Controller, processor and security summary
Mayfair Atrium Limited acts as controller for its own account administration, security, billing, product governance, legal compliance and support processing. A landlord, company or property manager may act as an independent controller for tenant and property-management data entered into Property Desk. Where Mayfair Atrium Limited handles such data only on the customer's documented instructions, a processor relationship may arise.
Processing is carried out to provide, secure, maintain, support and improve the subscribed Property Desk functions for the duration of the customer relationship and any lawful retention period.
Activities may include storage, retrieval, structured display, OCR/document extraction, backup, malware scanning, generation of reports, communications routing, technical support, security monitoring, audit logging and deletion or anonymisation under the retention schedule.
Account/contact details, tenant and tenancy information, rent and payment status, deposit information, property and maintenance records, uploaded documents/photos, communications, account security/audit records and other information chosen by authorised users.
Landlords, company representatives, tenants, prospective or former tenants where retained lawfully, agents, contractors, accountants, other authorised contacts and support users.
Access is restricted according to role and operational need. Personnel and authorised suppliers handling personal data must be subject to appropriate confidentiality and security obligations.
Measures are designed to include HTTPS, MFA, strong credential storage, access controls, audit logging, backup and restore controls, upload validation, malware scanning/quarantine, production secret management and vulnerability/incident processes.
Production hosting, storage, backup, OCR, security, communications, payment and support providers may act as sub-processors where applicable. The live production provider register should be maintained and contractual safeguards applied.
Where Mayfair Atrium Limited acts as processor, it will use reasonable measures to support relevant data-subject requests, security incidents, DPIAs and regulatory obligations in accordance with applicable contracts and law.
On termination, data is returned, deleted, anonymised or retained only where there is a lawful reason or documented retention requirement. Shared tenancy/legal records may not be erased merely because one portal account is closed.
Where a supplier processes data outside the UK, appropriate transfer mechanisms and safeguards will be used where required.
Data-processing enquiries: info@mayfairatrium.com.
