BlockHub52 and your RTM or RMC company. Version 1.1, 14 October 2026
Your company decides what happens to the information about your building and your leaseholders. We run the software that holds it. The law calls your company the controller and us the processor. This agreement sets out what we promise to do with that information, as Article 28 of the UK GDPR requires.
The main points:
1.1 Us: Streamshare DM OÜ, a private limited company registered in Estonia (registry code 17039398), whose registered address is Ruunaoja tn 3, Lasnamäe district, 11415 Tallinn, Harju county, Estonia, trading as BlockHub52 (“we”, “us”, “our”).
1.2 You: the Right to Manage (RTM) company or Residents’ Management Company (RMC) that has a BlockHub52 account (“you”, “your company”).
1.3 This agreement forms part of our ‘Terms of Service’ (“Terms”). If this agreement and the Terms disagree about personal data, this agreement wins.
1.4 This agreement takes effect when someone acting for your company ticks the box at sign-up to agree to the Terms and this Data Processing Agreement. Both are linked next to the box. It applies from the first time personal data is entered into BlockHub52 for your company. We keep a record of who accepted, when, and which version. For the Handover Tracker, the RTM company is named on the ‘Set Up Your Building’ page. The agreement is accepted for that RTM company when the person setting up the building chooses ‘Save and continue’ on the ‘Set Up Your Building’ page, which agrees on the RTM company’s behalf. We record that acceptance again, with the company’s name and Companies House number. We email your company a link to a copy. If your company would like a signed version as well, ask us and we will provide one (see Signatures).
2.1 Data protection law means the UK GDPR and the Data Protection Act 2018 and, where it applies to us, the EU General Data Protection Regulation (EU GDPR).
2.2 Personal data, controller, processor, processing, data subject and personal data breach have the same meaning as in data protection law.
2.3 Customer personal data means the personal data we process for your company as your processor. Annex A describes it.
2.4 Sub-processor means another company we use that processes customer personal data for us. Annex C lists them.
2.5 Authorised users means the directors, members and other people your company gives access to BlockHub52.
3.1 Your company is the controller of customer personal data. We are your processor.
3.2 Your company is responsible for:
3.3 Please do not record health information or other sensitive personal data (called “special category data” in the law) in notes or uploads unless it is truly necessary.
3.4 We are also a controller for some personal data of our own, such as authorised users’ accounts, sign-in records and billing. Our ‘Privacy Policy’ covers that data, not this agreement.
3.5 When an authorised user’s sign-in is deleted, we delete the authorised user’s account under our ‘Privacy Policy’. Records your company keeps about what that person did stay with the building’s records and are deleted with them under clause 13. Reviews of the year end accounts keep the name of each director who gave a review. Signed minutes keep the name of the chair who signed the minutes. Budget approvals keep the name of each director who approved the budget. The change record keeps each change and when it was made, but no longer shows who made it.
4.1 Annex A sets out the subject matter, length, nature and purpose of the processing, the types of personal data and the people it is about.
5.1 We only process customer personal data on your company’s documented instructions. Your instructions are:
5.2 If a law we must follow (the law of the UK, or of the EU or Estonia where it applies to us) requires us to process customer personal data in another way, we will tell you before we do it, unless that law forbids us from telling you.
5.3 We will tell you straight away if we think an instruction breaks data protection law.
5.4 We will not sell customer personal data, use it for marketing, or use it for any purpose of our own.
6.1 We only let people access customer personal data when they need to, to run the service, fix a problem or deal with your request.
6.2 Everyone we allow to access it has agreed to keep it confidential, or is under a legal duty to do so.
7.1 We use appropriate technical and organisational measures to protect customer personal data, as Article 32 of the UK GDPR requires. We take account of current good practice, the cost, and the risks to the people the data is about.
7.2 Annex B lists our current measures. We may change them over time, but we will not lower the overall level of protection.
8.1 We use AI assistants (Anthropic’s Claude and OpenAI’s ChatGPT) to help build and maintain the software. We never put customer personal data into these AI assistants. Where our work with the AI assistants needs examples of people’s details, we use made-up test data. We have also switched off the settings that would let the AI assistants train on what we show them.
8.2 These assistants are not part of how BlockHub52 runs. The app does not send your data to them. Anthropic PBC and OpenAI are both based in the USA. When we say ChatGPT, this includes Codex, OpenAI’s coding assistant.
8.3 What the AI assistants see:
The AI assistants never see names, contact details, addresses, IP addresses, bank details, the contents of documents, or any record about a single person, such as one leaseholder’s record number or payments. Before we show an AI assistant an error message or a log, we remove any names, email addresses, IP addresses and record numbers of people from the error message or log. Checks of the live service are read only by default, and any change to live data needs approval from our management board member. When a fix needs to be checked against real records about people, our management board member does that check without the AI assistants.
8.4 Because the AI assistants do not receive customer personal data, they are not sub-processors and are not listed in Annex C. If we ever need an AI assistant to process customer personal data, we will first put a data processing agreement and a transfer safeguard in place, and tell you under clause 9.
9.1 Your company gives us general written permission to use sub-processors. The sub-processors we use now are listed in Annex C.
9.2 Each sub-processor is bound by a written contract with data protection terms that give at least the same protection as this agreement. We remain responsible to you for what our sub-processors do.
9.3 We will tell you by email at least 14 days before we add or replace a sub-processor. We will also update the list in Annex C.
9.4 You may object to a new sub-processor on reasonable data protection grounds before the change takes effect. We will talk it through with you. If you object and we cannot accommodate your objection, your company may end this agreement before the change takes effect, without penalty.
9.5 In an emergency, for example if a sub-processor fails or stops its service, or for a security reason, we may need to add or replace a sub-processor with less than 14 days’ notice. If so, we will tell you as soon as we can. Your right to object under clause 9.4 still applies.
10.1 Leaseholders and other people have rights over their data, such as the right to see it, correct it or have it deleted. Your company is responsible for answering these requests.
10.2 BlockHub52 lets your authorised users view, correct, download and delete most records themselves.
10.3 If we receive a request directly about customer personal data, we will pass it to your company within 5 working days. We will not answer it ourselves, other than to tell the person that we have passed it on.
10.4 Where your company cannot deal with a request using BlockHub52 itself, we will give reasonable help.
11.1 We will give your company reasonable help, based on the information we have, with:
11.2 We give this help at no extra cost. If a request would take an unusual amount of work, we will tell you first and agree it with you before we start.
12.1 If we become aware of a personal data breach affecting customer personal data, we will tell your company without undue delay, and in any case within 48 hours.
12.2 We will tell you what we know at the time, including:
If we do not know everything straight away, we will send the rest as soon as we find it out.
12.3 Your company decides whether to report the breach to the ICO and whether to tell the people affected. Under the UK GDPR, a report to the ICO must be made within 72 hours of your company becoming aware of the breach, where one is needed. We will help you.
12.4 We will not report a breach of customer personal data to a regulator, or contact the people affected, without your company’s agreement, unless the law requires us to.
12.5 We record every personal data breach in our incident log, including ones that are not reported to a regulator.
13.1 While your company uses BlockHub52, your authorised users can view your records in BlockHub52 and download your records, one item at a time or all together with ‘Download everything’. ‘Download everything’ gives a zip file of your building’s documents, leases, service charge demands, proofs of posting, compliance records, leaseholder records and, for an RTM company, the Handover Tracker (and, on the Autopilot plan, the accounts). If your company asks us in writing, we will also send your company a full copy of its data before the data is deleted.
13.2 Free. When your company’s 45 days of free use end without a subscription, a paid subscription ends, or the free 12 months of a first twelve place end without a subscription, your account moves to Free, as the Terms explain. We keep processing the customer personal data that Free uses (the building, flats, leaseholders and their addresses, the landlord’s details, directors’ sign-ins, the Handover Tracker and its files, and service charge demands) while the account stays open.
13.3 Records that are not part of Free. The other customer personal data becomes read only for 90 days, starting on the day after the last day of the 45 days of free use, of the paid subscription, or of the free 12 months of a first twelve place. We email your company’s directors who use BlockHub52 at least 14 days before the deletion. After the 90 days, we delete that data, unless your company subscribes first. If your company has asked us in writing, before then, to return a copy first, we delete the data once the copy has been sent.
13.4 Free accounts no director uses. If no director signs in to your company’s account for 12 months, the account becomes read only. We delete all customer personal data on the account 15 months after the last director sign-in. We email your company’s directors who use BlockHub52 10, 11 and 12 months after the last sign-in, and at least 14 days before the deletion. Any director signing in before the deletion stops the deletion.
13.5 Accounts whose 45 days of free use have not started. If your company’s 45 days of free use have not started 12 months after your account set up its first building, we may ask your company whether it still wants the account. We will not delete customer personal data in that case without emailing your company’s directors who use BlockHub52 at least 14 days before.
13.6 Deletion your company asks for. Your company’s directors can instruct us in BlockHub52, on the ‘Delete this account’ page, to delete a building’s records. Where the building has two or more directors who use BlockHub52, a second of those directors must confirm. We treat that confirmation as your company’s documented instruction. The records are read only for 30 days after the confirmation, so that your authorised users can download them, and we delete them on the day after the 30 days, unless a director stops the deletion first.
13.7 A dissolved company. If the Companies House register shows your company as dissolved, removed or closed, the processing for your company has ended. The building’s records are read only for 90 days, so that the people who were your company’s directors and use BlockHub52 can download them. We then delete the customer personal data. If the register shows your company as active again before the deletion, we stop the deletion.
13.8 Where this agreement gives a day for deleting data, we complete the deletion within 30 days after that day, as section 9.5 of the Terms says. Deleted data can remain in our backups until the backups are overwritten. Our database backups are overwritten on a rolling basis within 7 days. Copies of emails sent through BlockHub52 are kept by our email provider, Resend, for 30 days after sending, and are then deleted.
13.9 If a law requires us to keep any customer personal data for longer, we will keep only what the law requires, protect that data under this agreement, and use that data for nothing else.
13.10 We will confirm in writing that we have deleted the data if your company asks. Our confirmation gives the date the data was deleted from BlockHub52, and the date by which the data left our backups.
14.1 We will give your company the information it reasonably needs to check that we are keeping to this agreement. This includes this agreement, a description of our processing for your company, a summary of our security measures, our sub-processor list, and information our sub-processors publish about their own security.
14.2 If that information is not enough, your company, or an independent auditor bound by confidentiality, may audit our compliance with this agreement. You must give us at least 30 days’ notice. Audits take place during normal working hours and no more than once a year, unless a regulator requires one or there has been a personal data breach. Each side pays its own costs.
14.3 For our sub-processors, we rely on the reports and certificates they publish.
15.1 Customer personal data is stored in the UK, in London.
15.2 Some of our sub-processors are companies based in the USA, and one sends email through Ireland (see Annex C). We only allow customer personal data to be transferred outside the UK where the transfer is protected by one of these:
15.3 Where the EU GDPR applies to our processing, we rely on the EU’s adequacy decision for the UK, and on the matching EU safeguards for any other transfer.
15.4 We will not start sending customer personal data to a new country without a safeguard, and we will tell you first under clause 9.
15.5 The AI assistants described in clause 8 do not receive customer personal data, so no customer personal data is transferred to them.
16.1 The limits and exclusions of liability in section 7 of the Terms apply to this agreement, except that our total liability is limited to the fees your company paid us in the 12 months before the event giving rise to the claim, or £500, whichever is higher. This is one combined limit across the Terms and this agreement, not a separate one.
16.2 Nothing in this agreement limits any liability that cannot be limited by law, or the rights of individuals under data protection law.
17.1 This agreement lasts for as long as we process customer personal data for your company, including on Free. It ends when we have finished deleting that data under clause 13.
17.2 Clauses 6, 13, 16 and 19 continue to apply after it ends, as long as they are needed.
18.1 We may update this agreement to reflect changes in the law, guidance from the ICO, or changes to our sub-processors (using the process in clause 9).
18.2 We will email your company about important changes at least 30 days before they take effect. We will not make changes that lower the protection for customer personal data.
19.1 This agreement is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute, as in section 11 of the Terms.
20.1 Privacy contact: privacy@blockhub52.co.uk
20.2 Our UK representative (Article 27 UK GDPR): Prighter Ltd, 20 Mortlake High Street, London SW14 8JN
20.3 Regulators: in the UK, the Information Commission (the ICO, ico.org.uk). Because we are established in Estonia, our lead EU authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
Only needed if your company asks for a signed version as well as accepting online (see clause 1.4).
| For Streamshare DM OÜ (trading as BlockHub52) | For the customer company | |
|---|---|---|
| Name | Patricia Riedel | |
| Position | Member of the Management Board | Director |
| Company | Streamshare DM OÜ, registry code 17039398 | Company name and Companies House number: |
| Signature | ||
| Date |
| Item | Details |
|---|---|
| Subject matter | Providing the BlockHub52 software service to your company. |
| Length | For as long as your company uses BlockHub52, including on Free. Records that are not part of Free: 90 days read only after the 45 days of free use, a paid subscription or the free 12 months of a first twelve place end, then deletion. A Free account no director signs in to: deletion 15 months after the last sign-in. A deletion your company asks for: 30 days read only, then deletion. A dissolved company: 90 days read only, then deletion. See clause 13. |
| Nature | Receiving data typed in, imported or uploaded by authorised users; storing, organising, displaying and updating it; producing service charge demands, reminders and reports; matching bank statement lines to payments (bank reconciliation); sending emails; allowing downloads; and deleting data. Support access when a problem needs fixing or your company asks. On Free, keeping the service charge demands already made, so that they can be viewed and downloaded as PDFs. |
| Purpose | To let your company keep leaseholder records, issue service charge demands and record payments and arrears, run bank reconciliation, track compliance, store documents, run the Handover Tracker and produce the handover notice, schedule and letters, and send reminder and notification emails. |
| Automated decisions | None with a legal or similarly significant effect on anyone. The app suggests matches and reminders; authorised users decide. |
| How often | Continuously while your company uses BlockHub52. |
People the data is about (data subjects)
Types of personal data
| Area | Personal data |
|---|---|
| Leaseholder records | Name, email, phone, correspondence address, ownership start and end dates, notes |
| Service charge demands, payments and arrears | Amounts demanded, payments received, balances, arrears history, demand notices |
| Bank reconciliation | Bank statement lines (names and references in descriptions), amounts, dates |
| Building bank account | Account name, bank, sort code, account number |
| Freeholder contacts | Name, role, email, phone, correspondence address |
| Compliance records and documents | Responsible person, notes, uploaded certificates and reports |
| Year end accounts review, signed minutes and budget approvals | The name of each director who reviewed the year end accounts, with the answer, any comments and the date; the name of the chair who signed the minutes, and the date; and the name of each director who approved a budget, and the date |
| Reminder and notification emails | Name, email address, content of the email |
| Handover Tracker | Names and contact details of the landlord and any managing agent; the handover notice, schedule and letters; which records were received and when; documents received at handover |
| Change record | Which authorised user made each change, and when. If that user’s sign-in is deleted, the change stays but no longer shows who made it. |
Special category data and criminal offence data: none is intended. Free text notes and uploaded documents could contain it if authorised users add it (see clause 3.3).
Higher risk data: arrears history shows people’s financial behaviour, so we treat it with extra care.
How long the data is kept: For as long as your company keeps it in BlockHub52, including on Free. Records that are not part of Free are read only for 90 days after the 45 days of free use, a paid subscription or the free 12 months of a first twelve place end, and are then deleted. A Free account no director signs in to is deleted 15 months after the last sign-in. A deletion your company asks for takes effect 30 days after it is confirmed. A dissolved company’s records are deleted after 90 days. Backups are overwritten within 7 days. Clause 13 has the details. The change record is kept as part of your building’s records. The IP address and browser details attached to the change record are removed after 12 months.
Where the data is held
Encryption
Access controls
Staff access
Records and monitoring
Backups and recovery
Deletion and export
Incidents
Suppliers
| Sub-processor | What it does | Where the data is held | Transfer safeguard |
|---|---|---|---|
| Supabase Inc (USA) | App database, sign-in, file storage and backups | London, UK (Amazon Web Services, eu-west-2) | Data stored in the UK. Supabase is not on the EU-US Data Privacy Framework list: EU Standard Contractual Clauses with the UK Addendum in Supabase’s data processing agreement, which forms part of Supabase’s terms and applies automatically (checked 19 September 2026) |
| Vercel Inc (USA) | Hosts and runs the app, including the daily reminder job | London, UK (Vercel London region). Vercel account and support data is held in the USA | EU-US Data Privacy Framework with the UK Extension (active, checked 17 September 2026), plus Standard Contractual Clauses in Vercel’s data processing agreement |
| Namecheap Inc (USA) | Business email: receives and stores the support emails your company sends us | USA | UK Standard Contractual Clauses in Namecheap’s data processing agreement (accepted) |
| Resend: Plus Five Five, Inc. (USA) | Sends app emails, including service charge demands, reminders and notifications | Ireland (Amazon Web Services email service, eu-west-1) | Ireland: UK adequacy regulations. Resend is a US company: EU-US Data Privacy Framework with the UK Extension (active, checked 19 September 2026), plus EU and UK Standard Contractual Clauses in Resend’s data processing agreement, which applies automatically when Resend’s terms are accepted |
Supabase and Resend use Amazon Web Services for hosting. Supabase also uses Cloudflare. These are covered by their own agreements with Supabase and Resend.
Not sub-processors: the AI assistants from Anthropic PBC (Claude) and OpenAI (ChatGPT and Codex) described in clause 8, which do not receive customer personal data.
The BlockHub52 Newsletter
I write about the things that are important to directors of self-managing blocks in England and Wales. Service charges, Section 20, reserve funds, the compliance calendar.
The newsletter is in plain English with no jargon. It is written to help directors without accounting or legal expertise manoeuvre around the legal and financial side of running a building, and it always points at the legislation behind it so you can check for yourself.
We use essential cookies to keep the site working. No tracking or advertising cookies. Privacy Policy