1. Overview and Data Controller
DeedBox is operated by Kontroll Solutions Ltd, a private limited company registered in Scotland. We are dedicated to upholding the highest standards of data security and privacy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For inquiries regarding this policy or to exercise your statutory rights, contact our Data Protection Officer at: privacy@deedbox.io.
2. UK-Only Sovereign Data Residency
All customer information, property inventories, document uploads, and encrypted credentials are stored exclusively within the United Kingdom in sovereign, tier-four UK data centres. We do not transfer your personal data outside the United Kingdom, guaranteeing full alignment with UK GDPR and the Data Protection Act 2018.
3. Data We Collect and Process
- Identity & Contact Data: Name, professional or personal email address, telephone number, and postal address.
- Conveyancing & Transaction Data: Property address, case identifiers, acting legal practice details, agreed completion dates, and certified settlement statements.
- Vaulted Credentials: Account usernames, passwords, device serial numbers, and router network keys provided by the seller. These are held in a bank-grade zero-access digital vault using isolated cryptographic keys dedicated exclusively to that transaction.
- Statutory Compliance Audit Logs: Cryptographic records of transactions, confirmations, and document access, preserved in compliance with UK conveyancing statutory requirements for 6 years in a tamper-proof state.
- Shared Documents: Compliance certificates and warranties, which are automatically anonymised upon upload to redact personal identifying details prior to formal completion.
4. Zero-Access Security Architecture
We employ a strict zero-access security architecture for sensitive household credentials and documents:
- Passwords are never stored in plaintext and cannot be viewed by platform personnel.
- Access policies enforce a technical barrier that prevents human decryption before completion.
- Credentials and unredacted original documents are only released when two independent, authorized legal practices submit matching digital completion confirmations.
5. Your Statutory Rights
Under UK GDPR, you have statutory rights including:
- Right of Access (Article 15): You may request a complete export of your personal data using our automated Subject Access Request endpoint.
- Right to Rectification (Article 16): You may update inaccurate personal details via your portal.
- Right to Erasure (Article 17): You may request deletion of your account once all transactions you participate in have concluded. Note that statutory retention rules apply to closed legal conveyancing audit trails under Article 17(3)(b).
6. Contact & Supervisory Authority
If you have concerns about our processing of your personal data, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk