Privacy Policy

1. About This Policy

This Privacy Policy explains how Percy Real Estate Ltd, trading as Bloc (“we”, “us”, “our”), collects, uses, stores, shares, and protects personal data in connection with the Bloc platform and any associated services, tools, integrations, or features (collectively, the “Platform”).

This policy applies to:

• All visitors to the Bloc website or platform;
• All registered users, workspace owners, team members, and administrators;
• All estate agencies, organisations, and business customers who access the Platform;
• All individuals whose personal data is uploaded, imported, managed, or processed within the Platform by workspace users;
• All contacts, leads, vendors, landlords, tenants, buyers, sellers, and third parties whose data is handled within any Bloc workspace.

This policy should be read alongside our Terms and Conditions and any Data Processing Agreement (“DPA”) entered into separately between Percy Real Estate Ltd and a business customer.

By accessing or using the Platform, you confirm that you have read and understood this Privacy Policy. If you do not accept this policy, you must cease using the Platform immediately.

2. Definitions and Interpretation

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below.

In this policy, references to “you” mean the User or, where the context requires, a Data Subject whose personal data is processed via the Platform. References to “we”, “us”, or “our” mean Percy Real Estate Ltd.

3. Who We Are

Percy Real Estate Ltd is registered as a data controller with the Information Commissioner's Office.

4. Our Role as Data Controller and Data Processor

The capacity in which Percy Real Estate Ltd acts in respect of personal data depends upon the context in which that data is processed. This distinction is important and has direct implications for your rights and our obligations.

4.1 Where We Are a Data Controller

Percy Real Estate Ltd acts as a Data Controller in respect of:

• Personal data provided directly to us when you create an account, register for the Platform, or contact us;
• Personal data collected automatically through your use of the Platform, including usage data, technical data, and cookies;
• Personal data processed for platform security, fraud prevention, abuse detection, legal compliance, and regulatory obligations;
• Personal data processed for our own analytics, product improvement, and operational purposes;
• Personal data processed in connection with our marketing activities where applicable and with appropriate consent or legitimate interest.

4.2 Where We Are a Data Processor

Percy Real Estate Ltd acts as a Data Processor in respect of personal data that is uploaded, imported, or entered into the Platform by Workspace Owners, estate agencies, and their authorised team members. This includes contact records, lead information, client data, property information, transaction data, uploaded documents, and any personal data processed by Users through third-party integrations configured within their Workspace.

Where we act as a Data Processor, the Workspace Owner or business customer is the Data Controller and is solely responsible for ensuring that personal data was collected lawfully, that a valid legal basis exists for processing, that data subject rights requests are addressed, and that all applicable data protection legislation is complied with.

Where required by UK GDPR, Workspace Owners and business customers should ensure that a Data Processing Agreement is in place with Percy Real Estate Ltd. Please contact us at [email protected] to request a copy of our standard DPA.

4.3 Joint Controllership

In limited circumstances, Percy Real Estate Ltd and a business customer may jointly determine the purposes and means of processing. Where this occurs, we will document the respective responsibilities of each party. Users or Data Subjects may exercise their rights against either party.

5. Data We Collect

We collect and process the following categories of personal data, depending on how you interact with the Platform.

5.1 Account and Registration Data

• Full name, email address, and phone number;
• Password (stored in encrypted form);
• Job title, professional role, and organisation name;
• Billing and account information;
• Preferences and communication settings.

5.2 Contact and CRM Data

Where Users upload, import, or create contact records within a Workspace, we process data on behalf of the relevant Workspace Owner. This may include names, email addresses, telephone numbers, property search preferences, transaction and property management data, notes and interaction records, documents, and compliance and identification data held in connection with anti-money laundering obligations.

5.3 Property Data

Property addresses, descriptions, attributes, valuations, pricing and marketing data, sales and lettings progression records, maintenance and inspection records, and associated landlord, tenant, and applicant information.

5.4 Messaging and Communication Data

Message content where stored or logged by the Platform; communication metadata including sender, recipient, timestamp, and delivery status; WhatsApp account identifiers and session metadata; email headers and integration metadata; and calendar event data and attendee information.

5.5 Usage and Activity Data

Pages and features accessed, clicks, and navigation paths; CRM activity logs; workflow and automation activity; team member activity within a Workspace; error logs; and diagnostic information.

5.6 Technical and Device Data

IP address; browser type and version; operating system and device type; screen resolution; referring URL and exit pages; cookie identifiers and session tokens; and network and connectivity information.

5.7 AI-Generated Data

Inputs provided to AI tools (which may include personal data); AI-generated suggestions, summaries, drafts, and outputs; records of automated actions performed on behalf of Users; and feedback provided by Users on AI outputs.

5.8 Document and File Data

Where Users upload documents or files to the Platform, we process the content and metadata of those files. This may include personal data such as identification documents, contracts, tenancy agreements, and correspondence.

5.9 Integration Data

Where Users connect third-party services to the Platform, we may process data made available through those integrations in accordance with this policy and the terms of the relevant integration.

5.10 Financial and Transactional Data

Billing information associated with Platform subscriptions. Payment card details are processed directly by our third-party payment providers and are not stored on our systems.

5.11 Support and Communications Data

When you contact us for support or otherwise communicate with us, we retain records of that correspondence and any personal data included within it.

6. How We Collect Your Data

We collect personal data through the following means:

• Directly from you when you register, complete forms, set up integrations, or contact support;
• Automatically through cookies, tracking technologies, and server logs when you access the Platform;
• From Workspace Owners and authorised users when they upload, import, or create data within a Workspace;
• Through integrations when you connect third-party services such as Google, Microsoft, WhatsApp, or APIs;
• From Matchouse and associated platforms where your data is shared between Bloc and Matchouse in connection with linked features;
• From publicly available sources in limited circumstances, such as the Land Registry, Companies House, or public professional directories where relevant to the Platform's operation.

7. How and Why We Use Your Data

8. Legal Bases for Processing

8.1 Performance of a Contract

We process your personal data where it is necessary for the performance of a contract to which you are party, or to take steps at your request before entering into a contract. This applies to the creation and management of your account, the provision of Platform features, and the fulfilment of subscription services.

8.2 Compliance with a Legal Obligation

We process personal data where it is necessary for compliance with a legal obligation to which we are subject, including obligations under UK data protection law, financial regulation, and anti-money laundering requirements.

8.3 Legitimate Interests

We process personal data where it is necessary for the purposes of our legitimate interests, except where those interests are overridden by your fundamental rights and freedoms. Our legitimate interests include ensuring platform security, fraud prevention, product improvement, and direct marketing to existing and prospective business customers subject to your right to object.

8.4 Consent

Where we rely on consent as our legal basis, we will obtain it clearly and specifically before processing begins. You may withdraw consent at any time without affecting the lawfulness of prior processing. We rely on consent for non-essential cookies and direct marketing communications to individuals who are not existing customers where required by PECR.

8.5 Processing as a Data Processor

Where we act as a Data Processor, our legal basis for processing is the documented instruction of the Data Controller, who is responsible for ensuring that their own processing activities are conducted on a valid legal basis.

9. Communication Integrations

9.1 Email Integrations

Users may connect email accounts to the Platform, including Google (Gmail / Google Workspace) and Microsoft (Outlook / Microsoft 365) accounts. Where enabled, the Platform accesses email content, contact information, and metadata to the extent authorised during integration setup, solely for the purposes of providing CRM and communication functionality. Users are solely responsible for ensuring that any emails sent through or synced with the Platform are sent lawfully and in compliance with applicable law including PECR.

9.2 Calendar Integrations

Where calendar integrations are enabled, the Platform processes calendar event data including attendee details, meeting titles, descriptions, and scheduling information, solely to provide scheduling and workflow functionality.

9.3 WhatsApp Integrations

Please refer to Section 10 of this policy for detailed information regarding WhatsApp integrations.

9.4 API and Third-Party Integrations

The Platform may integrate with third-party CRM systems, property portals, marketplace platforms, lead generation services, and other APIs. Users are responsible for ensuring that data exchanged through such integrations is processed lawfully. Third-party services operate under their own terms and privacy policies, for which Percy Real Estate Ltd bears no responsibility.

9.5 User Responsibility for Communications

Users are solely responsible for ensuring that all communications initiated through the Platform comply with PECR, UK GDPR, the Data Protection Act 2018, any applicable industry-specific rules, and the terms of the relevant third-party communication service.

10. Messaging and WhatsApp

10.1 WhatsApp Integration Overview

Where Users enable WhatsApp integration within their Workspace, the Platform facilitates the sending and receipt of WhatsApp messages between Users and their contacts via approved WhatsApp Business API services. By enabling this integration, Users expressly acknowledge and agree to the terms in this section.

10.2 Who Initiates Messages

Bloc does not independently initiate WhatsApp messages to any individual. All messages sent via the WhatsApp integration are initiated, composed, and sent by Workspace Users. Percy Real Estate Ltd acts as a technical intermediary only and does not exercise editorial control over message content.

10.3 User Responsibility

Users who utilise the WhatsApp integration are solely responsible for ensuring that valid, freely given consent has been obtained from message recipients; that messages comply with all applicable legislation including PECR; that messages are not unsolicited, misleading, or in breach of consumer protection standards; and that use complies with WhatsApp's Business Terms of Service and Acceptable Use Policy.

10.4 Platform Monitoring

Percy Real Estate Ltd reserves the right to monitor system-level activity within the Platform, including WhatsApp integration activity, for the purposes of spam detection, abuse and harassment detection, fraud prevention, platform integrity monitoring, and compliance with applicable law. Such monitoring does not constitute editorial review of message content.

10.5 Consequences of Misuse

Where Percy Real Estate Ltd reasonably determines that a User has used the messaging or WhatsApp integration to send spam or unsolicited communications, breach applicable law, engage in scraping or automated misuse, violate WhatsApp's terms, or cause harm to recipients, Percy Real Estate Ltd reserves the right to suspend or terminate access to the integration, the relevant Workspace, or the User's account, without liability to the User.

10.6 WhatsApp Metadata

The Platform may process WhatsApp metadata, including sender and recipient identifiers, message timestamps, delivery and read statuses, and session data, in order to provide the integration service. Such metadata is stored only for as long as necessary for the purposes set out in this policy.

11. AI-Assisted Tools and Automations

11.1 Overview

The Platform may include AI-assisted tools and automated features designed to assist Users with tasks such as drafting communications, summarising data, generating suggestions, creating workflow automations, and providing analytical insights (collectively, “AI Features”). These features are provided to assist Users and do not constitute professional advice of any kind.

11.2 Accuracy and Reliability

AI-generated suggestions, summaries, classifications, and outputs are produced by machine learning models and may not always be accurate, complete, or appropriate for the User's specific circumstances. Percy Real Estate Ltd does not warrant or guarantee the accuracy, reliability, or suitability of any AI-generated output.

11.3 No Professional Advice

No content, suggestion, or output generated by any AI Feature constitutes legal, financial, regulatory, investment, valuation, or any other form of professional advice. Users requiring such advice must consult an appropriately qualified professional.

11.4 Data Processing by AI Features

Inputs provided to AI Features — including personal data — may be processed by our AI models and infrastructure for the purpose of generating the requested output. Such processing is carried out in accordance with this Privacy Policy, on the instructions of the relevant Data Controller, and subject to appropriate security controls.

Where personal data is included in AI Feature inputs, Users and Workspace Owners are responsible for ensuring that such processing is lawful and that affected individuals have been given appropriate notice.

11.5 Use of Data for Platform Improvement

Aggregated and anonymised insights derived from AI Feature usage may be used to improve Platform functionality, model performance, and service quality. We will not use personally identifiable data for model training without appropriate safeguards and, where required, consent.

11.6 Automated Decision-Making

Where the Platform performs automated processing that produces decisions with significant legal or similarly significant effects on individuals, we will ensure appropriate safeguards are in place and that affected individuals are informed of their rights under UK GDPR Article 22.

12. Marketplace and Matchouse Ecosystem

12.1 Integration with Matchouse

Bloc is associated with the Matchouse platform, a property marketplace ecosystem operated by Percy Real Estate Ltd. Where Users access features integrated with Matchouse, data may be shared between the two platforms in connection with those features.

12.2 Scope of Integration

The integration may include lead management, profile visibility, messaging systems, service requests and booking, property publishing and syndication, smart matching, and collaboration tools, depending on the features enabled within your Workspace.

12.3 Data Flows and Responsibility

Where data flows between Bloc and Matchouse, it does so subject to this Privacy Policy and the Matchouse Privacy Policy. Workspace Owners who push contact or property data to Matchouse-integrated features are responsible for ensuring that affected individuals have been given appropriate notice of such data use.

13. Cookies and Tracking Technologies

13.1 What Cookies Are

Cookies are small text files placed on your device when you visit a website or use a web application. We use cookies and similar technologies within the Platform and on our website.

13.2 Types of Cookies We Use

13.3 Managing Cookies

Upon your first visit, you will be presented with a cookie consent banner through which you may accept or reject non-essential cookies. You may change your preferences at any time through the cookie settings in your account or via your browser settings. Disabling certain cookies may affect Platform functionality.

13.4 Third-Party Cookies

Some cookies on the Platform are set by third parties whose services we have embedded, such as analytics and performance monitoring providers. We do not control these cookies. Please refer to the relevant third party's privacy policy for further information.

14. Data Sharing and Third Parties

14.1 Our Approach to Sharing

We do not sell personal data to third parties. We do not share personal data with third parties for their own marketing purposes without your explicit consent.

14.2 Service Providers and Sub-Processors

We engage trusted third-party service providers to assist us in operating the Platform. These providers process personal data on our behalf subject to written contractual terms requiring them to maintain appropriate security and comply with UK GDPR. Our service providers include:

• Cloud infrastructure and hosting providers;
• Analytics providers to understand Platform usage;
• Email and notification providers for transactional communications;
• Customer support platforms for helpdesk management;
• Payment providers who independently process payment card data;
• WhatsApp Business API providers operating in compliance with Meta's platform requirements;
• AI and machine learning infrastructure providers;
• Security and monitoring providers for threat detection and platform security.

14.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the relevant successor entity. We will notify affected users of any such transfer where required by law.

14.4 Legal and Regulatory Disclosures

We may disclose personal data where required by applicable law, court order, or at the request of a competent authority. Where permitted, we will endeavour to notify you in advance.

14.5 Protection of Rights

We may disclose personal data where reasonably necessary to protect the rights, property, or safety of Percy Real Estate Ltd, our Users, or any third party, or to detect or prevent fraud, abuse, or unlawful activity.

14.6 With Your Consent

We may share personal data with third parties in any other circumstance where you have provided explicit, informed consent.

15. International Data Transfers

Percy Real Estate Ltd is based in England and Wales. We may transfer personal data to countries outside the United Kingdom. Where we do so, we ensure appropriate safeguards are in place in accordance with UK GDPR, which may include:

• Transfers to countries deemed to provide adequate protection by the Secretary of State under UK adequacy regulations;
• Use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• Other lawful transfer mechanisms recognised under UK GDPR and the Data Protection Act 2018.

For further information, please contact us at [email protected].

16. Data Security

16.1 Our Commitment to Security

Percy Real Estate Ltd implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include:

• Encryption of data in transit using industry-standard TLS protocols and encryption at rest for sensitive data;
• Access controls on a role-based and need-to-know basis with multi-factor authentication for privileged access;
• Workspace isolation ensuring data held in one Workspace cannot be accessed by users of another;
• Audit logs of significant User actions and system events retained for security and compliance purposes;
• Security monitoring using automated tools and manual processes for threat detection and incident response;
• Vendor security requirements imposed on all third-party service providers and sub-processors;
• Periodic security assessments including penetration testing and code reviews.

16.2 No Absolute Guarantee

No method of data transmission or storage is entirely secure. Whilst we take all reasonable steps to protect personal data, we cannot guarantee absolute security. In the event of a data breach likely to result in risk to the rights and freedoms of individuals, we will notify the ICO and, where required, affected individuals, in accordance with UK GDPR.

16.3 User Responsibilities

Users are responsible for maintaining the confidentiality of their account credentials. You should use a strong, unique password and must not share your login credentials with any other person. Please notify us immediately at [email protected] if you suspect your account has been compromised.

17. Data Retention

17.1 Retention Principles

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, in accordance with our legal obligations, and as required to protect our legitimate interests.

17.2 Account and User Data

Personal data associated with your account is retained for the duration of your account and for a period following closure to allow us to complete outstanding obligations, comply with legal requirements, resolve disputes, and defend or assert legal claims. In most cases, account data is retained for no longer than seven years following account closure, unless a longer period is required by law.

17.3 CRM and Workspace Data

Data held within a Workspace is retained for as long as the Workspace remains active. Upon closure or deletion, we retain a copy in secure backup systems for up to 90 days to facilitate recovery. Following expiry of the backup retention period, Workspace data is deleted in accordance with our data deletion procedures, subject to legal retention requirements. Workspace Owners may request earlier deletion by contacting us at [email protected].

17.4 Legal Retention Requirements

Certain data may be subject to minimum or mandatory retention periods under applicable law, including financial records, transaction data, and compliance documentation. We will retain such data for the periods required by law.

17.5 Anonymisation

Where it is not practicable to delete data within the applicable retention period, we will anonymise that data so that it can no longer be attributed to an identifiable individual.

18. Your Rights Under UK GDPR

Under UK GDPR and the Data Protection Act 2018, Data Subjects have the following rights. The availability of these rights depends upon the circumstances and legal basis for processing, and some rights may be subject to exemptions or limitations.

To exercise any of the above rights, please contact us at [email protected]. We may request proof of identity before processing your request and will not charge a fee except in limited circumstances where a request is manifestly unfounded or excessive.

19. Children

The Platform is intended for use by adults and is not directed at, or intended to be used by, individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe your child has provided personal data to us, please contact us immediately at [email protected] and we will take prompt steps to delete such data.

20. Workspace Users and Business Customers

20.1 Responsibilities of Workspace Owners

Where a business customer or estate agency creates a Workspace on the Platform and uploads, imports, or processes personal data within it, the Workspace Owner is the Data Controller for that data and is solely responsible for ensuring lawful collection, providing appropriate privacy notices, identifying a valid legal basis for each processing activity, ensuring compliant use of integrations and automations, responding to data subject rights requests, and complying with anti-money laundering and other regulatory requirements.

20.2 Team Members

Where a Workspace Owner invites team members, the Workspace Owner is responsible for ensuring that each team member is authorised to access and process the relevant data and that appropriate data protection obligations have been communicated.

20.3 Data Processing Agreement

Business customers requiring a Data Processing Agreement should contact [email protected]. Processing on behalf of business customers is subject to the terms of any applicable DPA.

21. Liability and User Responsibilities

21.1 Software Tools Only

The Platform provides software tools and services to assist estate agencies, property professionals, and other business users in managing their operations. Percy Real Estate Ltd does not provide legal, financial, regulatory, investment, or professional advice through the Platform or any of its features.

21.2 User Compliance Obligations

Users remain solely and fully responsible for ensuring that their own business operations, communications, data management practices, and use of Platform features comply with all applicable laws and regulations, including UK GDPR, the Data Protection Act 2018, PECR, anti-money laundering legislation, consumer protection and fair trading laws, and estate agency regulation.

21.3 User Content and Uploaded Data

Percy Real Estate Ltd is not responsible for the accuracy, lawfulness, or appropriateness of any data, content, or documents uploaded to the Platform by Users. Users warrant that any personal data they upload, import, or create was obtained lawfully, is processed on a valid legal basis, does not infringe the rights of any third party, and does not violate any applicable law or regulation.

21.4 Third-Party Misuse

Percy Real Estate Ltd is not responsible for the actions of third parties who gain unauthorised access to a User's account or Workspace as a result of the User's failure to maintain adequate account security, or as a result of third-party security incidents outside of our control.

21.5 Integration and Third-Party Services

Percy Real Estate Ltd is not responsible for the terms, practices, performance, or data handling of third-party services connected to the Platform by Users. Users should review the privacy policies and terms of service of any third-party services they connect.

21.6 Limitation

Nothing in this section limits Percy Real Estate Ltd's liability in respect of matters that cannot be excluded or limited by law, including liability for fraud or fraudulent misrepresentation, or in respect of our obligations as a Data Processor under any applicable DPA.

22. Changes to This Policy

22.1 Our Right to Update

Percy Real Estate Ltd reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in applicable law, changes to our Platform or services, or changes to our data processing activities.

22.2 Notification of Changes

Where we make material changes, we will notify you by displaying a prominent notice on the Platform, sending an email notification to the address registered to your account, and updating the “Last Updated” date at the top of this policy.

22.3 Continued Use

Your continued use of the Platform following publication of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree, you must cease using the Platform and may close your account by contacting us.

22.4 Version Control

We retain historical versions of our Privacy Policy, which are available upon request by contacting [email protected].

23. Contact Us and Complaints

23.1 Contact Details

23.2 Exercising Your Rights

To submit a data subject rights request, including a Subject Access Request, please email [email protected] with the subject line “Data Rights Request”, your full name, the email address associated with your account, and a description of your request. We will respond within one calendar month.

23.3 Complaints

If you are dissatisfied with our handling of your personal data or our response to a rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We would appreciate the opportunity to address your concerns before you approach the ICO, and encourage you to contact us in the first instance.