Privacy Policy
Effective date: 16 August 2026
Last reviewed: 16 August 2026
Next review date: 16 August 2027
The Compliance Register respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, protect and share personal information when you visit our website, create or use an account, scan one of our QR codes, report an issue, complete a task, attend a property or location, communicate through our platform or otherwise interact with The Compliance Register.
This policy also explains your rights under UK data protection law.
1. Who We Are
The Compliance Register provides an online platform designed to digitise and manage records relating to property maintenance, cleaning, inspections, servicing, compliance activities, contractor visits and other property or site-related activities.
The platform allows organisations to create digital records for their properties, buildings, locations and assets.
QR codes may be placed at properties or locations so that authorised users, contractors, employees, tenants, occupiers, visitors and other users can access relevant information, report issues or record work and visits.
For the purposes of data protection law, The Compliance Register may act as either a Data Controller or a Data Processor, depending upon why and how the personal information is being processed.
Email: info@thecomplianceregister.com
Registered address: Unit 3, Posterngate Farm, Harts Lane, South Godstone. RH9 8LZ
Company number: 17097166
2. When We Are the Data Controller
The Compliance Register will normally act as the Data Controller for information we collect directly for our own business purposes.
This includes information relating to:
- customers;
- account holders;
- prospective customers;
- website visitors;
- customer enquiries;
- subscriptions;
- billing;
- customer support;
- marketing;
- platform administration;
- security; and
- our own business operations.
When we act as Data Controller, we determine why and how your personal information is processed.
3. When We Are the Data Processor
Our customers may use The Compliance Register to manage information relating to their own:
- properties;
- buildings;
- employees;
- contractors;
- maintenance operatives;
- cleaners;
- tenants;
- occupiers;
- residents;
- visitors;
- suppliers; and
- other authorised users.
In these circumstances, our customer will normally be the Data Controller and The Compliance Register will act as the Data Processor.
This means our customer determines why personal information is being processed and The Compliance Register provides the technology used to process and store that information.
If you have interacted with The Compliance Register because of a property, employer, managing agent, landlord, contractor or other organisation, that organisation may therefore be responsible for responding to questions about how your information is being used.
We will assist our customers in meeting their data protection obligations where required.
4. Information We May Collect
The information we collect depends upon how you interact with The Compliance Register.
It may include the following.
Identity Information
This may include:
- your name;
- username;
- user ID;
- job title;
- employment role;
- organisation or company name.
Contact Information
This may include:
- email address;
- telephone number;
- business address;
- other contact information that you provide.
Account Information
This may include:
- login details;
- account permissions;
- account type;
- organisation;
- user preferences;
- account activity.
We do not store passwords in plain text and appropriate technical security measures should be used to protect authentication credentials.
5. Information Collected When You Scan a QR Code
QR codes generated through The Compliance Register may be displayed at properties, buildings, facilities, equipment or other locations.
When you scan a QR code and interact with the platform, we may collect information such as:
- your name;
- email address;
- telephone number;
- company or organisation;
- job role;
- the property or location concerned;
- the QR code accessed;
- date and time of access;
- details of an issue being reported;
- details of a visit;
- work completed;
- notes or comments;
- photographs;
- uploaded documents;
- communications;
- device and technical information;
- IP address; and
- other information you choose to provide.
The information collected will depend upon the particular function being used.
6. Property, Maintenance and Compliance Records
The Compliance Register is designed to create a transparent digital history of activities undertaken at a property, building, location or asset.
Records may therefore include:
- maintenance reports;
- repair requests;
- cleaning records;
- inspection records;
- servicing records;
- fire safety records;
- compliance records;
- contractor attendance;
- staff attendance;
- scheduled tasks;
- completed tasks;
- dates and times of visits;
- job notes;
- works undertaken;
- defects identified;
- recommendations;
- photographs;
- supporting documents;
- certificates;
- conversations and messages;
- confirmation that work has been completed; and
- other information relevant to managing the property or location.
These records may be retained as part of the property’s or location’s digital history.
7. Photographs and Documents
Users may be able to upload photographs, documents and other supporting evidence to The Compliance Register.
Photographs may, for example, be used to:
- demonstrate the condition of a property;
- record a maintenance issue;
- provide evidence of completed work;
- record an inspection;
- demonstrate that cleaning has taken place;
- document a compliance issue; or
- provide evidence relating to a service visit.
Users should avoid including identifiable individuals in photographs unless this is necessary and appropriate.
Users should also avoid uploading unrelated personal or confidential information.
Where documents contain personal information, that information should only be uploaded where there is a legitimate reason to do so.
8. Communications
The Compliance Register may allow users to communicate with other authorised parties regarding jobs, properties, maintenance issues, tasks or other records.
We may therefore process:
- messages;
- comments;
- responses;
- notifications;
- email communications;
- task updates; and
- other communications made through or in connection with the platform.
These communications may form part of the permanent or retained digital record relating to the relevant task, property or location.
9. Technical Information
When you access our website or platform, we may automatically collect certain technical information.
This may include:
- IP address;
- browser type;
- device type;
- operating system;
- approximate location derived from technical information;
- login dates and times;
- pages or areas accessed;
- session information;
- system logs;
- error logs; and
- security information.
We may use this information to operate, secure, maintain and improve our platform.
10. Payment and Subscription Information
Where you purchase or subscribe to The Compliance Register, we may collect information including:
- customer name;
- company name;
- billing address;
- subscription information;
- payment status;
- invoice records; and
- transaction information.
Payments may be processed by a third-party payment provider.
Where this is the case, full payment card information may be collected and processed directly by the payment provider rather than being stored by The Compliance Register.
11. How We Use Your Information
We may use personal information to:
- provide The Compliance Register platform;
- create and administer accounts;
- authenticate users;
- allow users to access authorised properties and records;
- enable QR-code functionality;
- enable users to report maintenance issues;
- manage cleaning records;
- manage maintenance records;
- manage inspections and servicing;
- maintain compliance records;
- record site visits;
- record contractor and operative attendance;
- assign tasks;
- monitor task completion;
- send job sheets;
- send reminders and notifications;
- allow communication between authorised users;
- create a digital record of activities;
- upload and retain photographs and documents;
- provide technical support;
- respond to enquiries;
- process subscriptions and payments;
- maintain and improve our platform;
- detect and prevent unauthorised access;
- prevent fraud and misuse;
- maintain system security;
- establish, exercise or defend legal claims;
- meet our legal and regulatory obligations; and
- communicate with customers about our products and services where permitted by law.
We will not use personal information for an incompatible purpose unless permitted to do so by law.
12. Our Lawful Bases for Processing
UK data protection law requires us to have a lawful basis for processing personal information.
Depending upon the circumstances, we may rely on one or more of the following.
Contract
We may process personal information where it is necessary to:
- create an account;
- provide our services;
- administer a subscription;
- provide customer support; or
- fulfil our contractual obligations.
Legitimate Interests
We may process personal information where this is necessary for our legitimate interests or those of another organisation, provided those interests do not override your data protection rights.
Our legitimate interests may include:
- operating our business;
- providing and improving our platform;
- managing customer relationships;
- protecting our systems;
- preventing fraud;
- maintaining appropriate business records;
- maintaining property and compliance records; and
- protecting our legal rights.
Legal Obligation
We may process information where this is necessary to comply with a legal or regulatory requirement.
Consent
Where consent is the appropriate lawful basis, we will ask you for consent.
Where processing is based upon consent, you can withdraw that consent at any time.
Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.
13. Special Category Personal Information
The Compliance Register is not intended to be routinely used to process sensitive or special category personal information.
Special category information includes information concerning:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data used for identification;
- health;
- sex life; and
- sexual orientation.
Users should not upload this type of information unless it is necessary, lawful and relevant to the purpose for which the platform is being used.
Where special category information is processed, an appropriate lawful basis and additional condition for processing must apply.
14. Who Can See Your Information?
Information stored within The Compliance Register is not intended to be publicly available.
Depending upon the account and circumstances, information may be accessible to authorised individuals including:
- the organisation responsible for the account;
- landlords;
- property managers;
- estate or letting agents;
- building managers;
- facilities managers;
- authorised employees;
- maintenance contractors;
- cleaning contractors;
- service providers;
- authorised administrators; and
- other persons who have been given legitimate access to the relevant property, location, task or record.
Access may differ depending upon the user’s permissions and role.
15. Sharing Your Information
We may share personal information with trusted third parties where necessary to operate The Compliance Register.
These may include:
- cloud hosting providers;
- database providers;
- IT providers;
- software suppliers;
- email providers;
- communications providers;
- payment processors;
- customer-support systems;
- analytics providers;
- security providers;
- backup providers;
- professional advisers such as accountants, insurers and solicitors; and
- regulators, courts, law enforcement agencies or public authorities where required by law.
Where another organisation processes personal information on our behalf, we will put appropriate contractual arrangements in place where required.
The Compliance Register does not sell your personal information.
16. International Transfers
Some suppliers or technology providers may process information outside the United Kingdom.
Where personal information is transferred internationally and UK data protection law requires safeguards to be put in place, we will use an appropriate lawful transfer mechanism.
This may include:
- transferring information to a country recognised as providing an adequate level of protection;
- an approved International Data Transfer Agreement;
- an approved UK Addendum to appropriate contractual clauses; or
- another lawful transfer mechanism.
Additional safeguards will be considered where appropriate.
17. How Long We Keep Your Information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected.
The appropriate retention period depends upon factors including:
- the type of information;
- why it was collected;
- whether the customer account remains active;
- contractual requirements;
- legal requirements;
- regulatory requirements;
- industry requirements;
- potential disputes;
- limitation periods;
- security requirements; and
- whether the information forms part of an ongoing property or compliance record.
Property, maintenance, inspection, cleaning, servicing and compliance records may need to be retained for longer periods where there is a legitimate need to maintain an historical record.
Where The Compliance Register acts as Data Processor, the relevant customer may determine how long information is retained.
Once information is no longer required, it will be deleted, anonymised or otherwise securely disposed of as appropriate.
18. Account Closure
Closing an account does not necessarily mean that all information connected with that account will be deleted immediately.
We may need to retain certain information:
- to comply with legal obligations;
- for accounting and taxation purposes;
- for fraud prevention;
- to resolve disputes;
- to establish or defend legal claims;
- to maintain security records; or
- in accordance with instructions from a customer acting as Data Controller.
Where appropriate, personal information will be deleted or anonymised once it is no longer required.
19. How We Protect Your Information
We take reasonable and proportionate technical and organisational measures to protect personal information against:
- unauthorised access;
- accidental loss;
- misuse;
- disclosure;
- alteration;
- destruction; and
- loss of availability.
Security measures may include:
- secure hosting;
- access controls;
- account authentication;
- password protection;
- encryption where appropriate;
- system monitoring;
- security logging;
- data backups;
- software updates;
- restricted administrative access; and
- procedures for managing security incidents.
No online system can provide an absolute guarantee of security, but we continually consider appropriate measures to protect information.
20. Your Responsibility for Account Security
If you have a user account, you are responsible for:
- keeping your login credentials confidential;
- using a secure password;
- not sharing your account with unauthorised individuals;
- logging out where appropriate;
- ensuring your contact information remains accurate; and
- notifying us promptly if you believe your account has been compromised.
You must not attempt to access information that you are not authorised to view.
21. Data Protection by Design
We consider data protection when designing and developing The Compliance Register.
This includes considering:
- what information needs to be collected;
- whether less information can be collected;
- who needs access;
- user permissions;
- security;
- retention;
- deletion;
- data sharing;
- new platform functionality; and
- third-party integrations.
Where a type of processing is likely to result in a high risk to individuals, we will consider whether a Data Protection Impact Assessment is required.
22. Your Data Protection Rights
Depending upon the circumstances, you may have the following rights.
Right to be Informed
You have the right to understand how your personal information is collected and used.
Right of Access
You may request confirmation of whether we process your personal information and request a copy of that information.
Right to Rectification
You may ask us to correct inaccurate or incomplete personal information.
Right to Erasure
In certain circumstances, you may ask us to delete your personal information.
This right is not absolute and we may be entitled or required to retain certain information.
Right to Restrict Processing
In certain circumstances, you may ask us to restrict how your information is processed.
Right to Data Portability
In certain circumstances, you may have the right to receive personal information in a structured, commonly used and machine-readable format.
Right to Object
You may have the right to object to certain processing, including certain processing based on legitimate interests and direct marketing.
Rights Relating to Automated Decision-Making
You may have rights relating to decisions made solely by automated processing where those decisions have legal or similarly significant effects.
Right to Withdraw Consent
Where we rely upon consent, you may withdraw your consent at any time.
23. Exercising Your Rights
To exercise your data protection rights, contact:
Email: info@thecomplianceregister.com
Please provide sufficient information for us to understand and respond to your request.
We may need to verify your identity before providing personal information or acting on a request.
We normally respond to valid data protection rights requests without undue delay and within the time limits required by applicable law.
Where The Compliance Register processes your information solely on behalf of one of our customers, we may refer your request to that customer or assist them in responding to it.
24. Direct Marketing
We may send information about The Compliance Register to existing and prospective customers where permitted by law.
You may opt out of marketing communications at any time by:
- using the unsubscribe option provided in a marketing email; or
- contacting us at [Insert email].
Opting out of marketing will not prevent us from sending essential service-related communications such as:
- security notifications;
- account information;
- task notifications;
- service notices;
- billing information; or
- other transactional communications.
25. Cookies
Our website and platform may use cookies and similar technologies.
Cookies may be used to:
- enable essential website functionality;
- maintain login sessions;
- remember preferences;
- improve website performance;
- maintain security;
- understand how our website is used; and
- support analytics or marketing where appropriate.
Where consent is required for non-essential cookies, we will obtain that consent before those cookies are placed or accessed.
You can manage your choices through our cookie controls where available.
Further information is available in our Cookie Policy.
26. Links to Other Websites
Our website or platform may contain links to third-party websites or services.
The Compliance Register is not responsible for the privacy practices of third-party websites.
We recommend reviewing the privacy policy of any external website before providing personal information.
27. Children
The Compliance Register is designed primarily for use by businesses, organisations, property professionals, contractors and other adults.
Our services are not directed specifically at children.
Customers should not upload information relating to children unless there is a legitimate and lawful reason to do so and appropriate safeguards are in place.
28. Personal Data Breaches
We have procedures for identifying, investigating and responding to suspected personal data breaches.
Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the Information Commissioner’s Office where required.
Where required by law, reportable breaches will be reported without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to an individual, we will notify affected individuals where required by law.
29. Complaints
If you are concerned about how we have collected, used or protected your personal information, please contact us first so that we can investigate.
You can submit a data protection complaint using:
Email: info@thecomplianceregister.com
Address: Unit 3, Posterngate Farm, Harts Lane, South Godstone, Surrey. RH9 8LZ
We will:
- provide an accessible way for you to make a complaint;
- acknowledge receipt of your complaint within 30 days;
- investigate the matter appropriately;
- keep you informed where appropriate; and
- communicate the outcome of the complaint without undue delay.
30. Complaining to the Information Commissioner’s Office
You also have the right to raise concerns with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Further information is available through the ICO website.
We would appreciate the opportunity to address your concerns directly before you contact the ICO, although this does not affect your right to approach the ICO.
31. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to The Compliance Register;
- new platform functionality;
- changes to our suppliers;
- changes to how we process information;
- changes to regulatory guidance; or
- changes to applicable legislation.
Where appropriate, significant changes will be brought to users’ attention through the website, platform or other appropriate communication.
The latest version will always state its effective date.
32. Contact Us
If you have questions about this Privacy Policy or how your personal information is processed, please contact:
The Compliance Register (IM Digital Systems LTD)
Email: info@thecomplianceregister.com
Address: Unit 3, Posterngate Farm, Harts Lane, South Godstone, Surrey. RH9 8LZ
Company number: 17097166
Privacy Policy version: 1.0
Effective date: 16 August 2026
Last reviewed: 16 August 2026
Next review date: 16 August 2027
