Privacy policy

Keys2 is a software platform for UK estate and lettings agencies, built and operated by Pixtech Ltd, a company registered in England and Wales (company number [company number]) with its registered office at [registered office address]. In this policy, “Keys2”, “we”, “us” and “our” mean Pixtech Ltd.

We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number]. For any question about this policy or your personal information, email hello@keys2.io.

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) we act in two different capacities, depending on whose information it is.

Where we are the controller

We decide how and why personal information is used for: visitors to our website, people who request a demo or contact us, and the agency staff who hold Keys2 accounts (including billing and account administration). This policy mainly describes that processing.

Where we are a processor for an agency

Agencies use Keys2 to manage their own records, which include personal information about landlords, tenants, applicants, buyers, vendors, contractors and other contacts, including documents they upload and documents people sign through Keys2. For that information the agency is the controller and we process it only on the agency’s instructions, under our agreement with them. Each agency’s data is kept separate from every other agency’s. If your information is held by an agency that uses Keys2, please contact that agency about it; if you contact us, we will pass your request to them.

When you visit our website

• Technical information sent by your browser, such as your IP address, browser and device type and the pages you request. Our hosting and security providers process this to deliver the site and protect it from abuse.
• Analytics about how you use the site (pages viewed, how you arrived, approximate location from your IP address), only if you accept analytics cookies. See our cookie policy.
• Whether a visit or demo request came from one of our adverts, only if you accept marketing cookies.

When you book a demo or contact us

• Your name, email address and (optionally) phone number, your agency’s name and location, portfolio size, the lettings models you run, your current software and any message you send.
• How you found us: your answer to “How did you hear about us?”, and which advert, post or link brought you to our website (the campaign tags in the web address, such as “utm_source”, any ad click identifier, the site that linked to us and the first page you visited), so we know which of our campaigns work.
• The content of any emails or calls between us.

When you create or use a Keys2 account

• Your name, email address and password (stored only in hashed form by our authentication provider), your agency’s name, your role and the plan and modules you choose.
• Security records: sign-in times, IP addresses and failed sign-in attempts, which we use to protect accounts (for example, locking an account after repeated failed attempts).
• A record of actions taken in your agency’s workspace (for example, who created or changed a record), which forms the agency’s audit trail.

Payments

Subscriptions are paid through Stripe. Your card details go directly to Stripe; we never see or store your full card number. We keep your subscription status, plan, billing contact details and invoice history.

We only use personal information where the law allows. The table sets out what we do and the lawful basis we rely on.

We do not sell personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

We use trusted suppliers to run Keys2. They act as our processors, may only use the information to provide their service to us, and are bound by contracts that protect it.

We may also share information with our professional advisers (such as lawyers and accountants), with authorities where the law requires it, and with a buyer or successor if our business or its assets are ever sold, in which case this policy would continue to protect your information.

Our database and file storage are hosted in [database hosting region]. Some of our suppliers, or their own sub-processors, process information outside the UK, including in the United States. Where that happens we make sure the transfer is protected as UK law requires: the destination is covered by UK “adequacy regulations” (including the UK-US data bridge, where the supplier is certified), or we rely on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We keep personal information only as long as we need it:

• Demo requests and enquiries: up to 24 months after our last contact with you, unless you become a customer.
• Account and workspace data: for as long as your agency’s subscription is active. When an agency leaves, we delete its workspace data after giving it the chance to export it; copies in our backups are overwritten in the normal backup cycle.
• Billing and invoice records: six years after the end of the financial year they relate to, as UK tax and company law requires.
• Security logs: up to 12 months, unless needed longer to investigate an incident.
• Analytics: under Metricool’s retention settings, and only where you consented.

We protect personal information with measures that include encryption in transit, strict separation of each agency’s data enforced in the database itself, role-based access within each agency, private storage for uploaded documents with short-lived access links, bot protection on public forms, account lockout after repeated failed sign-ins and regular automated backups. No system is completely secure, but we work to keep your information safe and will tell you and the ICO about a breach where the law requires us to.

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it, or object to our using it (including for marketing);
• ask us to transfer information you gave us to you or another organisation; and
• withdraw your consent at any time, where we rely on it.

To use any of these rights, email hello@keys2.io. We may need to confirm your identity, and we will reply within one month. Some rights depend on circumstances; if we cannot do what you ask, we will explain why. If your information is held by an agency that uses Keys2, please contact the agency directly.

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Keys2 is a business service for estate and lettings agencies. It is not aimed at children, and we do not knowingly collect information from anyone under 18 for our own purposes.

We may update this policy as Keys2 changes. The date at the top shows when it was last updated. If a change significantly affects how we use your information, we will tell account holders by email or in the app.

Pixtech Ltd, [registered office address]. Email: hello@keys2.io.