Privacy Policy

Holdkey Ltd ("Holdkey", "we", "us", "our") is a UK-registered company operating a property transaction platform at holdkey.co.uk. We digitise the home-buying and selling process, providing escrow, document management, and a vetted professional network.

For the purposes of UK data protection law and the UK GDPR, Holdkey Ltd is the data controller of your personal information.

Contact: privacy@holdkey.co.uk

We collect personal data in the following categories:

• Account data — name, email address, password (hashed), role (buyer, seller, solicitor, etc.)
• Profile data — phone number, firm name, city, professional bio (for professional roles)
• Property data — addresses, postcodes, property details, images you upload for listings
• Transaction data — offer amounts, transaction status, step progress, escrow amounts
• Document data — files you upload as part of a property transaction (deeds, surveys, mortgage approvals, ID documents)
• Communication data — messages sent between parties on the platform
• Authentication data — if you sign in via Google or X, we receive your name, email, and profile picture from those providers
• Usage data — pages visited, actions taken, device type, IP address, browser type

We use your personal data to:

• Create and manage your account
• Facilitate property transactions between buyers, sellers, and professionals
• Process and hold funds in our FCA-authorised escrow account
• Send transactional notifications (offer updates, step completions, escrow release)
• Enable messaging between transaction parties
• Verify professional credentials (solicitors, surveyors, mortgage advisors, estate agents)
• Comply with our legal and regulatory obligations, including FCA requirements and anti-money laundering (AML) checks
• Detect fraud, security threats, and abuse
• Improve the platform through anonymised analytics

We process your personal data on the following legal bases under UK GDPR:

• Contract performance — processing necessary to deliver our service to you (account management, transactions, escrow)
• Legal obligation — FCA compliance, AML checks, record-keeping requirements
• Legitimate interests — fraud prevention, platform security, service improvement
• Consent — marketing communications (where you have opted in)

Holdkey operates an FCA-authorised escrow service. Financial data (purchase prices, fee amounts, bank details) is handled in accordance with FCA requirements. Access to financial figures is strictly role-gated:

• Buyers see only the amount they have paid into escrow
• Sellers see the net payout and our 2% commission
• Solicitors and senior Holdkey staff see the full escrow ledger
• Customer support staff cannot access financial figures

We do not sell your personal data. We share data only where necessary:

• Transaction parties — other parties in your transaction (e.g. the seller sees your offer amount; the solicitor sees your contact details)
• Professional network — if you are listed as a solicitor, surveyor, advisor, or estate agent, your name, firm, city, phone, and bio are visible to buyers searching for professionals
• Service providers — Supabase (database and authentication), Vercel (hosting), Resend (transactional email). All are bound by data processing agreements
• Regulatory authorities — we may disclose data to the FCA, HMRC, or law enforcement where required by law

• Active accounts — retained for the duration of your account
• Transaction records — retained for 7 years after completion to meet FCA and HMRC requirements
• Deleted accounts — anonymised within 30 days of a verified deletion request, except where retention is legally required
• Marketing data — deleted promptly upon withdrawal of consent

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — ask us to pause processing of your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — withdraw marketing consent at any time

To exercise any of these rights, email privacy@holdkey.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use strictly necessary cookies to maintain your session and authenticate you. We do not use advertising or third-party tracking cookies.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest, role-based access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For any privacy-related queries or to exercise your rights:

Holdkey Ltd
Privacy: privacy@holdkey.co.uk
General support: support@holdkey.co.uk