Privacy Policy
1. Who we are
SupportedHousingOS is a product of Yantrium Ltd ("we", "us", "our"), a company registered in England & Wales (company number [COMPANY NUMBER]), registered office [REGISTERED OFFICE ADDRESS].
For any data protection matter, contact our data protection lead at privacy@yantrium.co.uk. Where required, our registration with the Information Commissioner's Office (ICO) is number [ICO REGISTRATION NUMBER].
2. Controller and processor — two roles
We handle personal data in two distinct roles:
- As controller — for the personal data of people who visit our website, make an enquiry, or hold an account with us (typically staff at our customer organisations). This policy governs that data.
- As processor — for the personal data that our customers (housing and support providers) enter into the platform about their residents, staff and contacts. In that case the customer is the controller and decides why and how that data is used; we process it only on their documented instructions under a written data processing agreement that meets Article 28 of the UK GDPR. If you are a resident or member of staff of one of our customers, please contact that organisation to exercise your rights; we will assist them in responding.
3. Personal data we collect (as controller)
- Identity & contact — name, work email, organisation, role, and anything you include in an enquiry.
- Account — sign-in details (passwords are stored only as a secure hash), and two-factor settings.
- Usage & technical — IP address, device/browser information, and log data needed to run and secure the service.
- Billing — the details needed to administer your subscription and invoices.
- Communications — messages you send us and our replies.
4. Why we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing and administering your account and the service | Performance of a contract |
| Securing the service, preventing abuse, keeping logs | Legitimate interests (running a secure service) |
| Responding to enquiries and support requests | Legitimate interests / steps prior to a contract |
| Sending service and, where relevant, product emails | Legitimate interests; consent where required |
| Billing, accounting and meeting legal duties | Legal obligation / performance of a contract |
Where we rely on legitimate interests, we have balanced those against your rights. Where we rely on consent, you may withdraw it at any time.
5. Special category data
The platform is designed for supported housing and may hold sensitive information about residents (for example, health, support needs or safeguarding information). We handle that data as a processor on behalf of our customer. The customer, as controller, is responsible for identifying an appropriate Article 6 lawful basis and Article 9 condition for that processing. We apply appropriate technical and organisational measures to protect it.
6. Cookies
We use only strictly necessary cookies to run the site and keep you signed in. See our Cookie Policy for details.
7. Who we share data with (sub-processors)
We do not sell personal data. We share it only with service providers who help us run the platform, under contracts that require them to protect it and use it only as instructed:
- Hosting & email — our infrastructure and transactional email are provided by Hostinger; data is stored in a database dedicated to this service.
- Professional advisers and authorities — where we are legally required to disclose, or to establish or defend legal claims.
A current list of sub-processors is available on request from privacy@yantrium.co.uk.
8. International transfers
We aim to keep personal data hosted in the UK or European Economic Area. If any transfer outside the UK is necessary, we put in place an appropriate safeguard recognised under UK data protection law (such as the UK International Data Transfer Agreement or Addendum, or an adequacy regulation).
9. How long we keep data
We keep account and website data for as long as your account is active and then only as long as we need it for the purposes above or to meet legal, accounting or reporting requirements, after which it is deleted or anonymised. Personal data we process on behalf of a customer is retained and deleted in line with our data processing agreement with that customer.
10. Security
We protect personal data with measures appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed passwords, access controls, per-customer data isolation, and regular updates. No system is perfectly secure, but we work to protect your information and will notify you and the ICO of a reportable personal data breach as required by law.
11. Your rights
Under UK data protection law you have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and to withdraw consent where we rely on it. To exercise a right, email privacy@yantrium.co.uk. We will respond within one month. If your data is held on behalf of one of our customers, we will pass your request to them.
12. Complaints
If you have a concern, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113.
13. Changes to this policy
We may update this policy from time to time. We will change the "last updated" date above and, where changes are significant, tell you.
14. Contact us
Yantrium Ltd — privacy@yantrium.co.uk (data protection) or hello@yantrium.co.uk (general).