Privacy Policy

1. Who I am

Northfield Spaces is a cloud-based software-as-a-service platform owned and operated by Abrin Thapa as an independent sole trader, registered in the United Kingdom at 87 Sompting Road, BN15 9LF. For the purposes of UK GDPR and the Data Protection Act 2018, I am the data controller of personal data that you provide directly to me through this website and the platform, and I am a data processor of personal data that you upload into your workspace.

You can contact me at any time about this Privacy Policy or about any personal data I hold by emailing hello@northfieldspaces.co.uk or by writing to the address above.

2. What this policy covers

This policy explains what personal data I collect, why I collect it, how it is stored and protected, who I share it with, your rights under UK data protection law, and how long I keep your information. It applies to: the public Northfield Spaces website at northfieldspaces.co.uk; the cloud platform you access after subscribing; any email or written correspondence with me; and any sales, support or onboarding interactions.

3. Personal data I collect

I collect three categories of personal data:

3.1 Account and billing information

When you create a subscription I collect your full name, business name (if applicable), email address, billing address, the plan you have selected, the start date of your subscription and a Stripe customer reference. Payment card details are processed and stored exclusively by Stripe and never reach Northfield Spaces systems.

3.2 Workspace content

Inside your subscribed workspace you may upload, create or store records about properties, projects, documents, tasks, activities and the people associated with them — for example tenant names, contractor contact details, lease parties or staff members. This content is processed on your instruction. You are the controller of that data; I am the processor.

3.3 Technical and usage data

The platform automatically logs technical information such as IP address, browser type, device type, the pages or features used, timestamps of activity and error diagnostics. This information is used to operate, secure and improve the service.

4. Lawful bases for processing

I rely on the following lawful bases under UK GDPR Article 6:

• Contract — to deliver the subscription you have purchased, including account creation, authentication, billing and customer support.
• Legitimate interests — to keep the platform secure, prevent fraud and abuse, monitor service health, improve product quality and respond to enquiries from prospective customers.
• Legal obligation — to comply with UK tax, accounting and consumer-protection law.
• Consent — where required, for example for non-essential analytics cookies or marketing email beyond service communications.

5. How I use personal data

I use personal data only for the purposes listed below:

• Providing and maintaining your subscription and the platform features it includes.
• Authenticating your access and protecting your account from unauthorised use.
• Processing payments through Stripe and issuing receipts and VAT-ready invoices.
• Responding to support enquiries and providing customer assistance.
• Sending service communications such as billing receipts, security notices and policy updates.
• Monitoring performance, diagnosing errors and improving the platform.
• Meeting legal, regulatory and audit obligations.

I do not sell personal data, I do not share it with advertisers, and I do not use customer data to train artificial intelligence models.

6. Sharing of personal data

I share personal data only with the third parties listed below and only to the extent necessary for them to provide the service in question:

• Stripe — payment processing.
• Cloud hosting providers — to operate the platform infrastructure under appropriate data-processing terms.
• Email delivery services — to send transactional emails, receipts and service notices.
• Professional advisers — including accountants and legal advisers, under confidentiality obligations.
• Public authorities — where required by UK law.

All processors are subject to written data-processing agreements that require them to handle personal data lawfully and securely.

7. International transfers

Where personal data is transferred outside the United Kingdom, those transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to jurisdictions covered by a UK adequacy decision.

8. Data retention

I keep personal data only for as long as needed for the purposes described above:

• Account and billing records: for the life of the subscription and for at least six years after termination, to meet UK tax and accounting obligations.
• Workspace content: for the life of the subscription. Following termination, data is retained for 30 days to allow recovery, then permanently deleted unless you instruct otherwise in writing.
• Support correspondence: for up to three years from the date of last contact.
• Technical logs: typically for up to 90 days, longer where required for security investigation.

9. Your rights

Under UK GDPR you have the right to access the personal data I hold about you, to ask for inaccurate data to be corrected, to ask for data to be deleted in certain circumstances, to restrict or object to processing, to data portability, and to withdraw consent at any time where processing relies on consent. You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.

To exercise any of these rights please email hello@northfieldspaces.co.uk. I respond to verified requests within one calendar month.

10. Security

I take the security of personal data seriously. The platform uses encryption in transit (TLS) and at rest. Access is controlled through role-based permissions. Administrative access is restricted, audited and protected with multi-factor authentication. Backups are taken regularly and tested. Any suspected personal data breach is investigated promptly and reported to the ICO and affected individuals where required.

11. Cookies

The website uses a minimal set of cookies necessary for site functionality. Optional analytics cookies are only set with your consent. For full details please see the Cookie Policy.

12. Children

Northfield Spaces is a business tool not directed at children under 16. I do not knowingly collect personal data from children.

13. Changes to this policy

I may update this policy from time to time to reflect changes to the platform, legal requirements or operational practice. The 'last updated' date at the top of the page will always reflect the most recent revision. Material changes will be communicated by email to active subscribers.

14. Contact

If you have any questions about this Privacy Policy, please contact:

Abrin Thapa
Northfield Spaces
87 Sompting Road
BN15 9LF, United Kingdom
hello@northfieldspaces.co.uk