumstances.

Right to data portability – to receive certain personal information in a portable format where applicable.

Right to object – to object to certain types of processing.

Rights relating to automated decision-making – where applicable.

Right to withdraw consent – where processing is based upon consent.

The application of these rights depends upon the circumstances and applicable data protection legislation.

Where The Compliance Register acts solely as Data Processor, a request may need to be referred to the relevant customer acting as Data Controller.

17. Subject Access Requests

Individuals may request access to personal information held about them.

The Compliance Register will respond to valid requests without undue delay and normally within one month of receiving the request and any information reasonably required to confirm the individual’s identity or clarify the request.

Where permitted by law, this period may be extended for complex or multiple requests.

We will undertake reasonable and proportionate searches for information relevant to a valid subject access request.

Requests should be sent to:

Email: Info@thecomplianceregister.com

18. Data Protection Complaints

Anyone who has concerns about how The Compliance Register has handled their personal information may raise a complaint with us.

Complaints can be submitted to:

Email: Info@thecomplianceregister.com
Address: Unit 3, Posterngate Farm, Harts Lane, South Godstone, Surrey. RH9 8LZ

We will:

provide a clear route for individuals to submit data protection complaints;
acknowledge receipt of a complaint within 30 days;
investigate complaints without undue delay;
take appropriate steps to resolve justified concerns; and
communicate the outcome of our investigation to the complainant.

If an individual remains dissatisfied, they may have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

19. Personal Data Breaches

A personal data breach may include accidental or unlawful:

loss of personal information;
destruction of information;
alteration of information;
unauthorised disclosure;
unauthorised access; or
loss of availability of personal information.

All suspected personal data breaches must be reported immediately to the person responsible for data protection within The Compliance Register.

We will investigate suspected breaches and maintain appropriate records of incidents.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office without undue delay and, where required, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to an affected individual, we will also notify that individual where required by law.

20. Data Protection by Design and Default

The Compliance Register will consider data protection and privacy when designing, developing and modifying its services.

This includes considering:

whether personal information needs to be collected;
whether the amount of information collected can be reduced;
access controls;
default privacy settings;
retention;
deletion;
platform security;
third-party integrations; and
risks associated with new functionality.

Where proposed processing is likely to result in a high risk to individuals, a Data Protection Impact Assessment may be undertaken where required.

21. Access to Information

Access to personal information contained within The Compliance Register will be restricted according to the user’s role and legitimate business need wherever reasonably practicable.

Customers are responsible for managing their authorised users and removing access when it is no longer required.

Users must not:

share passwords;
deliberately access records they are not authorised to view;
download or distribute information unnecessarily;
use information for unrelated purposes; or
disclose personal information to unauthorised third parties.

22. Automated Decision-Making

The Compliance Register does not intend to make decisions about individuals solely through automated processing where those decisions produce legal or similarly significant effects, unless this is permitted by law and appropriate safeguards are implemented.

Routine automation such as task reminders, notifications, scheduling and workflow management is not intended to make significant decisions about individuals.

23. Children’s Information

The Compliance Register is primarily a business and property-management platform and is not intended to be used directly by children.

Customers should not deliberately enter children’s personal information unless there is a legitimate and lawful reason for doing so and appropriate safeguards have been considered.

24. Marketing Communications

Where The Compliance Register sends marketing communications, these will be sent in accordance with applicable data protection and electronic marketing laws.

Individuals will be given an appropriate method of opting out of marketing communications.

Marketing preferences will not affect essential service, security, account or transactional communications.

25. Cookies and Website Information

Our website may use cookies or similar technologies to operate the website, maintain security, remember preferences, understand website usage and, where applicable, support marketing activities.

Where required, users will be provided with information about the cookies used and appropriate choices regarding non-essential cookies.

Further details may be provided in a separate Cookie Policy.

26. Training and Responsibilities

Anyone working for or on behalf of The Compliance Register who has access to personal information must:

respect confidentiality;
handle information securely;
follow this policy;
only access information where required;
report suspected breaches promptly; and
undertake appropriate data protection training where required.

Failure to comply with data protection requirements may result in access being removed and, where applicable, disciplinary or contractual action.

27. Data Protection Contact

Questions concerning this policy, personal information or data protection rights should be directed to:

The Compliance Register (IM Digital System LTD)
Email: Info@thecomplianceregister.com
Address: Unit 3, Posterngate Farm, Harts Lane, South Godstone, Surrey. RH9 8LZ

28. Changes to this Policy

This policy will be reviewed periodically and may be updated to reflect:

changes to our services;
changes to how personal information is processed;
new technology;
changes in regulatory guidance; or
changes to applicable legislation.

The latest version will be made available through The Compliance Register website or platform where appropriate.

Policy version: 1.0
Effective date: 16.08.26
Next review date: 16.08.27