GDPR and Data Protection

1. Overview

Percy Real Estate Ltd (trading as “Bloc”), Company Number 15525233, registered at 25 Cabot Square, Canary Wharf, London E14 4QZ, is the data controller for personal data collected directly from visitors to this website and from individuals who register for the Platform.

Where Bloc processes personal data on behalf of estate agency customers using the Platform, we act as a data processor and those customers are the data controllers. This dual role is explained in Section 11.

This notice should be read alongside our Privacy Policy (which covers broader privacy practices).

2. Data Controller Details

We are registered with the Information Commissioner's Office (ICO) as a data controller as required by the Data Protection Act 2018. Our ICO registration can be verified at ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/.

3. What Personal Data We Collect

Website Visitors

• Device and browser information (anonymised) collected via analytics tools.
• IP address (anonymised or truncated before storage).
• Pages visited, time on page, and referral source.
• Contact details submitted via enquiry forms (name, email, company, message).

Platform Users (Account Holders)

• Name and email address provided at registration.
• Password (stored as an irreversible hash; we cannot read your password).
• Job title and company name.
• Profile photo, if voluntarily uploaded.
• Activity logs: login times, features used, and actions taken within your Workspace.
• Communications with our support team.
• Billing name and address (payment card details are held by our payment processor, not by us).

CRM Data (Processed on Behalf of Customers)

Estate agency customers upload and manage personal data relating to their own clients, including vendors, buyers, landlords, tenants, and applicants. This data is described in the customer's own privacy notices. Bloc processes this data as a data processor under the customer's instructions (see Section 11).

4. Lawful Bases for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

Where we process special category data (Article 9), such as health information relevant to a tenancy, we rely on explicit consent or another condition under Article 9(2) as appropriate.

5. How We Use Your Data

• To create and manage your Bloc account and Workspace.
• To provide, operate, maintain, and improve the Platform.
• To process your Subscription payments and send billing records.
• To send service notifications, security alerts, and essential product updates.
• To provide customer support and respond to enquiries.
• To measure and analyse platform usage using anonymised analytics (PostHog).
• To send marketing communications to you where you have opted in or where we have a legitimate interest as an existing customer. You may opt out at any time.
• To comply with our legal and regulatory obligations.
• To prevent fraud, abuse, and security threats.
• To enforce our Terms of Service.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

6. Sharing and Processors

We share personal data only with trusted sub-processors that are necessary to operate the Platform, and only to the extent required for those purposes. All sub-processors are bound by data processing agreements. Our current sub-processors are:

We may also disclose personal data to: (a) law enforcement or government authorities where required by law; (b) our professional advisers (lawyers, accountants, auditors) under confidentiality obligations; (c) a successor entity in the event of a merger, acquisition, or sale of assets, in which case we will notify you in advance.

7. International Transfers

Some of our sub-processors are based outside the UK. Where we transfer personal data to countries that do not benefit from a UK adequacy decision, we rely on one or more of the following safeguards:

• UK International Data Transfer Agreements (IDTAs) or addenda to the EU Standard Contractual Clauses (SCCs) approved for UK use.
• The UK adequacy decision for EEA transfers.
• The UK-US Data Bridge where applicable.

You may request a copy of the relevant transfer mechanism by contacting [email protected].

8. Retention Periods

After the applicable retention period, personal data is securely deleted or anonymised. Where anonymisation is not possible (e.g. backup tapes), data is isolated and not accessed until it is overwritten or destroyed.

9. Your Rights

Under the UK GDPR you have the following rights. We will respond to valid requests within one calendar month (extendable by a further two months for complex requests, with notice):

10. Exercising Your Rights

To exercise any of your rights, contact us at [email protected] with the subject line “Data Subject Request”. Please include:

• Your full name and the email address associated with your Bloc account.
• A clear description of the right you wish to exercise and the data concerned.
• Any information that will help us locate your data quickly.

We will acknowledge your request within 72 hours and respond fully within one calendar month. We may ask you to verify your identity before processing the request. We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we will notify you before charging.

If your request relates to data processed by Bloc on behalf of an estate agency customer (e.g. your personal details in their CRM), you should contact that agency directly. We will forward requests to the relevant customer where we are able to identify them.

11. Bloc as Data Processor (Business Customers)

When estate agency customers use the Platform to manage their own client data (vendors, buyers, landlords, tenants, applicants), Bloc acts as a data processor and the customer is the data controller.

Data Processing Agreement

A Data Processing Agreement (DPA) is available to all business customers and forms part of the contract between Bloc and those customers. The DPA sets out:

• The subject matter, duration, nature, and purpose of processing.
• The type of personal data processed and categories of data subjects.
• Our obligations as processor, including confidentiality, security, sub-processor notification, and data subject rights assistance.
• Return and deletion of data on termination.
• Our sub-processor list and change notification process.

Customers may request a copy of the DPA or sign the DPA by contacting [email protected].

Customer Responsibilities

Business customers are responsible for ensuring they have a lawful basis for every use of personal data within their Workspace, maintaining an appropriate privacy notice for their own clients, and responding to data subject rights requests in respect of their CRM Data. Bloc will provide reasonable assistance to customers in meeting these obligations.

Security Measures

We implement appropriate technical and organisational measures (TOMs) to protect personal data processed on behalf of customers, including: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, multi-factor authentication, regular penetration testing, and audit logging.

12. Children's Data

The Platform is not directed at, and should not be used to process data of, individuals under the age of 18 except to the minimum extent necessary for a lawful property transaction (for example, where a tenant is a minor co-signatory with parental consent). Bloc does not knowingly collect personal data from children under 13 for any purpose.

If you believe we hold personal data of a child without appropriate authorisation, please contact us immediately at [email protected].

13. Changes to This Notice

We may update this notice at any time to reflect changes in our practices or applicable law. We will notify you of material changes by email or in-app notification at least 14 days before they take effect. The current version is always available at bloc.matchouse.com/gdpr.

We recommend you review this notice periodically. Continued use of the Platform after any changes take effect constitutes acceptance of the updated notice.

14. Contact and Complaints

For any data protection query, subject access request, or concern, please contact:

Complaints to the ICO

If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

We encourage you to contact us first so that we can resolve your concern directly, but you are always entitled to approach the ICO at any stage.