Privacy Notice

1. Who we are

The data controller is SOS Property. This portal is operated to manage property maintenance, compliance, and welfare reporting across SOS Property hotels. For data protection queries contact your line manager or the appointed Data Protection Officer.

2. What personal data we hold about you

• Account data: full name, username, email address, job role, assigned hotel
• Authentication data: hashed password, time-limited MFA verification codes, login timestamps, IP addresses
• Activity data: maintenance defects you raised or closed (including photos and notes), compliance and certificate records you uploaded, UKVI reports you created
• Audit data: a timestamped log of every significant action taken in the portal

3. Why we process it and our legal basis

• Contract / employment: to provide you with access to systems required for your role
• Legitimate interests: to maintain property safety, track compliance, and detect misuse of the portal
• Legal obligation: UKVI right-to-work checks; Health & Safety record-keeping requirements

4. Who we share it with

Your data is stored in Supabase (EU-hosted PostgreSQL and file storage) and processed by Vercel (UK/EU serverless hosting). Email notifications are sent via Resend. We do not sell or share your data with third parties for marketing.

5. How long we keep it

Operational records (defects, compliance, UKVI reports, audit logs) are retained for 5 years from creation, after which they are automatically deleted. Account data is removed when your account is deleted by an administrator.

6. Security

All data is encrypted in transit (TLS). Passwords are hashed using scrypt. Multi-factor authentication is required at every sign-in. Access is role-based and every significant action is written to an immutable audit log.

7. Your rights

Under UK GDPR and the Data Protection Act 2018 you have the right to: access the personal data we hold about you; have inaccurate data corrected; request erasure where there is no lawful reason to retain it; restrict or object to processing; and data portability. To exercise any of these rights, contact your administrator or the DPO. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

8. Cookies

This portal sets a single authentication cookie (hm_token) strictly necessary for keeping you signed in. No analytics, advertising, or tracking cookies are used. Because this cookie is strictly necessary for the service to function, UK law does not require a cookie-consent banner for it — this notice serves as the required disclosure.