Privacy contact: privacy@keynetic.co.uk

Keynetic Privacy Policy

Version: 1.1 — Launch Draft Last updated: [DATE]

Keynetic helps homeowners, buyers, sellers and estate agents coordinate property moves and keep people involved in a property chain informed.

This Privacy Policy explains what personal information Keynetic collects, how we use it, who we share it with, how long we keep it, and the rights you have in relation to your information.

1\. Who we are

Keynetic is operated by:

[LEGAL COMPANY NAME — TBC following incorporation] [REGISTERED OFFICE — TBC following incorporation] Company number: [TBC following incorporation]

In this Privacy Policy, "Keynetic", "we", "us" and "our" refer to the organisation responsible for operating the Keynetic service.

For privacy and data-protection questions, contact:

privacy@keynetic.co.uk

2\. What Keynetic does

Keynetic provides a shared coordination platform for property moves.

The platform allows people involved in a property transaction to:

  • create or join a property chain;
  • see relevant information about connected properties and participants;
  • receive updates about the progress of a move;
  • connect participants in the chain;
  • receive invitations to join a chain;
  • allow participating estate agents to coordinate properties and transactions; and
  • receive transactional communications relating to their account or property chain.

Keynetic is not a replacement for an estate agent's CRM or other professional systems. It provides a shared coordination layer between participants in a property chain.

3\. Information we collect

The information we collect depends on how you use Keynetic.

Account information

When you create an account, we may collect:

  • your name;
  • email address;
  • account type;
  • authentication and account identifiers;
  • information required to maintain your account; and
  • records of your acceptance of relevant terms and policies.

Property and transaction information

When you create or participate in a property move, we may process:

  • property address information;
  • postcode;
  • property and chain identifiers;
  • your position within a property chain;
  • relationships between properties in a chain;
  • transaction or move status;
  • structured progress updates;
  • dates and timestamps associated with activity; and
  • information identifying participating users, estate agents, companies or branches.

Some information about other properties may be restricted depending on your position and participation in the chain.

Certain property information may therefore be redacted where a participant is not entitled to see it.

Estate-agent information

Where an estate agent uses Keynetic, we may process:

  • estate-agent contact details;
  • company and branch information;
  • staff and user account information;
  • property assignments;
  • chain participation;
  • subscription and billing information; and
  • records of activity performed through the platform.

Invitation information

When someone invites another person to participate in a Keynetic property chain, we may process:

  • the invited person's email address;
  • invitation name where supplied;
  • invitation status;
  • invitation expiry and related timestamps;
  • invitation identifiers and securely stored invitation token information; and
  • records relating to the invitation.

Communications information

Keynetic sends transactional emails such as account, invitation and service-related notifications.

We may retain information about those communications, including:

  • recipient email address;
  • message or template type;
  • delivery/provider identifiers;
  • timestamps;
  • delivery or processing status; and
  • limited error or provider information.

Keynetic does not provide an arbitrary user-to-user messaging or chat facility.

Users cannot use Keynetic's activity system to send unrestricted free-text messages to other participants. Progress information is based on structured updates and predefined options.

4\. Information we receive from other people

Some information may be provided to us by someone other than you.

For example, a person participating in a property chain may invite you to join Keynetic and provide your email address for that invitation.

In these circumstances, we may receive information such as:

  • your name;
  • your email address;
  • invitation information;
  • information about the relevant property chain; and
  • information necessary to establish or maintain the invitation.

The source of this information may therefore be another Keynetic user, an estate agent or another organisation participating in the relevant property transaction.

Where required, we will provide you with the applicable privacy information when we first communicate with you or within the applicable legal timeframe.

5\. Address lookup

Keynetic may provide address-search functionality to help users enter property addresses.

We use Ideal Postcodes to provide address lookup services.

A search may involve sending address or postcode search information to the address lookup provider.

Where an address is selected, the resulting property address may subsequently be stored as part of the relevant Keynetic property record.

Address information is therefore treated as property and transaction information within Keynetic.

6\. How we use personal information

We use personal information where necessary to operate Keynetic, provide its services and protect the platform.

Depending on the circumstances, this includes:

Providing the service

To:

  • create and manage accounts;
  • authenticate users;
  • create and connect property chains;
  • coordinate participants;
  • maintain property and chain information;
  • provide estate-agent functionality;
  • send invitations; and
  • provide transactional service communications.

Security and abuse prevention

To:

  • protect accounts;
  • prevent unauthorised access;
  • detect and prevent abuse;
  • apply rate limits;
  • investigate security incidents; and
  • maintain the security and integrity of the platform.

Billing and subscriptions

For estate-agent subscriptions, to:

  • establish subscriptions;
  • process payments;
  • maintain subscription status;
  • administer founding and standard subscription arrangements;
  • communicate about billing; and
  • maintain appropriate billing records.

Payments are processed using Stripe.

Legal and regulatory purposes

We may process information where necessary to:

  • comply with applicable legal obligations;
  • respond to lawful requests;
  • establish, exercise or defend legal claims;
  • investigate suspected fraud or misuse; or
  • maintain appropriate records.

Platform analytics and improvement

We may analyse information generated through the Keynetic platform to understand how property transactions progress and to improve the service.

This may include analysis of:

  • time spent at particular transaction stages;
  • common points at which chains experience delays;
  • points at which chains fail or collapse;
  • patterns across regions, towns or other geographic areas;
  • patterns across participating estate-agent branches;
  • expected transaction timelines; and
  • other measures that help us understand and improve property-chain coordination.

Where practical, we will seek to use aggregated, anonymised or otherwise minimised information for these purposes and apply appropriate safeguards to analytical datasets.

We may develop analytical models to support features such as chain confidence and expected transaction timelines. Any material new use of personal information will be assessed before being introduced and, where required, this Privacy Policy will be updated.

7\. Lawful bases for processing

Where UK data-protection law applies, we rely on one or more lawful bases for processing personal information.

The basis depends on the purpose for which the information is being processed.

Contract

We may process information where it is necessary to provide Keynetic services to you or to take steps at your request before entering into an agreement.

This may include account creation, authentication and provision of relevant Keynetic functionality.

Legitimate interests

We may process information where necessary for our legitimate interests, or those of another relevant party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

  • providing and operating the Keynetic platform;
  • maintaining platform security;
  • preventing fraud, misuse and unauthorised access;
  • maintaining service reliability;
  • administering accounts;
  • protecting users and Keynetic;
  • maintaining appropriate operational records; and
  • improving the security and effectiveness of the service.
  • analysing platform activity to understand and improve property-chain coordination; and
  • developing and improving platform functionality, including analytical models and estimates of transaction progression.

Where we rely on legitimate interests, we consider the impact of the processing on the individuals concerned and whether their interests or fundamental rights override those interests.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Consent

Where we rely on consent, we will request consent appropriately and explain how it can be withdrawn.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

8\. Property chains and information about other participants

A central feature of Keynetic is that property-chain participants need to see relevant information about the chain in order to coordinate a move.

If you join a property chain, information associated with that chain may therefore be visible to other participants who are entitled to access it.

Access is controlled according to participation in the chain and, where relevant, estate-agent assignment.

We do not provide unrestricted access to all information simply because a person has a Keynetic account.

Certain property information may be redacted depending on the participant's position and access rights.

9\. Estate agents and other organisations

Estate agents and other organisations may use Keynetic as part of their own business activities. Those organisations remain responsible for their own processing of personal data for their own purposes.

Keynetic independently operates the shared property-chain platform and determines the purposes and means of processing required to provide, secure, maintain and improve that platform.

This includes operating property chains, managing access and visibility between authorised participants, maintaining platform security, managing the lifecycle of information held within the platform, and analysing information to improve Keynetic and develop platform-level insights.

An estate agent's use of Keynetic does not make Keynetic simply an extension of the estate agent's own systems or database. Keynetic operates as an independent platform.

Estate agents remain responsible for their own processing activities outside Keynetic, including information they collect and use for their own estate agency business.

A property chain may continue to operate even where an estate agent stops using Keynetic or its subscription ends. Where this occurs, Keynetic may continue to process information necessary to operate the shared chain for authorised participants, subject to the applicable lifecycle, retention and data protection requirements described in this Privacy Policy.

10\. Who we share information with

We use selected service providers to operate Keynetic.

Our current Production service providers include:

Supabase

Used for:

  • authentication;
  • database services; and
  • core application data.

Vercel

Used for:

  • application hosting;
  • application delivery; and
  • server-side application infrastructure.

Resend

Used for:

  • transactional email delivery.

Stripe

Used for:

  • estate-agent subscription billing and payment processing.

Ideal Postcodes

Used for:

  • property address lookup.

Upstash

Used for:

  • security-related rate limiting of privileged privacy-administration operations.

Upstash is not used as Keynetic's primary property or chain database.

We may add or replace service providers where reasonably necessary to operate the service. Where required, we will update our relevant privacy or subprocessor information.

Sentry is not currently enabled for Keynetic's Production environment.

11\. International transfers

Some of our service providers or their infrastructure may involve processing personal information outside the United Kingdom.

Where applicable, we use an appropriate lawful transfer mechanism and safeguards required under applicable data-protection law.

Depending on the provider and service used, this may include:

  • an applicable adequacy decision;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to EU Standard Contractual Clauses; or
  • another legally recognised transfer mechanism.

Information about relevant providers and their applicable transfer arrangements will be maintained in Keynetic's subprocessor and compliance records.

12\. How long we keep information

We retain different categories of personal information for different periods depending on why we hold it, our operational requirements and applicable legal obligations.

We do not retain personal information indefinitely without a reason to do so.

Our detailed retention periods and the criteria used to determine them are set out in our Data Retention Schedule.

In general:

  • active account information is retained while the account remains active;
  • property and chain information is retained for as long as it is operationally required;
  • certain email information is automatically minimised after defined periods;
  • expired invitation information is subject to retention and minimisation controls;
  • billing and commercial records may need to be retained for longer periods;
  • information needed for legal, security, fraud-prevention or regulatory purposes may be retained for the relevant period; and
  • genuinely anonymised information may be retained where it can no longer be linked to an identifiable person. Where information is used for platform analytics or modelling, we will seek to minimise the personal information included in analytical datasets and, where appropriate, use aggregated, anonymised or pseudonymised information.

13\. Automated retention

Keynetic operates automated retention processes for certain categories of information.

These processes can:

  • minimise identifiable email-event information;
  • delete eligible already-redacted email-event records;
  • minimise billing email recipient information;
  • minimise eligible expired invitation information; and
  • maintain an operational audit record of retention jobs.

These automated processes do not mean that every category of Keynetic information is automatically deleted after the same period.

Where you exercise a data-protection right, that process is separate from normal operational retention.

14\. Data required to use Keynetic

Some personal information is necessary for us to provide particular Keynetic services.

For example, an email address may be required to create or authenticate an account, send an invitation or provide certain transactional communications.

If you do not provide information that is necessary for a particular function, we may be unable to provide that function or complete the relevant transaction.

Where information is required because of a legal or contractual requirement, we will explain this where appropriate.

15\. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to:

  • access your personal information;
  • have inaccurate personal information corrected;
  • request erasure;
  • request restriction of processing;
  • object to certain processing;
  • receive certain personal information in a portable format; and
  • withdraw consent where processing relies on consent.

These rights are not absolute and may be subject to legal exceptions.

Your right to object

You have a right to object to certain processing where we rely on legitimate interests as our lawful basis.

You may contact us at:

privacy@keynetic.co.uk

We will consider your objection in accordance with applicable data-protection law.

16\. Right to erasure

You can ask us to erase personal information where the applicable legal requirements are met.

Keynetic maintains processes for handling erasure requests.

Erasure is different from normal lifecycle management of property-chain information.

For example, information may be archived or anonymised as part of normal operational lifecycle management without that necessarily constituting a response to a formal right-to-erasure request.

Where erasure is required, we will apply the relevant process and consider information held by relevant service providers where applicable.

Some information may need to be retained where required or permitted by law, including certain records needed for legal, security, fraud-prevention, accounting or regulatory purposes.

17\. Automated decision-making

Keynetic does not currently make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects.

Keynetic may in future use analytical models to provide estimates or indicators relating to property-chain progression, such as expected timelines or chain confidence. These are intended to support users' understanding and coordination of a transaction and are not intended to determine an individual's legal rights or access to essential services solely through automated processing.

Keynetic may use automated processes for operational purposes, such as:

  • applying access controls;
  • enforcing security controls;
  • managing property lifecycle states;
  • applying retention rules; and
  • preventing excessive or abusive requests.

These operational processes are not intended to make decisions about an individual's legal rights or otherwise produce similarly significant effects solely through automated processing.

18\. Security

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

  • authenticated access;
  • role and participation-based access controls;
  • database-level security controls;
  • protected server-side credentials;
  • restricted privileged operations;
  • rate limiting;
  • security monitoring;
  • controlled administrative access;
  • secure transactional communications; and
  • lifecycle and retention controls.

No internet-based service can guarantee absolute security. We continually review and improve our security measures as the service develops.

19\. Cookies and similar technologies

Keynetic uses cookies and similar browser-storage technologies where necessary to operate parts of the service.

These technologies may be used for:

  • authentication and session management;
  • maintaining workflow state;
  • invitation-related workflows; and
  • other functionality necessary to operate the service.

Keynetic does not currently operate a Production marketing analytics or advertising-cookie programme.

Further information is provided in our Cookies and Similar Technologies Policy.

20\. Children's information

Keynetic is intended for adults involved in property transactions and estate-agent professionals.

We do not knowingly seek to collect personal information from children.

If you believe that a child has provided personal information to Keynetic, please contact:

privacy@keynetic.co.uk

21\. Third-party websites and services

Keynetic may contain links or integrations to third-party services.

Those services operate under their own terms and privacy policies.

This Privacy Policy does not govern how an independent third party processes information once you leave Keynetic or interact directly with that third party.

22\. Complaints

If you have concerns about how Keynetic has handled your personal information, please contact us first:

privacy@keynetic.co.uk

You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO).

We encourage you to contact us first so that we have an opportunity to address your concern, but you are entitled to contact the ICO directly.

23\. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • changes to Keynetic;
  • changes to our use of personal information;
  • changes to service providers;
  • legal or regulatory developments; or
  • improvements to our policies and procedures.

When we make material changes, we will take appropriate steps to bring them to your attention.

The latest version will be made available through the Keynetic website.

24\. Contact us

For privacy and data-protection questions:

Email: privacy@keynetic.co.uk

Keynetic [LEGAL COMPANY NAME] [REGISTERED OFFICE ADDRESS] [COMPANY NUMBER]