Privacy Policy
Last updated: 12 April 2026
1. Who we are
Greenco Block Management Ltd(“Greenco”, “we”, “us”) is a block management company registered in England and Wales (Company No. 14279102). We are the data controllerfor personal data processed through this platform and the resident portal. We are registered with the Information Commissioner’s Office (ICO registration: ZB609207).
Contact us about data matters: info@greenco.co.uk
2. What data we collect
- Identity data: full name, email address, phone number
- Property data: unit number, building, lease/tenancy details
- Financial data: service charge demands, payment records (amounts and dates; we do not store bank card details)
- Communications: tickets, maintenance requests, correspondence with our team
- Usage data: pages visited in the resident portal, login timestamps
- Device data: IP address, browser type (for security and fraud prevention)
3. Legal bases for processing (UK GDPR)
| Processing activity | Legal basis |
|---|---|
| Managing your lease, service charges, and maintenance | Performance of a contract (Art. 6(1)(b)) |
| Legal compliance (RTM, Section 20, Companies House) | Legal obligation (Art. 6(1)(c)) |
| Resident portal access and ticket management | Legitimate interests (Art. 6(1)(f)) |
| Non-essential communications (newsletters, announcements) | Consent (Art. 6(1)(a)) |
| AI-assisted maintenance triage and staff assistance | Legitimate interests (Art. 6(1)(f)) |
4. AI processing
We use AI services (Anthropic Claude) to power our resident concierge and staff assistant tools. Data submitted to these tools may be processed by Anthropic as a data processor under a Data Processing Agreement. Anthropic does not use your data to train AI models under our enterprise agreement. We do not share your data with Anthropic beyond what is necessary to provide the service.
5. Who we share data with
- Supabase Inc. — database and authentication hosting (EU region, DPA in place)
- Vercel Inc. — platform hosting (EU region available, DPA in place)
- SendGrid / Twilio Inc. — email and SMS delivery (DPA in place)
- Anthropic PBC — AI processing (DPA in place)
- Plaid Inc. — bank account verification and payment processing (FCA regulated)
- Your freeholder or RTM company — as required to fulfil management obligations
- Contractors — name and contact details only, when necessary to carry out repair work
We do not sell your personal data. We do not use it for advertising.
6. How long we keep your data
- Financial records: 7 years (Companies Act / HMRC requirement)
- Maintenance records: 6 years after closure (limitation period for latent defect claims)
- Lease/tenancy records: duration of tenancy + 7 years
- Portal account data: until deletion requested, then within 30 days
- AI conversation logs: 90 days
7. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data (subject to legal retention requirements)
- Restriction — limit how we use your data while a dispute is resolved
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — at any time, for consent-based processing (e.g. marketing emails)
To exercise any of these rights, email info@greenco.co.uk or use the resident portal account settings. We will respond within 30 days.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8. Cookies
We use only essential cookies required for authentication and session management. We do not use tracking, analytics, or advertising cookies. Essential cookies cannot be disabled as they are required for the service to function.
9. Security
We protect your data using industry-standard measures including encryption in transit (TLS 1.2+), encryption at rest, access controls, multi-factor authentication for staff accounts, and regular security reviews aligned with Cyber Essentials v3.3.
10. Changes to this policy
We will notify portal users by email of material changes to this policy at least 14 days before they take effect. Minor updates (corrections, clarifications) will be reflected in the “Last updated” date above.