Privacy Policy

Last updated: 9th February 2026

1. Introduction

This Privacy Policy explains how Horton  Co (“we”, “us”, “our”) collects, uses, stores, and protects personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
   
• Data Protection Act 2018
   
• Privacy and Electronic Communications Regulations (PECR)
   
• Industry best practice issued by Propertymark, RICS, ARMA, and IRPM
   

We operate within the residential living sectors and understand the sensitive nature of personal data.

Horton Co generally acts as a Data Processor when processing personal data on the Client’s instructions. Where Horton Co independently determines the purpose or means of processing, it shall act as a Data Controller for that processing activity and only on the Client's instructions. 

2. Data Processor / Controller

Horton Co
Email: alie@horton-co.com

3. Personal Data We Collect

a) Website & Enquiries

• Name, email address, telephone number
   
• Business details
   
• Enquiry content
   
• IP address and analytics data (see Cookies section)
   

b) Client & Resident-Level Data

Where required to deliver services, we may process:

• Names and contact details of leaseholders, tenants, freeholders
   
• Property addresses and unit references
   
• Correspondence, complaints, or service history
   
• Compliance and safety documentation
   
• Financial references (e.g. apportionment data – not card or bank details)
   

We do not intentionally process special category data, but may receive it incidentally (e.g. vulnerability disclosures).

4. How We Use Personal Data

Personal data is processed strictly for:

• Delivering contracted services
   
• Supporting managing agents with property operations and compliance
   
• Communicating with residents or stakeholders when authorised
   
• Legal, regulatory, and professional obligations
   
• Website analytics and improvement (with consent)
   

5. Lawful Basis for Processing

Purpose                                                                      Lawful Basis

Service delivery                                                        Contract

Resident administration                                         Legitimate interests

Compliance records                                               Legal obligation

Website analytics                                                    Consent

Vulnerability data (if received)                            Substantial public interest / explicit consent                                                                                 

6. Data Sharing

Personal data may be shared only where necessary with:

• Managing agents / clients
   
• Contractors and professional advisers
   
• IT and software providers
   
• Regulatory or legal bodies where required
   

Data is never sold or used for unrelated purposes.

7. Data Retention

Data is retained only for as long as necessary:

• Contractual records: up to 6 years
   
• Compliance documentation: as required by law
   
• Correspondence: reviewed regularly
   

Data is securely deleted when no longer required.

8. Data Security

We apply enhanced controls consistent with Propertymark and RICS expectations, including:

• Encrypted devices and password protection
   
• Role-based access to data
   
• Secure cloud storage
   
• Confidentiality obligations
   
• Breach reporting procedures
   

9. Use of artificial intelligence tools

We use artificial intelligence tools to support the delivery of our services, including to assist with drafting summaries and analysis. We use ScoreApp (operated by ScoreApp Ltd) as a sub-processor to deliver interactive scorecards and assessments. Data submitted through ScoreApp tools is processed and stored within the EU in accordance with UK GDPR. A data processing agreement governs this relationship. AI-generated outputs are always reviewed by a human professional before any action is taken. No decisions about individuals are made solely by automated means.

The AI tools we use include Claude (Anthropic) and ChatGPT for drafting assistance. Personal data processed through these tools is handled in accordance with UK GDPR. We do not use personal data to train third-party AI models.

Where feedback data contains sensitive or special category information, we apply additional controls before any AI tool is used to process it.

10. Data Subject Rights

Individuals have rights to access, rectify, erase, restrict, object, and complain.
Requests are handled within statutory timeframes.

11. Cookies & Analytics

See our Cookie Policy for full details. Analytics cookies are used only with consent.

12. Complaints

Concerns may be raised with us or the Information Commissioner’s Office (ICO).

13. Updates

This policy is reviewed regularly and updated as required.