Privacy notice

What we collect

When you apply for membership, you give us:

• Your name, email address and phone number — these are required.
• Optionally: your company, experience, the areas and strategies you buy in, your typical purchase price, capital available, target returns, properties you own or have done, how you heard about us, and anything you choose to add in the free-text box.
• Your contact preferences, including whether you want deal alerts by email or text.

Once you are a member, we also record what you do on the platform:

• Deals you save, view or register interest in.
• Non-disclosure agreements you sign, with your typed name, the date and the version.
• Searches you save so we can alert you, and the alerts we send you — recipient, subject and body are kept.
• Requests for an introduction to a professional.
• Optionally, your funding position — how you buy, your rates, your deposit and LTV, the cash you have available, your target profit and works period, whether you buy in a company, whether this would be an additional property, whether you have a broker or a solicitor in place, and any note you add — so that deals can be modelled on your terms rather than ours.

And there is technical data we hold about every account:

• IP address and a session reference, recorded when you apply (to stop automated abuse of the form) and against actions you take on the platform, in an audit log. The audit log is append-only by design: entries in it cannot be edited or deleted, including by us, because it is the record of what was shown to whom and when.

We do not ask for or store your bank details, card details, identity documents or evidence of your source of funds through this website. Those are part of onboarding, which happens separately once you have asked to proceed with a deal, and they are handled outside this platform. Nothing on this site is a place to send a passport or a bank statement — if a page ever appears to ask you for one, it is not us.

Why, and on what legal basis

• To operate your membership — reviewing your application, giving you access, and dealing with deals you are interested in. Basis: performance of a contract with you, and steps taken at your request before it.
• To match deals to your criteria so we are not sending you things you do not want. Basis: our legitimate interests in running a marketplace that is useful, balanced against your interests. You can change or clear your criteria at any time.
• To send you deal alerts by email or text. Basis: your consent, which you gave separately and can withdraw at any time without affecting your membership.
• To keep records of NDAs, disclosures and verification, and an audit log. Basis: our legal obligations and our legitimate interest in being able to evidence what was shown to whom, and when.
• To protect the platform — rate-limiting the application form and detecting abuse. Basis: our legitimate interest in keeping the service available and honest.

Who else sees it

We use these providers, and they process data on our instructions only:

• Supabase — our database, accounts and file storage. Hosted in the EU (Ireland).
• Vercel — hosting for this website.
• Sentry — tells us when a page on this site breaks, so we find out before you have to tell us. Hosted in the EU (Germany). It is set up to record what went wrong and not who it happened to: no IP address, no cookies, no account details, and nothing you typed into a form. It does not record your screen.
• GoHighLevel — our customer relationship system, based in the United States. A contact record is created there when you apply, carrying your name, email, phone, company and contact preferences, so that we can review and reply to your application. When you register interest in a deal, an opportunity is added to that record. When you sign a non-disclosure agreement, a tag and a dated note are added. Declined applicants keep a contact record there until we delete it, which we do on request.
• Our email provider — for sign-in links, alerts and correspondence.
• WhatsApp (Meta) — where you choose to deal with us that way. Messages there are processed by Meta under their own terms, and we have no control over that. If you would rather we did not use it, tell us and we will use email or telephone.

Some of these are based outside the UK. Where data is transferred, it is done under the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.

We do not sell your data, and we do not share it with other investors, with vendors, or with sourcers. Where you ask us to introduce you to a professional, we pass on only what is needed to make that introduction, and only once you have asked.

If you supply deals to us

Introducers and sourcers who apply to send us deals give us the name of their business or themselves, a trading name, company number and registered office where they have one, contact details, and — for sourcers — their redress scheme, HMRC anti-money-laundering and ICO registration numbers and professional indemnity insurer and expiry date. Introducers make a declaration about how they work, and we stamp it with the date and the version they agreed to. For a sole trader all of this is personal data.

We use it to decide whether to work with you (steps at your request before a contract), to meet our own legal obligations about who we take deals from, and — for the registration and insurance details — because the law requires us to check them before a deal of yours is listed. Stream staff see it; investors do not. We keep it while we work together and for six years afterwards, which is how long a claim about a deal could still be brought, and the declaration is kept for the same period.

How long we keep it

We keep your information for as long as we are entitled to, and no longer. In practice that means:

• While you are a member, and for six years after you stop being one. Six years is how long a claim arising from a deal could still be brought, so it is the period in which we might need the record to answer one.
• Anti-money-laundering and identity checks: five years from the end of our relationship. That period is set by the regulations, which require us to keep the records and then to delete them.
• An application that does not become a membership: twelve months, so we can explain a decision if you ask, and then it goes.
• Marketing permissions: until you withdraw them. We keep a note that you asked us to stop, because that is the only way to honour it.

You can ask us to delete your information at any time and we will, except where the law requires us to keep something — the anti-money-laundering records above are the usual case, and we will tell you if that applies to you. The audit log is not deleted; if you ask us to erase your account, your name and contact details are removed from it and the entries remain against an anonymous reference, so the record of what happened survives without identifying you.

Two things survive an erasure, and both exist to protect you. If you have asked us to stop contacting you, we keep the email address or the phone number itself on a do-not-contact list — not attached to an account, just the address. It is the only way to be sure we do not write to you again, including if you sign up once more by accident, and deleting it would quietly undo the thing you asked for. We also keep the record of each permission you gave or withdrew, when, and the exact words you were shown at the time. That record cannot be edited by anyone here, which is the point of it: it is how we can show what you agreed to, and how you can hold us to it.

Your rights

You can ask us to:

• Give you a copy of what we hold about you.
• Correct anything that is wrong.
• Delete your account and your data, subject to records we must keep by law and the audit log described above.
• Send your data to you or someone else in a portable format.
• Stop using it for a particular purpose, or object to our legitimate interests.
• Withdraw consent to marketing, at any time, without affecting anything else.

Ask us at info@streampropertygroup.co.uk and we will respond within one month.

Cookies

We set one kind of cookie: the one that keeps you signed in. It is strictly necessary for the site to work, so it does not require your consent and there is no banner asking for it. We do not use advertising or tracking cookies, and we do not run third-party analytics that profile you.

Complaining

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Stream Property Group Ltd, registered in England and Wales, company number 14438611, registered office Unit 12 Manston Industrial Park, Manston, Ramsgate, CT12 5GT. We are registered with the Information Commissioner’s Office as a data controller, registration number ZB521266.