Privacy Policy

1. Who we are

SECTION20 is operated by Fixshtel Ltd, a company registered in the United Kingdom. Contact us at info@fixshtel.co.uk.

2. What personal data we handle

Three categories:

• Your account data — the email address you sign up with, authentication metadata (sign-in timestamps, session tokens), and any organisation name or signatory name you enter for your notice branding.
• Consultation data you enter — property name and address, cost figures, works descriptions, statutory dates, uploaded logo.
• Leaseholder personal data you enter — names, flat or unit numbers, addresses for service, and (optionally) email addresses. We ask for nothing else about leaseholders: no date of birth, no financial data, no correspondence content.

3. Controller and processor

For leaseholder data: our customer (the block manager, freeholder, RMC or agent using the tool) is the data controller. They decide who to add, why and when. SECTION20 acts as a processor, storing and processing that data solely on the customer's instructions for one purpose — generating Section 20 notices and maintaining the service and audit log.

For account data: Fixshtel Ltd is the controller.

We do not use leaseholder data for marketing, we do not sell it, and we do not contact leaseholders. Ever.

4. Legal basis

Our customers rely on their own lawful basis to process leaseholder data — typically the legal obligation to consult under the Landlord and Tenant Act 1985, or a legitimate interest in serving statutory notices. By entering leaseholder data into SECTION20, our customer confirms they have that lawful basis.

For your account data we rely on the contract with you to provide the service.

5. Sub-processors

We use a small number of specialist providers to run the service:

• Supabase — hosts the database, authentication and file storage for uploaded logos. Data is stored in Supabase's UK/EU region.
• Stripe — processes the one-off £39 payment when you unlock a consultation. Card details are entered on Stripe's own hosted checkout; we never see or store card numbers. Stripe receives your email and the consultation reference only.
• Email delivery provider — used only when you choose to email a notice from within SECTION20. If no email provider is configured on your account, no email data leaves our systems.

Each provider is bound by its own data processing terms. We use each of them only for the narrow purpose above.

6. Where the data lives

The database and uploaded files are hosted in the UK/EU. Stripe processes payments internationally under standard contractual protections. We do not sell or transfer your data outside of these providers.

7. Retention and deletion

We keep your data for as long as you keep it in your account, because the value of the tool is the audit trail. There is no automatic expiry.

You can permanently delete a single consultation at any time from its detail page — this removes the consultation record and every leaseholder entry, notice and service log record attached to it. You can permanently delete your entire account from Settings — this removes everything belonging to you, including uploaded logos.

Deletion is permanent and we cannot restore it. If a consultation may be needed as evidence at a First-tier Tribunal (Property Chamber), export or download the PDF and service log before deleting. Retaining tribunal evidence is your responsibility as the controller.

Encrypted backups are held by our hosting provider for a short rolling window (typically up to 30 days) before being overwritten.

8. Your rights

Under the UK GDPR you can ask us to:

• Tell you what personal data we hold about you and give you a copy (right of access).
• Correct anything that is wrong (right of rectification).
• Delete your account and everything associated with it (right of erasure) — available directly in Settings.
• Give you a portable export of your account and consultation data (right of portability).
• Object to, or restrict, how we process your data.

If your request concerns leaseholder data that one of our customers entered, we will forward it to that customer — they are the controller and must handle the request. We will support them in doing so.

9. Cookies

We use only strictly necessary cookies to keep you signed in and to remember your session. We do not run advertising cookies, tracking pixels, or third-party analytics that profile visitors. Because we use no non-essential cookies, no consent banner is required or shown.

10. Security

Data in transit is protected by HTTPS. Data at rest is protected by our hosting provider's standard encryption and access controls. Access to your data is scoped to your account only — other SECTION20 customers cannot see it.

11. Contact and complaints

For any privacy question or to exercise a right above, email info@fixshtel.co.uk. If you're unhappy with how we've handled a request, you have the right to complain to the Information Commissioner's Office at ico.org.uk.