Privacy Policy

Last updated 12 July 2026

UnitLet (“we”, “us”) provides management software for caravan, motorhome and boat storage, container and industrial sites, at unitlet.co.uk and each customer’s own subdomain. This policy explains what personal data we handle and why. The service is operated by Property Workflow Systems Ltd, Unit 6, Orchard Business Units, Cockaynes Lane, Alresford CO7 8BZ, and we comply with UK GDPR and the Data Protection Act 2018.

Two kinds of data

1. Your account. When an operator signs up we hold the account holder’s name, email address, chosen site name and web address, and a securely hashed password (never stored in plain text). This is the personal data for which we are the data controller.

2. Data you enter to run your site. Operators enter records about their own business: their customers’ names, phone numbers, emails and addresses; stored vehicles; storage contracts; payments received; and site maintenance notes and photos. For this data the operator is the data controller and we are the data processor, storing and processing it on their behalf.

How we use it, and our lawful basis

We do not use your data for advertising and we do not sell or rent it to anyone. Everything we do with it falls under one of these:

What we do	Lawful basis
Create and run your account; authenticate logins; show you your site; take payment for the subscription	Contract — we cannot provide the service without it
Service email: welcome, email verification, password reset, trial and billing notices	Contract
Keeping the service secure — login rate limits, activity logs, backups	Legitimate interests — running a service that is not trivially broken into
Answering you when you email us	Legitimate interests
Keeping records we are obliged to keep, e.g. for tax	Legal obligation
Storing and processing the customer records you enter	Not ours to choose — we act on your documented instructions as your processor. See the Data Processing Terms.

Who we share it with

We use a small number of providers, each only for the purpose stated. Those marked (sub-processor) may handle the records you enter about your own customers; the rest only touch your account.

Cloudflare (sub-processor) — hosting, database and file storage, and security. The database and file storage are located in Western Europe. Data is encrypted in transit, and at rest by the underlying storage.
Paddle (Paddle.com Market Ltd) — our payment provider and Merchant of Record. Paddle handles subscription checkout and billing; we never see or store your card details. See Paddle’s own privacy policy.
Resend (sub-processor) — email delivery. This covers our own service email to you and the messages your site sends its occupiers: rent reminders, overdue notices, invoices, agreement links and portal sign-in links. Those contain your customers’ names, email addresses and account details.
Twilio (sub-processor) — text messages, and only if you connect your own Twilio account. It handles your customers’ mobile numbers and the message text, in both directions.
GoCardless / Stripe — only if you connect your own account to take payments from your customers. Those payments run on the provider’s hosted pages and we never handle card or bank details.

We give you notice before adding or changing a sub-processor, as set out in the Data Processing Terms.

Where your data goes

The site database and uploaded files are held in Western Europe. Some providers are based outside the UK: Resend and Paddle operate in the United States, and Cloudflare is a US company whose network is global. Where personal data is transferred outside the UK, it is protected by the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent approved safeguard, under each provider’s data processing agreement.

Cookies and similar storage

Our website uses GoatCounter for visit statistics. It sets no cookies, builds no personal profiles and does no cross-site tracking, which is why you have not been asked to accept anything.

The app sets two strictly necessary first-party cookies: one to keep a staff user signed in, and one for the optional customer portal. Both are essential to a service you asked for, so neither needs consent. Your browser also stores a light/dark theme preference on your own device when you use the toggle. There are no advertising or analytics cookies anywhere.

Our checkout page loads Paddle, which sets its own cookies for payment and fraud prevention. That happens only when you arrive with an order to pay for — not on an ordinary visit.

How long we keep it

Account and business data is retained for as long as the account is active. Automatic backups are kept for up to 30 days. If an account is closed, its data is deleted within 30 days, except where we are required to retain limited records (for example, transaction records for tax purposes).

Your rights

You may access, correct, export or delete your data. Operators can export everything (CSV and full backup) or delete records at any time from within the app. To exercise any UK GDPR right — access, correction, erasure, restriction, portability or objection — email us at the address below. Individuals whose details are held by an operator should contact that operator directly, as its data controller. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Contact

Questions about this policy or your data: hello@unitlet.co.uk.

Terms & Conditions · Privacy Policy · Refund & Cancellation · Data Processing · Home