Privacy policy.

1. Who we are

HabiTrak is a management platform for UK supported housing. It is operated by Habitrak Software Ltd, a company registered in England & Wales (company number 16518603) ("HabiTrak", "we", "us", "our"). Habitrak Software Ltd is registered with the Information Commissioner's Office as a data controller (registration number ZC266969).

HabiTrak helps registered providers, managing agents, support workers, residents and maintenance engineers manage tenancies, support and compliance across supported housing. This policy explains how we handle personal data and applies to our marketing website (habitrak.co.uk), the HabiTrak web app (app.habitrak.co.uk) and the HabiTrak apps for iOS (Apple App Store) and Android (Google Play).

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Our role: controller and processor

Data protection law distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" (who processes data on a controller's instructions). Our role depends on the data in question.

Resident and operational data — we are the processor

When a housing provider or managing agent organisation uses HabiTrak to record and manage information about residents, tenancies, support and compliance, that organisation is the data controller and HabiTrak acts as a data processor, processing that data only on the provider's documented instructions. The provider remains responsible for the lawful basis, notices and data-subject responses for this data. Our processing on their behalf is governed by our Data Processing Agreement, published at https://habitrak.co.uk/dpa/.

Account, prospect and website data — we are the controller

For data about the people who sign up for or pay for a HabiTrak customer account (the account holders), prospects who contact us, and visitors to our website, HabiTrak is the controller. The sections below on lawful bases, your rights and our contact details apply to that data. The account details of every User a customer adds to its own HabiTrak account, whatever that User's role in the app, are part of the data we process for that customer, so a request about them goes to the customer, as clause 7 of our Data Processing Agreement sets out.

3. What data we collect and why

Account and contact data (HabiTrak as controller)

When you sign up for or pay for a customer account as its account holder, or contact us, we collect data such as your name, work email address, organisation, job role and the content of your enquiries. We use this to create and manage accounts, provide support, and communicate with you about the service. If your organisation pays for HabiTrak, we also keep its billing contact, invoices and payment records. Card details are entered on our payment provider Stripe's own page; we never see or store your full card number.

Usage and device data (HabiTrak as controller)

When you use the website or apps we may collect technical data such as device or browser type, operating system, IP address, and basic information about how the service is used, for operational and security purposes. We do not use third-party advertising or analytics trackers, and we do not collect precise real-time location data from your device.

Resident personal data, including special-category data

Providers and their staff input personal data about residents in order to deliver and evidence supported housing. This includes special-category data within the meaning of UK GDPR Article 9 — for example data concerning health, mental health, substance use, risk assessments and support plans — alongside tenancy, incident and compliance records.

We process this data on the provider's behalf as a processor, only to provide the platform and on the provider's instructions. We do not use resident data for our own purposes, and we do not sell personal data.

4. Lawful bases under UK GDPR

For the data for which we are the controller (account, prospect and website data), we rely on the following Article 6 bases:

• Contract — to set up and operate accounts and provide the service to the customer organisation and its users.
• Legitimate interests — to secure, maintain and improve the service, respond to enquiries, and carry out limited business-to-business marketing, balanced against your rights.
• Legal obligation — where we must process data to comply with the law.
• Consent — where we ask for it, for example optional marketing communications. You can withdraw consent at any time.

For resident personal data, the controlling provider determines the lawful basis. Where special-category data is processed, the provider relies on a condition under UK GDPR Article 9 — typically Article 9(2)(h) (provision of health or social care) or Article 9(2)(g) (substantial public interest) — together with the associated condition in Schedule 1 of the Data Protection Act 2018. HabiTrak processes such data only as the provider's processor, under the data processing agreement and on their documented instructions.

5. Sub-processors and third parties

We rely on Amazon Web Services (AWS) as our infrastructure provider (sub-processor) to host and run the service. AWS processes personal data only on our instructions and under contract, and we remain responsible for the data we entrust to it. We use AWS for:

• cloud hosting and storage (Amazon S3 and Amazon CloudFront);
• user authentication and account sign-in (Amazon Cognito);
• sending service and verification emails (Amazon SES).

Card payments are handled by Stripe. Stripe processes your organisation's billing contact, invoices and payments for us, and acts as a controller for its own fraud-prevention and legal duties. It never receives residents' records.

When someone types a postcode or address into HabiTrak, IDDQD Limited (Ideal Postcodes), an English company (company number 08302922), turns it into a full address. Email sent to support@habitrak.co.uk or billing@habitrak.co.uk is held in our Google Workspace mailboxes, so Google processes that correspondence for us. Each of them processes personal data for us under its published data processing terms.

Our AWS services run in the United Kingdom (London region, eu-west-2), apart from CloudFront's certificates and the firewall in front of our websites, which are set up in the AWS US East (N. Virginia) region, as AWS requires, and the CloudFront edge caching described in section 6. We do not use third-party advertising, analytics or tracking services, and we do not sell personal data or share it with third parties for their own marketing.

6. International transfers

The personal data held in the HabiTrak service is stored in the United Kingdom, in the AWS London region (eu-west-2): the database, uploaded files, logs and the sign-in service. Some processing touches other countries: uploaded files are delivered through Amazon CloudFront, which can hold a cached copy of a file at AWS edge locations in Europe, North America and Israel while serving it; a postcode or address typed into an address search goes to IDDQD Limited, which hosts in the UK and EU and uses some processors in the United States; email to our support and billing mailboxes is held by Google Workspace in Google's data centres, which may be outside the UK; and card payments and billing details go to Stripe as section 5 describes. Each of these transfers takes place under the safeguards in that supplier's published data processing terms. We do not otherwise transfer personal data outside the UK; if that changes, we will put a transfer mechanism UK law recognises in place first and update this policy.

7. Data retention

We keep account and contact data for as long as your organisation maintains a HabiTrak account, and delete it within 90 days after the account is closed, except billing and payment records, which UK tax law requires us to keep for 6 years after the end of the financial year they relate to. We keep technical and security logs for up to 17 months.

Resident data is retained in line with the controlling provider's instructions and their own legal and housing-sector retention obligations. On termination of a provider's account we return or delete resident data in accordance with the data processing agreement. We keep resident records until the provider erases them or the read-only period after its subscription ends is over, and we never delete them on our own initiative; the service will not erase a residence while a safeguarding concern raised by someone other than the resident is still on record for it, a former resident can still read their own documents and agreements for twelve months after moving out, and any longer retention (for example keeping safeguarding records for 7 years) is the provider's decision, so the provider exports those records before its account's read-only period ends.

8. Your rights

Under UK GDPR you have rights over your personal data, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing.

For data where HabiTrak is the controller (account, prospect and website data), you can exercise these rights by contacting us using the details below, or via our data deletion page.

If you are a staff User a customer added to its HabiTrak account, your account details are part of the data we process for that customer, so please send your request to the customer. A request that reaches us instead is passed to the customer within 5 working days, as clause 7 of our Data Processing Agreement sets out.

If you are a resident and wish to exercise rights over data held about you in HabiTrak, your housing provider or managing agent is the controller of that data, so such requests are routed to and handled by them. We will support our provider customers in responding to those requests as their processor.

9. Security

We maintain organisational and technical measures designed to protect personal data, including role-based access controls, restricting access to authorised personnel on a need-to-know basis, encryption of data in transit, and logging and monitoring. We keep these measures under review. No system can be guaranteed fully secure, and we do not over-state the protection any technology can provide.

For a fuller summary of our hosting architecture and our responsibilities as a processor, see our GDPR compliance page.

10. Children

HabiTrak is a tool for housing professionals and is not directed at children. Residents supported through the platform may include young adults; any data about residents is entered by provider staff and processed on the provider's instructions. We do not knowingly collect personal data from children under 13 through our public website.

11. Cookies and website analytics

Our marketing website does not use analytics, advertising or tracking cookies, and does not set non-essential cookies. The HabiTrak apps use only strictly necessary cookies and tokens — for example to keep you securely signed in. If we introduce non-essential cookies in future, we will ask for your consent first and update this policy.

12. Changes

We may update this policy from time to time. When we do, we will revise the effective date below and post the updated policy on this page. Significant changes will be communicated to account holders where appropriate.

This policy is effective from 10 October 2026.

Contact us

For any privacy questions, or to exercise your rights in respect of data we control, please contact us at support@habitrak.co.uk.