Lease Ventures Privacy Notice

Version 1.0. Dated 12 October 2026.

1. Who is responsible for your data

1.1 Scott FT Property Limited (company number 15976662, registered office Maritime House, Basin Road North, Portslade, Brighton, BN41 1WR), trading as Lease Ventures, is the controller of the personal data collected through the Lease Ventures platform (the "Platform").

1.2 Registration with the Information Commission (the ICO): ZB801828.

1.3 Contact about your data, and about anything else: info@lease-ventures.com. This address is read by a named member of our team every working day.

2. Who this notice covers

2.1 Users: people who sign up and use the Platform (sections 3, 4, 6, 8, 9 and 10).

2.2 Website visitors (sections 5, 6, 8, 9 and 10).

2.3 People whose contact details appear on the Platform as the contact at a Provider (sections 7, 8, 9 and 10).

3. What we collect from users, why, and the lawful basis

Each line gives what we collect, why, and the legal reason (lawful basis) that lets us use it.

3.1 Your name, email address, postcode, business name and login details. Why: to run your account. Lawful basis: contract.

3.2 The addresses and details of the properties you add. Why: to match your properties to Providers. Lawful basis: contract.

3.3 Your feedback on Providers and your pipeline activity. Why: to run the service and to keep our Provider information and internal scoring up to date. Lawful basis: contract, and our legitimate interests in improving the Platform.

3.4 How you use the Platform, the properties you add, and your feedback. Why: to improve and develop the Platform, including training, testing and tuning the matching, scoring, search and analysis tools we run. Lawful basis: our legitimate interests in improving the service (section 4).

3.5 Device and log data from your use of the Platform. Why: security, fixing faults and improving the Platform. Lawful basis: our legitimate interests in running a secure service.

3.6 Your contact details, for beta check-ins. Why: to ask how you are getting on with the Platform and your properties. Lawful basis: our legitimate interests in running the beta. You can ask us to stop at any time.

3.7 Your answer to the optional contact box at sign-up. Why: to get in touch about other options for your properties, only if you ticked it. Lawful basis: consent, which you can withdraw at any time.

4. How we improve the Platform and train our tools

4.1 We analyse how users use the Platform, what they add and what they tell us, to improve matching and scoring and to build new features. That includes training and tuning the automated tools we run, ourselves or through suppliers acting for us.

4.2 Our suppliers do not use your information to train their own models.

4.3 We make no automated decisions that have legal or similarly significant effects on you.

4.4 If you delete your account we stop using what identified you. Anonymised insight already produced and tools already trained are not undone.

4.5 You can object to this use at any time (section 10).

5. Website visitors

5.1 We use cookies and similar tools, such as your browser's local storage, as set out in our Cookie Notice. Essential items keep you signed in (a session token held in your browser's local storage) and keep the site secure. They run without your consent because the site cannot work without them.

5.2 Analytics (PostHog) runs only if you accept it on the cookie banner. Lawful basis for analytics: consent, which you can withdraw at any time using the "Cookie settings" link at the foot of every page.

6. Who we share data with

6.1 Suppliers who host, build and support the Platform for us, each acting on our instructions:

(a) Supabase, hosting and database, in Sweden (European Union);

(b) Vercel, which serves the website pages, through a network of servers with no fixed location. It does not hold your account data. Its functions run in Sweden;

(d) OpenAI, for automated searches for Provider information;

(e) Anthropic, the AI assistant our team uses;

(f) PostHog, analytics, in the United States, only if you accept analytics;

(g) Sentry, error monitoring, in Germany (European Union).

6.2 Our development contractors are bound by a written data processing agreement.

6.3 Professional advisers, regulators, or the police where the law requires it.

6.4 A buyer or successor of the Platform or of our business, or a prospective buyer under confidentiality during due diligence.

6.5 We do not sell user data. Anonymised insight is different: once anonymised, information identifies no one and this notice does not apply to it. We produce it with safeguards: it is never used to take decisions about any individual, it is never released in a way that could harm anyone, and we check each release so that no one can reasonably be identified.

6.6 We do not share your property details with Providers. You decide whether to contact them.

7. Information about Providers and the people who work for them

7.1 The Platform lists organisations that provide supported living, social housing and care. This is information about organisations, and the contact details we show are general or team inboxes, not details of named individuals. We do not hold personal details of the people who work for Providers, such as their names, job titles, personal-looking email addresses or direct phone numbers. If we find any, we remove them.

7.2 Where we get organisation information. We collect it from public registers (the Regulator of Social Housing, the Care Quality Commission, Companies House, the CIC register, council framework and tender publications, and HMO licence registers), from company notices in The Gazette, from organisations' own websites, and through AI web search across the open web.

7.3 Why we are allowed to. If a detail we hold does turn out to be personal data, we use it on the basis of our legitimate interests in helping landlords find organisations that may lease their property, and we think this is within what people in these roles would reasonably expect.

7.4 What you can do. If you work for a Provider and see your own details on the Platform, you can ask us to correct them, swap them for a general or team inbox, or remove them, and you can object to our using them. Email info@lease-ventures.com. We will acknowledge within 5 working days and act within 10 working days.

7.5 How long we keep it. We check every contact at least every 12 months and either confirm, correct or remove it. We remove it sooner if you ask or if we learn it is wrong.

7.6 Scores. A score beside a Provider is information shown to users. It makes no decision with legal or similar effects about you or your organisation.

7.7 If a Provider asks us to remove it as an organisation, its public register information stays on the Platform and any personal contact details come off.

8. International transfers

8.1 Your data may be processed in the United Kingdom, the European Union and the United States. We host the Platform with Supabase in Sweden, in the European Union, and its functions run in Sweden. Transfers to the European Union are covered by the UK's adequacy regulations.

8.2 Some suppliers process data in the United States: PostHog, for analytics, only if you accept analytics; OpenAI, for automated searches for Provider information; and Anthropic, for the AI assistant our team uses.

8.3 Where data is processed in the United States we protect it as UK data protection law requires. You can ask us for details at info@lease-ventures.com.

9. How long we keep data

9.1 User account data: for as long as the account is open, then 2 years after it was last used.

9.2 If you ask us to delete your account, we delete your account, login and property details within one month, except anything we must keep by law. Deleted accounts cannot be recovered.

9.3 Feedback, tick boxes and written comments: kept after deletion, with anything that links it to you or your properties removed.

9.4 Provider contact details: up to 12 months from the date we last checked them, then confirmed, corrected or removed (section 7.5). Information about a Provider as an organisation, such as its registration, address and services, is public information and is kept for as long as the Platform lists that Provider.

9.5 Website analytics (PostHog): one year.

9.6 Error reports (Sentry): 30 days.

10. Your rights and complaints

10.1 You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask to move it, withdraw your answer to the optional contact box, and ask us to stop beta check-ins. Email info@lease-ventures.com. We reply within one month.

10.2 If you want to complain about how we handle your data, email info@lease-ventures.com. We will acknowledge within 30 days (we aim for 5 working days) and tell you the outcome without undue delay.

10.3 If you are unhappy with our answer you can complain to the Information Commission (the ICO) at ico.org.uk, though we would like the chance to put it right first.

10.4 If a personal data breach is likely to put you at risk we tell you without undue delay, and where the law requires it we report it to the Information Commission (the ICO) within 72 hours.

11. Changes to this notice

11.1 We will post any change here with a new date and version, and tell users by email if it matters. We keep every version and you can ask for a copy.