Privacy policy.

1. Who we are

HabiTrak is a management platform for UK supported housing. It is operated by Habitrak Software Ltd, a company registered in England & Wales (company number 16518603) ("HabiTrak", "we", "us", "our").

HabiTrak helps registered providers, managing agents, support workers, residents and maintenance engineers manage tenancies, support and compliance across supported housing. This policy explains how we handle personal data and applies to our marketing website (habitrak.co.uk) and to the HabiTrak apps for iOS (Apple App Store) and Android (Google Play).

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Our role: controller and processor

Data protection law distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" (who processes data on a controller's instructions). Our role depends on the data in question.

Resident and operational data — we are the processor

When a housing provider or managing agent organisation uses HabiTrak to record and manage information about residents, tenancies, support and compliance, that organisation is the data controller and HabiTrak acts as a data processor, processing that data only on the provider's documented instructions. The provider remains responsible for the lawful basis, notices and data-subject responses for this data. Our processing on their behalf is governed by a data processing agreement (see our Terms).

Account, prospect and website data — we are the controller

For data about the people who sign up for and administer HabiTrak accounts, prospects who contact us, and visitors to our website, HabiTrak is the controller. The sections below on lawful bases, your rights and our contact details apply to that data.

3. What data we collect and why

Account and contact data (HabiTrak as controller)

When you register for or administer an account, or contact us, we collect data such as your name, work email address, organisation, job role and the content of your enquiries. We use this to create and manage accounts, provide support, and communicate with you about the service.

Usage and device data (HabiTrak as controller)

When you use the website or apps we may collect technical data such as device or browser type, operating system, IP address, and basic information about how the service is used, for operational and security purposes. We do not use third-party advertising or analytics trackers, and we do not collect precise real-time location data from your device.

Resident personal data, including special-category data

Providers and their staff input personal data about residents in order to deliver and evidence supported housing. This includes special-category data within the meaning of UK GDPR Article 9 — for example data concerning health, mental health, substance use, risk assessments and support plans — alongside tenancy, incident and compliance records.

We process this data on the provider's behalf as a processor, only to provide the platform and on the provider's instructions. We do not use resident data for our own purposes, and we do not sell personal data.

4. Lawful bases under UK GDPR

For the data for which we are the controller (account, prospect and website data), we rely on the following Article 6 bases:

• Contract — to set up and operate accounts and provide the service to the customer organisation and its users.
• Legitimate interests — to secure, maintain and improve the service, respond to enquiries, and carry out limited business-to-business marketing, balanced against your rights.
• Legal obligation — where we must process data to comply with the law.
• Consent — where we ask for it, for example optional marketing communications. You can withdraw consent at any time.

For resident personal data, the controlling provider determines the lawful basis. Where special-category data is processed, the provider relies on a condition under UK GDPR Article 9 — typically Article 9(2)(h) (provision of health or social care) or Article 9(2)(g) (substantial public interest) — together with the associated condition in Schedule 1 of the Data Protection Act 2018. HabiTrak processes such data only as the provider's processor, under the data processing agreement and on their documented instructions.

5. Sub-processors and third parties

We rely on Amazon Web Services (AWS) as our infrastructure provider (sub-processor) to host and run the service. AWS processes personal data only on our instructions and under contract, and we remain responsible for the data we entrust to it. We use AWS for:

• cloud hosting and storage (Amazon S3 and Amazon CloudFront);
• user authentication and account sign-in (Amazon Cognito);
• sending service and verification emails (Amazon SES).

Our AWS services are configured in the United Kingdom (London region). We do not use third-party advertising, analytics or tracking services, and we do not sell personal data or share it with third parties for their own marketing.

6. International transfers

Personal data is stored and processed in the United Kingdom. We do not routinely transfer your personal data outside the UK. If that ever changes, we will put appropriate safeguards in place — such as UK adequacy regulations or the International Data Transfer Agreement — and update this policy.

7. Data retention

We keep account and contact data for as long as your organisation maintains a HabiTrak account, and delete it within 90 days after the account is closed. We keep technical and security logs for up to 12 months.

Resident data is retained in line with the controlling provider's instructions and their own legal and housing-sector retention obligations. On termination of a provider's account we return or delete resident data in accordance with the data processing agreement.

8. Your rights

Under UK GDPR you have rights over your personal data, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing.

For data where HabiTrak is the controller (account, prospect and website data), you can exercise these rights by contacting us using the details below, or via our data deletion page.

If you are a resident and wish to exercise rights over data held about you in HabiTrak, your housing provider or managing agent is the controller of that data, so such requests are routed to and handled by them. We will support our provider customers in responding to those requests as their processor.

9. Security

We maintain organisational and technical measures designed to protect personal data, including role-based access controls, restricting access to authorised personnel on a need-to-know basis, encryption of data in transit, and logging and monitoring. We keep these measures under review. No system can be guaranteed fully secure, and we do not over-state the protection any technology can provide.

For a fuller summary of our hosting architecture and our responsibilities as a processor, see our GDPR compliance page.

10. Children

HabiTrak is a tool for housing professionals and is not directed at children. Residents supported through the platform may include young adults; any data about residents is entered by provider staff and processed on the provider's instructions. We do not knowingly collect personal data from children under 13 through our public website.

11. Cookies and website analytics

Our marketing website does not use analytics, advertising or tracking cookies, and does not set non-essential cookies. The HabiTrak apps use only strictly necessary cookies and tokens — for example to keep you securely signed in. If we introduce non-essential cookies in future, we will ask for your consent first and update this policy.

12. Changes

We may update this policy from time to time. When we do, we will revise the effective date below and post the updated policy on this page. Significant changes will be communicated to account holders where appropriate.

This policy is effective from 2 June 2026.

Contact us

For any privacy questions, or to exercise your rights in respect of data we control, please contact us at support@habitrak.co.uk.