Privacy Policy

Last updated: 23 June 2026

This Privacy Policy explains how VeraHold Ltd (“VeraHold”, “we”, “us” or “our”) collects, uses, stores, protects and shares personal data when you visit our website, contact us, use our services, submit an enquiry, upload documents, request a report, subscribe to updates, make a payment or otherwise interact with us.

VeraHold is a company registered in England and Wales under company number 17289572, with its registered office at 145 City Road, The Atlas Building 1307, EC1V 1AX, London.

For the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, VeraHold will usually act as the data controller of the personal data described in this Privacy Policy. This means that VeraHold decides why and how personal data is processed.

In limited circumstances, where VeraHold processes personal data solely on behalf of a client under a separate written agreement, VeraHold may act as a data processor. Where this applies, the relevant client agreement or data processing agreement will govern that processing.

If you have any questions about this Privacy Policy or how VeraHold handles personal data, you can contact us at:

1. About VeraHold

VeraHold provides independent information, analysis, document review, benchmarking, reporting and related support for leaseholders, residents, RMC directors, RTM directors, share-of-freehold participants and other parties involved in residential leasehold blocks.

Our services may include reviewing and analysing documents such as leases, service charge budgets, service charge accounts, invoices, supplier contracts, insurance schedules, Section 20 notices, maintenance records, managing-agent communications, complaint histories and other property or block-management documents.

We may use technology, including AI-assisted tools, to help classify documents, extract information, compare costs, identify potential anomalies, summarise materials and prepare reports. Where appropriate, human review is used before client-facing outputs are finalised.

VeraHold does not sell personal data.

2. Personal data we collect

The personal data we collect depends on how you interact with us and which services you use.

2.1 Identity and contact data

We may collect:

• name;
• email address;
• telephone number;
• postal address;
• role or relationship to a property, block or organisation, such as leaseholder, resident, RMC director, RTM director, shareholder, landlord, managing agent, professional adviser or supplier;
• company or organisation name;
• communication preferences.

2.2 Enquiry, account and service data

We may collect:

• information submitted through website forms;
• emails, messages, calls and correspondence with us;
• details of services requested or purchased;
• onboarding responses and questionnaires;
• client instructions;
• report requests;
• support queries;
• feedback, comments, complaints or testimonials;
• internal notes relating to your matter or service request.

2.3 Property, leasehold and block data

Where you ask us to review or analyse documents, we may collect information relating to:

• property addresses;
• flat, unit, block or building information;
• service charge budgets and accounts;
• lease terms and property documentation;
• managing-agent details;
• freeholder, landlord, RMC, RTM or management company information;
• insurance schedules and policy information;
• supplier, contractor and maintenance information;
• reserve fund or sinking fund information;
• major works and Section 20 consultation documents;
• invoices, quotes, contracts and payment information relating to block services;
• correspondence between residents, leaseholders, directors, managing agents, landlords, freeholders, contractors or advisers;
• complaints, concerns, disputes or issue histories relating to building management.

Some documents may contain personal data about people who are not direct VeraHold clients, including other leaseholders, residents, directors, managing agents, suppliers, contractors or professional advisers.

2.4 Document and file data

If you upload, email or otherwise provide documents to us, we may process:

• file names;
• document contents;
• metadata associated with the document;
• extracted text and data;
• document summaries;
• document classifications;
• report outputs and analysis generated from those documents.

You should avoid sending us information that is irrelevant, excessive or unnecessarily sensitive.

2.5 Payment and billing data

We may collect:

• billing name and address;
• invoice information;
• payment status;
• payment references;
• subscription or payment plan information;
• limited payment information made available to us by payment processors.

Payments are processed through Stripe. VeraHold does not intend to store full payment card numbers or full card security details on its own systems.

2.6 Technical, website and usage data

When you visit or use our website or digital services, we may collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from technical data;
• pages viewed;
• referring website;
• dates and times of visits;
• click, navigation and interaction data;
• error logs;
• security logs;
• cookie and consent preferences.

2.7 Marketing and communications data

We may collect:

• newsletter or update preferences;
• marketing opt-in and opt-out records;
• email engagement information, where our tools provide this;
• records of unsubscribe requests;
• preferences relating to leasehold, property, product or regulatory updates.

2.8 Special category and sensitive personal data

We do not intentionally request special category personal data unless it is necessary for a specific service and we have a lawful basis to process it. Special category data includes information about health, ethnicity, religion, political opinions, trade union membership, genetics, biometrics or sexual orientation.

However, documents sent to VeraHold may occasionally contain sensitive information, for example in complaint records, dispute materials, vulnerability-related correspondence, accessibility requests, arrears discussions or resident communications.

Please do not upload sensitive personal data unless it is genuinely necessary for the service requested. Where we identify sensitive or special category data, we will apply additional care, restrict access where appropriate and process it only where lawful.

3. How we collect personal data

We may collect personal data directly from you when you:

• visit our website;
• complete a contact form;
• request a report;
• ask for a consultation or review;
• upload documents;
• email or message us;
• call us;
• subscribe to updates;
• pay for services;
• provide feedback;
• interact with us through our website, platform or business systems.

We may also receive personal data from:

• leaseholders, residents or RMC/RTM directors;
• managing agents;
• landlords, freeholders or their representatives;
• professional advisers;
• suppliers or contractors;
• payment providers;
• cloud storage, hosting, database and software providers;
• publicly available sources, such as Companies House, public registers, tribunal decisions, property-related materials and managing-agent websites.

Where you provide personal data about another person, you should ensure that you have a lawful basis or appropriate authority to do so and that the information is relevant to the service requested.

4. How we use personal data

We use personal data for the purposes described below.

4.1 To respond to enquiries

We use personal data to respond to messages, requests, questions, forms and communications.

Our lawful basis is usually legitimate interests or taking steps before entering into a contract.

4.2 To provide our services

We use personal data to provide document review, analysis, benchmarking, reporting, support, recommendations and related services.

Our lawful basis is usually performance of a contract, taking steps before entering into a contract, and legitimate interests.

4.3 To review and analyse documents

We may process uploaded or submitted documents to classify information, extract relevant data, identify issues, compare costs, produce summaries, create reports, prepare evidence packs and support client decision-making.

Our lawful basis is usually performance of a contract and legitimate interests.

4.4 To prepare reports and outputs

We may use personal data to produce client-facing reports, summaries, dashboards, findings, benchmark comparisons, issue lists, document reviews, evidence packs, challenge packs or recommendations.

Our lawful basis is usually performance of a contract and legitimate interests.

4.5 To operate, secure and improve our website and services

We may use personal data to maintain, test, secure, monitor, improve and develop our website, platform, reports, workflows, analytics, benchmarking methods and client experience.

Our lawful basis is usually legitimate interests. Where non-essential cookies or similar technologies are used, we will rely on consent where required.

4.6 To communicate with you

We may use personal data to send service messages, administrative updates, report updates, payment information, security notices, changes to our terms or policies and other important communications.

Our lawful basis is usually performance of a contract, legitimate interests or legal obligation.

4.7 To process payments and manage billing

We may use personal data to issue invoices, process payments, manage subscriptions, record transactions, deal with refunds or payment failures and maintain accounting records.

Our lawful basis is usually performance of a contract, legal obligation and legitimate interests.

4.8 To send newsletters, updates and marketing

Where permitted, we may send newsletters, leasehold updates, regulatory updates, product updates or marketing communications.

Our lawful basis may be consent, legitimate interests or the soft opt-in where applicable. You can unsubscribe at any time.

4.9 To protect VeraHold, clients and third parties

We may use personal data to prevent fraud, protect our systems, enforce our terms, investigate misuse, manage disputes, protect confidential information and defend legal claims.

Our lawful basis is usually legitimate interests and legal obligation.

4.10 To comply with legal obligations

We may process personal data to comply with company, tax, accounting, regulatory, data protection, legal or law-enforcement obligations.

Our lawful basis is legal obligation and, where relevant, legitimate interests.

4.11 To anonymise or aggregate information

We may anonymise or aggregate information so that it no longer identifies any individual. We may use anonymised or aggregated information for benchmarking, product development, internal analysis, market research, service improvement, business planning and reporting.

Once information has been properly anonymised, it is no longer personal data.

5. AI-assisted processing

VeraHold may use AI-assisted tools to support document classification, data extraction, summarisation, anomaly detection, cost comparison, benchmarking, workflow automation and report drafting.

We do not use AI tools to make solely automated decisions about individuals that produce legal or similarly significant effects without appropriate human involvement.

Where AI-assisted tools are used:

• we aim to minimise the personal data submitted to those tools;
• we restrict access to client documents and outputs;
• we review outputs where appropriate before they are used in client-facing materials;
• we do not intentionally use client-uploaded documents or personal data to train third-party foundation models unless there is a lawful basis, appropriate contractual protection and, where required, consent;
• we may use anonymised or aggregated information to improve our internal workflows, benchmarks, methods and services.

AI-assisted outputs may contain errors or require human interpretation. VeraHold’s use of AI is designed to support analysis and efficiency, not to replace professional judgement.

6. Client documents and third-party personal data

Our services may require us to process leasehold, property, management and building-related documents. These documents may include personal data about individuals who are not direct VeraHold clients.

This may include names, addresses, contact details, signatures, leaseholder information, director details, supplier contacts, professional adviser details, resident correspondence, complaint records or other information appearing in uploaded documents.

We ask clients to provide only documents and information that are reasonably necessary for the service requested. Where possible, clients should redact irrelevant personal data before uploading or sending documents to VeraHold.

We will use this information only for legitimate service-related purposes, including analysis, reporting, benchmarking, verification, security, legal compliance and record-keeping.

7. Security and confidentiality

VeraHold takes the security of client documents, company data and personal data seriously. We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

Our security measures may include, where appropriate:

• access controls and role-based permissions;
• multi-factor authentication for key systems;
• password management controls;
• encryption in transit and, where supported, encryption at rest;
• secure cloud storage and database infrastructure;
• restricted access to client files;
• confidentiality obligations for personnel, contractors and advisers;
• secure document handling procedures;
• data minimisation;
• retention and deletion controls;
• audit logs or activity records where available;
• supplier due diligence;
• contractual data protection obligations for processors;
• secure backup and recovery arrangements where appropriate;
• access reviews when personnel or contractors change role or leave;
• incident response procedures;
• internal policies and training.

No method of transmission, processing or storage can be guaranteed to be completely secure in all circumstances. However, VeraHold is committed to maintaining security measures appropriate to the nature of the data we process and the risks involved.

If we become aware of a personal data breach, we will investigate and take appropriate steps. Where legally required, we will notify the Information Commissioner’s Office and affected individuals.

8. Our core service providers

VeraHold uses trusted third-party service providers to operate its website, provide services, store documents, process payments, manage communications, secure systems and run business operations.

Our core service providers currently include (but are not necessarily limited to):

8.1 Stripe

We use Stripe to process payments, manage billing, support subscriptions where applicable and handle payment-related administration.

Stripe may process payment, billing, transaction and limited customer information in accordance with its own legal and privacy terms. VeraHold does not intend to store full payment card numbers or full card security details on its own systems.

8.2 Supabase

We use Supabase for cloud infrastructure, database functionality, file storage and related technical services.

Documents, uploaded files, account information, service data and platform-related data may be stored or processed using Supabase infrastructure.

8.3 Google Drive and Google Workspace

We use Google Drive / Google Workspace for internal file storage, document management, business email, collaboration, administrative records and secure internal workflows.

Client documents, reports, working files, internal notes, business records and administrative materials may be stored or processed using Google Drive / Google Workspace where appropriate.

9. Other parties we may share personal data with

In addition to our core service providers, we may share personal data with:

• website hosting providers;
• database and cloud infrastructure providers;
• document processing, OCR, AI, analytics and workflow tools;
• email, calendar and communication providers;
• customer support and CRM providers;
• accountants, lawyers, insurers, auditors and other professional advisers;
• contractors, consultants and service providers working for VeraHold;
• IT support and cybersecurity providers;
• payment, billing and subscription providers;
• regulators, courts, tribunals, public authorities or law-enforcement bodies where required or permitted by law;
• potential investors, buyers, lenders or business partners in connection with a proposed investment, financing, merger, acquisition, restructuring or sale of VeraHold or its assets, subject to appropriate confidentiality protections.

Where third parties process personal data on our behalf, we require appropriate contractual protections and expect them to process personal data only in accordance with our instructions, applicable law and relevant data protection terms.

We do not sell personal data.

10. International transfers

Some of the service providers we use, including Stripe, Supabase and Google Drive / Google Workspace, may process, store or access personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take steps designed to ensure that the data remains protected in accordance with applicable data protection law. These steps may include:

• using providers that offer appropriate data processing terms;
• relying on adequacy regulations where applicable;
• using the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or equivalent lawful transfer mechanisms where required;
• applying contractual, technical and organisational safeguards;
• limiting transfers to what is necessary for the relevant service;
• reviewing provider security and privacy information where appropriate.

You may contact us if you would like more information about the safeguards used for international transfers.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide services, comply with legal obligations, resolve disputes, enforce agreements and maintain business records.

Our typical retention periods are:

• Website enquiries: up to 2 years after the last interaction, unless a longer period is needed.
• Client account and service records: up to 6 years after the end of the client relationship.
• Reports, analysis files and uploaded documents: up to 6 years after the relevant service or client relationship ends, unless a shorter or longer period is appropriate.
• Invoices, payment and accounting records: generally 6 years from the end of the relevant financial year.
• Marketing records: until you unsubscribe or withdraw consent, plus a limited suppression record to ensure we respect your opt-out.
• Website analytics and technical logs: for a period appropriate to security, analytics and operational needs, usually between 12 and 24 months unless longer retention is required for security or legal reasons.
• Legal, complaint or dispute records: for as long as needed to manage the issue and comply with legal limitation periods.

We may retain anonymised or aggregated information indefinitely, provided it can no longer identify any individual.

12. Your data protection rights

Depending on the circumstances, you may have the following rights under UK data protection law:

• the right to be informed about how your personal data is used;
• the right of access to your personal data;
• the right to request correction of inaccurate or incomplete data;
• the right to request erasure of personal data;
• the right to restrict processing;
• the right to object to processing based on legitimate interests;
• the right to data portability;
• the right to withdraw consent where processing is based on consent;
• rights relating to automated decision-making and profiling.

These rights are not absolute and may be subject to legal exemptions. For example, we may need to retain certain information for legal, accounting, contractual, fraud-prevention, security or dispute-resolution reasons.

You have the right to object to processing based on legitimate interests. Where you object, we will consider your request and stop the relevant processing unless we have compelling legitimate grounds to continue or need the information for legal claims.

To exercise your rights, contact us at support@verahold.co.uk. We may need to verify your identity before responding.

13. Marketing communications

We may send marketing communications, newsletters, leasehold updates, regulatory updates, product announcements or similar communications where permitted by law.

You can opt out of marketing communications at any time by:

• clicking the unsubscribe link in our emails, where available; or
• contacting us at support@verahold.co.uk.

Opting out of marketing does not stop us from sending service-related messages, such as payment notices, report updates, security notices, contractual communications or important administrative messages.

14. Cookies and similar technologies

Our website may use cookies and similar technologies.

Cookies are small files placed on your device. They may be used to make the website work, remember preferences, improve performance, analyse usage, support security or enable marketing features.

We may use:

• strictly necessary cookies, which are required for the website or service to function;
• analytics cookies, which help us understand website usage and improve performance;
• preference cookies, which remember choices you make;
• security cookies, which help protect the website and our systems;
• marketing cookies, if used, which help measure or deliver marketing activity.

Where required by law, we will ask for your consent before placing non-essential cookies or similar technologies on your device.

15. Links to third-party websites

Our website, reports, emails or communications may contain links to third-party websites, platforms, resources, articles, payment providers or tools.

We are not responsible for the privacy practices, security or content of third-party websites. You should read their privacy policies before providing personal data to them.

16. Children’s data

Our services are not directed at children. We do not knowingly collect personal data from children through our website for marketing or general service purposes.

If we become aware that we have collected children’s data without an appropriate lawful basis, we will take steps to delete or restrict it where required.

17. Data accuracy

We rely on clients, users and third parties to provide accurate, complete and relevant information.

If you believe any personal data we hold about you is inaccurate or incomplete, please contact us at support@verahold.co.uk.

18. Data minimisation

We aim to collect and process only the personal data that is relevant and necessary for our services.

Clients should avoid uploading irrelevant, excessive or unnecessarily sensitive information. Where appropriate, we may ask clients to redact documents or provide reduced data sets. We may also delete, restrict or anonymise information that is not necessary for the relevant service.

19. Confidentiality of client documents

Documents submitted to VeraHold may contain confidential, commercially sensitive, financial, property-related or personal information.

We treat client documents as confidential and use them only for legitimate business and service-related purposes. Access to client documents is restricted to authorised VeraHold personnel, contractors, advisers or service providers who need access for a legitimate purpose.

We do not publish client documents or make them publicly available unless expressly authorised by the relevant client or legally required.

20. Data breaches and security incidents

If we identify a suspected or actual personal data breach, we will assess the nature, scope and likely impact of the incident.

Where appropriate, we will take steps to contain the issue, investigate what happened, reduce potential harm, restore security and prevent recurrence.

Where legally required, we will notify the Information Commissioner’s Office and affected individuals.

21. Complaints

If you have concerns about how VeraHold handles personal data, please contact us first at support@verahold.co.uk so we can try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office:

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, service providers or business operations.

The updated version will be posted on our website with a revised “Last updated” date. Where changes are material, we may take additional steps to notify users, such as by email or website notice.

23. Contact us

For questions about this Privacy Policy, personal data, privacy rights, security or data protection requests, contact: