ItBox Mobile App Privacy Policy
Last updated: 5th March 2025
Introduction
Welcome to ItBox LTD’s Privacy Policy. ItBox LTD respects your privacy and is committed to protecting your personal data. This Privacy Policy explains:
What data we collect and why.
How we use your data.
Your rights regarding your data.
For ease we may refer to this privacy policy as a “privacy policy”, “this policy” or “privacy notice” in the rest of this policy. We refer to ItBox as “we”, “us”, or “our” in the rest of this policy.
Please read the following carefully to understand our practices regarding your personal data and how we will treat it.
Changes to this privacy policy
We may update this Privacy Policy from time to time to reflect changes in legal requirements or our practices. If we make material changes, we will notify you via an in-app notice.
You may be required to read and acknowledge the changes to continue your use of the App or the Services.
Controller vs Processor roles
ItBox as a controller. This is when we decide how and why your personal data is used (e.g., when we communicate with you directly or manage your account).
ItBox as a processor. This is when we process personal data on behalf of landlords to support their compliance with the Building Safety Act, including providing certain aspects of the App. In these cases, landlords remain primarily responsible for how your personal data is used.
Our relationship with landlords and property owners
ItBox is dedicated to helping everyone navigate and simplify the challenges of maintaining safe buildings and helping the Principal Accountable Person (“PAP”) or Accountable Person (“AP”) to comply with changing legislation including the Building Safety Act.
Our clients are usually landlords or those with responsibilities under the Building Safety Act, PAP’s, AP’s or property managers (“RP”s). In the rest of this policy, we’ll refer to our clients as “landlords” for ease. When we help landlords with their compliance obligations (our “Landlord Services”), we are committed to protecting and respecting your privacy and personal data in compliance with applicable data protection laws including:
the United Kingdom General Data Protection Regulation (what we refer to as “UK GDPR” in the rest of this policy)
the Data Protection Act 2018
+ and all other mandatory laws and regulations of the United Kingdom.
When we process your personal data so we can provide our Landlord Services to a landlord, we are acting on the landlord’s behalf as their service provider and what is known as a “processor” under UK GDPR. As a processor, we’re not required to provide full details of how and why your personal data is used, that is the responsibility of the landlord. However, as we want to be as transparent as possible we have explained in the section below titled “Part B: Using your personal data as a processor on behalf of landlords” what we do with this personal data on landlords’ behalf. If you are a resident of a landlord you should also review the landlord’s privacy policy for full information about how your personal data is collected and used and that will take precedence over this policy.
Our relationship with you
As well as handling your personal data on behalf of your landlord in order to provide our Landlord Services to them, we may also handle your personal data on our own behalf as what is known as a “controller” under the UK GDPR. For example, we may use your personal data to communicate with you about updates to our App. For information about how we use personal data as a controller, please see the section of this Privacy Policy headed “Part A: Using your personal data as a controller.”
When we act as controller we are committed to protecting and respecting your privacy and personal data in compliance with applicable data protection laws.
Part A: Using your personal data as a controller
This privacy notice describes how we will collect, use, share and otherwise process your personal data in connection with your use of:
ItBox mobile application software (available on the Apple App Store or Google Play) (App).
Any of our services that are accessible through the App (Services), unless such Services state that a separate or additional privacy notice applies to a particular Service, in which case only that privacy notice applies.
This App is not intended for those under 16 and we do not knowingly collect data relating to children under that age. If we become aware that a child under 16 has provided us with personal data, we will take immediate steps to delete it.
This notice is provided in a layered format so you can click through to the specific areas set out below.
[IMPORTANT INFORMATION AND WHO WE ARE]
[THE DATA WE COLLECT ABOUT YOU]
[HOW IS YOUR PERSONAL DATA COLLECTED?]
[HOW WE USE YOUR PERSONAL DATA]
[DISCLOSURES OF YOUR PERSONAL DATA]
[DESCRIPTION OF CATEGORIES OF PERSONAL DATA]
Important information and who we are
We have appointed a data privacy manager. If you have any questions about this privacy notice, please contact them using the details set out below.
Contact details
Our full details are:
Full name of legal entity: ItBox Ltd
Name or title of data privacy manager: Charles Seifert
Email address: charles@itboxhub.co.uk
Postal address: 33 Broadwick Street, London W1F 0DQ
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues..
Your duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you. Please visit the “Setting” section of your Account in the App to update your details.
Third party links and sites
Our App and Services may, from time to time, contain links to and from the websites of third parties, such as other service providers of the landlord (e.g. property managers or building portal providers). Please note that these websites (and any services accessible through them) are controlled by those third parties and are not covered by this privacy notice. You should review their own privacy notices to understand how they use your personal data before you submit any personal data to these websites or use these services.
The data we collect about you
We collect, use, store and transfer different kinds of personal data about you only when necessary. To make it easier for you to use this privacy notice, we group these into the following categories. Each of these categories is described in more detail [LINK TO Description of categories of personal data].
Identity Data.
Contact Data.
Profile Data.
Device Data.
Usage Data.
Cookies Data.
Marketing and Communications Data.
Location Data.
We do not intentionally collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Further details can be found at Criminal offence data and special category data.
How is your personal data collected?
We collect your personal data in the following ways:
1. Registration & Account Management
When you register for an account on the App we collect Identity Data (e.g., name) and Contact Data (e.g., email, phone number).
2. Communications & Support
When you communicate with us via email, telephone, online forms, or chat, we collect your Contact Data.
If you report an issue with the App, we may collect Usage Data to diagnose and improve our services.
3. Information Provided by Third Parties
We may receive personal data about you from:
Landlords
Property Managers
Property Owners
4. Information You Generate When Using Our App & Services
Each time you interact with the App, we may collect:
Device Data – Information about the device you use to access the App.
Cookies & Usage Data – Collected via analytics tools to understand how you interact with the App. Please see our Cookie Notice for details.
5. Monitoring Use of Our App & Services
To ensure compliance and improve our services, we may collect Device & Usage Data – Information on how you access and navigate the App.
6. Additional Data Collection with Your Consent
If you provide consent, we may collect:
Location Data – To enhance compliance tracking and resident engagement.
Direct Marketing Data – When you subscribe to receive ItBox updates, regulatory alerts, or promotional materials.
7. Automatic Data Collection & Updates
If the App includes automatic updates, we may collect:
Technical Data – Information about your operating system, App version, and installation details when checking for updates.
Cookies
We use cookies (small files placed on your device) on the App to improve your experience and our development of the App and our Services. For detailed information on the cookies we use, the purposes for which we use them and how you can exercise your choices regarding our use of your cookies, see our cookie notice [LINK].
How we use your personal data
We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances:
Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by accessing your Account in the App, using our cookie banner or contacting us (see Your legal rights below).
Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.
Delivery and improvement of our App
Purpose or activity
Type of personal data
Lawful basis for processing
To permit you to install the App and register you as a new App user
Identity
Contact
Device
Performance of a contract
Enforce our terms and conditions
Identity
Legitimate interests (to recover debts due to us)
Direct marketing
Purpose or activity
Type of personal data
Lawful basis for processing
To send you direct marketing communications via email
Contact
Device
Direct Marketing
Consent
Troubleshooting, improvement and security
Purpose or activity
Type of personal data
Lawful basis for processing
To administer, monitor and improve our business, services and this App including troubleshooting, data analysis and system testing
Identity
Contact
Device
Legitimate interests (for running our business, provision of administration and IT services, network security, maintaining the security of our App and Services, providing a secure service to users and preventing fraudulent and other misuse of our App)
Applying security measures to our processing of your personal data, including processing in connection with the App
All personal data under this privacy notice
Legal obligation (applying appropriate technical and organisational measures under Article 32 of the UK GDPR)
Otherwise monitoring use of the App and deploying appropriate security measures
Contact
Security
Transaction
Legitimate interests (running our business, provision of administration and IT services, network security, maintaining the security of our App and services, providing a secure service to users and preventing fraudulent and other misuse of our App)
Rights and obligations
Purpose or activity
Type of personal data
Lawful basis for processing
To comply with our other legal obligations, including compliance with tax legislation, judicial, law enforcement and government authorities' requests
All personal data under this privacy notice
Legal obligation
Cookies and personalisation
Purpose or activity
Type of personal data
Lawful basis for processing
To deploy and process personal data collected via Cookies that are strictly necessary, as set out in the cookies note [LINK]
Cookies
Legitimate interests (delivering and securing the App and our Services)
Other communications
Purpose or activity
Type of personal data
Lawful basis for processing
To notify you of changes to the App or our terms and conditions
Contact
For ongoing or prospective contracts, Performance of a contract
Otherwise, Legitimate interests (in servicing our users and prospective users)
To notify you of updates to this privacy notice
Contact
Legal obligation (to inform you of our processing under Articles 13 and 14 of the UK GDPR)
To respond to your requests to exercise your rights under this notice
As relevant to your request
Legal obligation (complying with data subject requests under Chapter 3 of the UK GDPR)
To ask you to complete a survey and process your response (where applicable, please also see the separate privacy notice)
Contact
Legitimate interests (to analyse how users use our products or Services and to develop them and grow our business)
Unless you have previously opted out, where we will rely on Consent
To otherwise respond to your enquiries, fulfil your requests and to contact you where necessary
As relevant to your enquiry or request
Legitimate interests (service our users and prospective users)
Personal data sharing
Purpose or activity
Type of personal data
Lawful basis for processing
Share personal data with our third-party providers for purposes not otherwise set out above (see Disclosures of your personal data)
As set out at "Disclosures of your personal data”
Legitimate interests (for the purpose relevant to the recipient, as set out at "Disclosures of your personal data”
Automated decision making and profiling
We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).
Criminal offence data and special category data
We do not intentionally collect criminal offence data about you. However we may process data relating to criminal offences in monitoring the use of our App for security purposes, where we suspect you may have committed a crime, such as attempting to make a fraudulent purchase or claim or circumvent the security of the App or Services. In such circumstances we will provide that information to law enforcement and/or use it to establish, exercise or defend a legal claim. In those circumstances, according to the type of activity and purpose, we will rely on legitimate interests (protecting our business, employees and other users) and legal obligation (where required by legal, judicial or law enforcement to disclose or process that information). UK law authorises that processing under the Data Protection Act 2018 and although the appropriate authorisation will depend on a case-by-case basis, monitoring for criminal behaviour through the use of our App is in the Substantial public interest (preventing or detecting unlawful acts) and processing information related to suspected criminal activity for legal claims is permitted under the additional condition of legal claims.
We do not intentionally collect special category data about you.
Disclosures of your personal data
We may share your personal data with the following third parties:
External third parties.
Your Appstore Provider and mobile network operator to allow you to install the App.
Service providers acting as processors based in the UK who provide IT and system administration services, hosting services for our App, customer service support, email delivery and administration, and data storage and analysis.
Our professional advisors based in the UK including lawyers, auditors, insurers, consultants and who provide legal, accounting and insurance services.
Specific third parties listed in the table Purposes for which we will use your personal data] above.
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
HM Revenue and Customs, regulators, law enforcement, public authorities or other third parties based in the UK where necessary to exercise our rights or comply with a legal obligation.
International transfers
We do not transfer your personal data outside the UK.
Data security
All information you provide to us is stored on our secure servers and located in the UK. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our App or Services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorised use or access.
Certain Services include social networking, chat room or forum features. Ensure when using these features that you do not submit any personal data that you do not want to be seen, collected or used by other users.
We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.
Data retention
Details of retention periods for different aspects of your personal data are available in our retention policy which you can request by contacting us.
In some circumstances you can ask us to delete your data: see Your legal rights below for further information.
Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Your legal rights
You have the following rights under data protection laws in relation to your personal data.
Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.
Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)
Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)
Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.
Restriction. Request that we restrict or suspend our processing of your personal data:
if you want us to establish the data's accuracy;
where our use of the data is unlawful, but you do not want us to erase it;
where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.
Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
Complain to the UK data protection regulator. If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint to the ICO at any time.
Who to contact about your data rights
If your data is being processed by ItBox for its own purposes in its role of controller (this data is set out in the table under “How we use your personal data” above), contact ItBox’s Data Privacy Manager.
If your data was collected by your landlord, you must contact your landlord to exercise your rights. We act as a processor in this case and cannot fulfil your request independently.
You can also use your Account in the App or your local device settings to give or withdraw your consent to or disable our processing of your Location Data.
Description of categories of personal data
Identity Data: first name, last name and Profile Data.
Contact Data: first name, last name, email address, your communication preferences and copies of the communications between you and us.
Profile Data: your email address, username and password.
Device Data: the type of device you use and your mobile operating system
Usage Data: logs and detail of your use of our Apps and Services, being the dates and times on which you download, access and update the App and our Services, any error or debugging information, and the actions we and you take in relation to them and Cookies Data.
Cookies Data: the information collected through the cookies and similar technologies listed in our Cookies Notice available here [LINK].]
Direct Marketing Data: your direct marketing preferences, consents for receiving direct marketing from us and/or our third parties and the history of the direct marketing communications we have sent to you.
Location Data: your current location as disclosed by GPS technology or WiFi connections for the time period where you have permitted us to collect it.
Part B: Using your personal data as a processor on behalf of landlords
In this section of the policy we briefly provide information about how we process your personal data on behalf of landlords in our role as processor.
The personal data referred to below is only used by us as instructed to us by landlords and for their own purposes. We will not use the personal data in a way that the landlord has not agreed to.
The why and how we process this personal data (including applicable law bases) is established by the landlord and your first port of call for understanding why we may be processing your personal data should be the landlord and their own privacy policy.
The data we process about you
We use and store the following kinds of personal data about you:
Identity Data: first name, last name
Contact Data: home address, email address and telephone number
Usage Data: includes information about how you interact with and use the App including audit logs and consent and engagement records
Profile Data: includes your username and password, tenant status, languages spoken, preferences, feedback and survey responses
We may process “special categories” of personal data about you. Specifically, this may include information about your health, such as:
Details relating to whether you’re physically able to get down stairs
Details relating to whether you’re able to hear fire alarms
These particularly sensitive types of data will only be processed for residents who identify themselves as hard of hearing or suffering from mobility issues. Even then, providing this information is not mandatory. If it is provided it will be used by the landlord to help comply with their obligations.
How do we get your personal data?
We are provided with your personal data in the following ways:
From the landlord. Primarily, we will be provided with your personal data from the landlord. They will usually provide us with this information via the landlord’s version of the App (what we’ll call the “Landlord’s Portal”) by adding residents’ details to the Landlord’s Portal. We may also get personal data via other means such as email or telephone which will then be put into the Landlord’s Portal.
Managing agents or other landlord representatives. Some landlords may have engaged managing agents to act on their behalf. If they have then day-to-day management of the landlord's property and the Landlord’s Portal may be managed by their managing agent. In this case, it may be the managing agents that provides us with your personal data by adding residents’ details to the Landlord’s Portal. We may also get personal data via other means such as email or telephone which will then be put into the Landlord’s Portal.
Registration. We may get some personal data from you when you register for the App or when you update your settings or profile in the App. This data will still only be used for the landlord’s benefit and so process this as a processor (unless we also use this data for our own purposes as set out in Part A).
International transfers
In our role as processor, we do not process your personal data outside of the UK.
Data security
We use the same/similar security measures to protect your personal data when acting as a controller.
Data retention
We will retain your data as agreed with the landlord (who may have their own retention policy that you can check). We will return or delete your personal data if the landlord asks us to in writing and we will delete your personal data when the agreement we have in place with the landlord ends, unless we are legally required to keep the personal data.
Your legal rights
These will be similar to those set out under Part A above but will be the responsibility of the landlord. If you want to utilise your legal right you should contact the landlord in the first instance.