Legal
Privacy Notice
Last updated: May 2026
1. Who we are
FixRoute is operated by Chavannes Ltd (Company No. 17198260), a private limited company registered in England and Wales. We are the data controller for personal data processed through this service.
We are registered with the Information Commissioner's Office (ICO) under registration reference ZC142025.
Contact: privacy@fixroute.co.uk
2. What data we collect
- Landlord email address — used to authenticate you and deliver the service.
- Tenant name, email, and phone — provided when reporting a maintenance issue; used to track and communicate about that issue only.
- Contractor name, email, and phone — stored by landlords to assign repair work.
- Maintenance issue descriptions and photos — submitted by tenants as part of a repair report.
- IP address and browser type — stored as a peppered HMAC hash in our security audit log. Used to detect suspicious activity. Retained for 365 days then deleted.
3. Why we collect it (lawful basis)
- Contract performance (Article 6(1)(b) UK GDPR) — to deliver the maintenance coordination service landlords sign up for.
- Legitimate interest (Article 6(1)(f) UK GDPR) — basic security and abuse-prevention processing necessary for the integrity of the service.
4. What we do with your data
We use your data only to deliver the service. We do not sell, rent, or share your data with any third party for marketing purposes.
5. Third-party processors
| Processor | Purpose | Country | Safeguard |
|---|---|---|---|
| Resend | Transactional email delivery | USA | SCCs |
| Railway | Application hosting and database | USA | SCCs |
| Cloudflare R2 | Photo storage | USA | SCCs |
| Sentry | Error monitoring | USA | SCCs |
6. Data retention
- Landlord account data — held until you delete your account at /delete-account. Deletion is permanent and irreversible.
- Maintenance tickets and tenant data — retained while the associated landlord account is active; deleted when the landlord account is deleted.
- Security audit log — retained for 365 days, then permanently deleted automatically.
7. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, or port your data, and to object to processing. To exercise these rights, submit a request at /account/dsar-request. We respond within one calendar month.
8. Cookies
We use only functional cookies necessary to operate the service (keeping you signed in). We do not use advertising or cross-site tracking cookies.
9. Right to complain
If you believe we have not handled your personal data lawfully, you may complain to the ICO at ico.org.uk.