Effective 9 September 2026
CorpHaus Ltd, registered in England and Wales, company number 17453226.
CorpHaus Ltd is the controller of personal information processed for the operation of CorpHaus. Company number 17453226. Registered office: 77 Sunny Gardens Road, London, NW4 1SJ.
Privacy enquiries: support@corphaus.co.uk.
This policy applies to personal information processed through CorpHaus about account users, business contacts, people named in member submissions, proposed guarantors and other individuals whose information is lawfully supplied through the service.
Account information: name, business email, telephone number, hashed password, verification status and records of acceptance of terms.
Organisation information: company name and number, registered/trading addresses, website, business contact details, primary contact and years trading.
Provider/regulatory information: CQC status and number where relevant, other regulatory registrations, local-authority contracts, framework agreements, accreditations, safeguarding-policy availability and public-liability insurance information.
Guarantor information: name, relationship to a provider, email, telephone, UK property ownership information, ownership status, notes and uploaded proof-of-ownership documentation.
Property information: street address, photographs and compliance documents such as EPC, gas safety, EICR, fire alarm, emergency-lighting and insurance documents.
Correspondence: messages exchanged through the platform.
Commercial records: expressions of interest, proposals, negotiation history and placements, including agreed rent, term and start date.
Operational/security information: administrative audit logs, notifications, verification/reset records, IP/device or security information generated in ordinary operation where applicable.
Payment/subscription information: subscription status, billing identifiers and payment events. Full card details are handled by Stripe and are not stored on CorpHaus servers.
We receive information directly from account users; from their organisation; from other members where they lawfully provide information relevant to a proposed transaction; from service providers that support the platform; and from platform activity and security logs.
If a member provides another person’s information, such as a guarantor’s details, that person may not have supplied the information directly to us.
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Create and administer accounts and provide requested platform functionality | Account, organisation, communications, commercial records | Contract where the individual is party to the contract; otherwise legitimate interests in providing and administering a B2B service |
| Review applications, listings and platform integrity | Organisation, regulatory, property, uploaded documents, audit information | Legitimate interests in operating a trusted B2B marketplace and preventing misuse |
| Match requirements and listings | Property, requirement and commercial criteria | Legitimate interests in providing the core matching service |
| Process subscriptions and payments | Account, subscription and billing records | Contract; legitimate interests for business-account administration; legal obligation for records where applicable |
| Security, fraud prevention, moderation and disputes | Account, messages, documents, audit/security records | Legitimate interests in protecting users and the platform; legal obligation where applicable |
| Maintain accounting, tax and legal records | Billing and relevant commercial records | Legal obligation and legitimate interests in establishing, exercising or defending legal claims |
| Service communications | Account and contact details | Contract and legitimate interests in administering the service |
| Improve and troubleshoot the platform | Operational and usage information | Legitimate interests in maintaining and improving the service, balanced against user privacy |
A member may provide information about a proposed guarantor or other individual who does not hold a CorpHaus account. We process this information where it is relevant to evaluating or facilitating a proposed B2B property transaction and where our legitimate interests, or those of participating businesses, are not overridden by the individual’s rights and interests.
Members supplying third-party information must ensure they are entitled to do so, must not provide excessive or irrelevant information, and must provide appropriate privacy information to the individual where required.
An individual whose information has been supplied to CorpHaus may contact support@corphaus.co.uk to ask how their information is being used and to exercise applicable data-protection rights.
CorpHaus is not designed for members to upload special category personal data or other highly sensitive personal information into general document fields. Members should not upload health information, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric information, sex-life or sexual-orientation information, or criminal-offence information unless there is a clear lawful necessity and the platform expressly permits it.
We may remove, restrict or request deletion of information that appears unnecessary or inappropriate for the service.
CorpHaus uses rules and scoring to compare property listings with requirement profiles. The matching process uses information entered by members and produces a score and explanation. It does not by itself enter anyone into a contract, make a legally binding decision, determine access to housing, or make a decision producing legal or similarly significant effects about an individual.
Other authorised CorpHaus members, but only to the extent required by the platform workflow and visibility rules.
Render, which hosts the application and PostgreSQL database; the current application/database region is Frankfurt, EU.
Cloudflare R2, used for private storage of uploaded documents and photographs. The precise storage jurisdiction should be confirmed in CorpHaus’s infrastructure settings and this policy updated if necessary.
Resend, used for transactional email delivery; the current sending infrastructure described in the product brief uses Amazon SES in eu-west-1.
Stripe, which processes subscriptions and card payments under its own applicable privacy and processing arrangements.
Professional advisers, insurers, auditors, regulators, law-enforcement bodies, courts or public authorities where reasonably necessary or legally required.
A purchaser, successor or new group company if CorpHaus is reorganised, transferred or moved into a dedicated operating company, subject to appropriate safeguards.
Some service providers used by CorpHaus are headquartered outside the UK even where particular infrastructure is located in the UK or EEA. Where personal information is transferred internationally and UK data-protection law requires safeguards, we rely on an applicable adequacy arrangement or appropriate contractual and organisational safeguards required by law. You may contact us for further information about safeguards relevant to your information.
We use technical and organisational measures designed to protect personal information. Uploaded documents are stored privately and are intended to be served only through authenticated routes that re-check permissions. Passwords are stored in hashed form. No method of storage or transmission can be guaranteed completely secure.
We keep personal information only for as long as reasonably necessary for the purposes for which it is held, including service delivery, accounting, security, dispute resolution and legal claims.
| Category | Indicative retention approach |
|---|---|
| Active account/profile data | For the life of the account, then deleted or anonymised following closure unless a longer period is required for another purpose. |
| Unsuccessful/rejected application material | Normally up to 12 months after the application is closed, unless needed for fraud prevention, a complaint or legal claim. |
| Messages, proposals and placement/commercial records | Normally up to 6 years after the relevant transaction, placement, account closure or last material activity, as appropriate, because these may form shared commercial records or be relevant to disputes and legal claims. |
| Billing/accounting records | Normally 6 years or such other period as required by applicable tax/accounting law. |
| Audit, security and fraud-prevention records | For a proportionate period based on security and legal need; ordinarily up to 24 months, but longer where linked to an investigation, restriction, dispute or legal claim. |
| Uploaded compliance/property documents | While required for the active listing/relationship and thereafter only where necessary for a commercial record, dispute, legal obligation or claim; otherwise deleted or anonymised. |
| Verification/reset tokens | Only for their operational validity period and limited technical/security retention thereafter where applicable. |
These periods are guidelines rather than promises to retain every record for the maximum period. We may delete information sooner when it is no longer needed and retain specific information longer where a dispute, investigation, legal hold or legal obligation requires it.
Depending on the circumstances and lawful basis, individuals may have rights to access personal information, correct inaccurate information, request erasure, restrict processing, object to processing, and receive certain information in a portable form.
Where we rely on legitimate interests, you have the right to object to processing based on your particular situation. We will consider the objection and stop processing unless we have compelling legitimate grounds or need the information for legal claims.
To exercise a right, contact support@corphaus.co.uk. We may need to verify identity before acting.
Please contact us first if you have a privacy concern so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO).
We may update this policy as CorpHaus, its providers or applicable law changes. The current version will be published with an effective date.