Privacy Policy

1. Who We Are

Frist is operated by Oshylabs Ltd, a company registered in England and Wales, company number 16883720, registered office 100 St Pier Court, 549 Green Street, London E13 9GU. We are registered with the Information Commissioner's Office, registration number C1892619. You can reach us about privacy matters at arnold.oshenye@oshylabs.eu.

2. Our Two Roles

Frist handles personal data in two different roles and your rights depend on which applies.

As a controller, we decide how we handle the account, billing, and website data of the landlord organisations and staff who use Frist. This policy governs that data.

As a processor, we handle the resident personal data that a landlord enters into Frist. Here the landlord is the controller and decides why and how that data is used. We only process it on the landlord's documented instructions, under a separate Data Processing Agreement (DPA). If you are a resident and want to exercise your rights, please contact your landlord directly; we will support them in responding.

3. Data We Handle as a Controller

We collect and process the following categories of personal data in our capacity as controller:

Account data: your name, work email address, job role, and the organisation you belong to.

Billing data: payment and invoicing information processed through our payment provider Stripe. We do not store full card numbers.

Usage and log data: sign-in times, actions taken in the application, and technical records needed to run and secure the service.

Support data: any messages or information you send us when contacting support.

4. Resident Data We Process for Landlords

When a landlord uses Frist to manage a hazard case, the platform holds resident names, property addresses, details of the reported hazard and the home's condition, records of contact and access attempts, any vulnerability information the landlord records, and the written summaries produced by the AI drafting feature. We process this data solely to provide the service to the landlord and only on their documented instructions. We do not use resident data for any other purpose.

5. Lawful Bases for the Data We Control

We rely on the following lawful bases under Article 6 UK GDPR for our controller-side processing:

Contract (Article 6(1)(b)): to provide the Frist service to your organisation and fulfil our contractual obligations.

Legitimate interests (Article 6(1)(f)): to operate, secure, monitor, and improve the platform; to prevent fraud and abuse; and to communicate service-related information to existing users. Our legitimate interests in maintaining a secure and functional service are not overridden by your interests or fundamental rights, given the limited intrusiveness of the data involved, your reasonable expectation of such processing as a business user, and the availability of objection rights under Article 21. A Legitimate Interests Assessment is maintained internally and is available on request.

Legal obligation (Article 6(1)(c)): to comply with our accounting, tax, and other statutory obligations.

The lawful basis for processing resident data sits with the landlord as controller. The landlord is responsible for identifying and documenting a valid Article 6 lawful basis for each category of resident data entered into Frist.

6. Special Category Data

Some resident information recorded by a landlord, for example vulnerability details or health-linked information connected to damp and mould conditions, may constitute special category data under Article 9 UK GDPR.

The landlord, as controller, is responsible for identifying a valid Article 9(2) condition for processing such data and for maintaining any required documentation under the Data Protection Act 2018 (DPA 2018), including an appropriate policy document where required by Schedule 1 DPA 2018.

As processor, Oshylabs Ltd processes special category data only on the landlord's documented instructions. Our processing is authorised under Article 9(2)(b) (processing necessary for obligations and rights in the field of employment and social protection law) and Article 9(2)(f) (processing necessary for the establishment, exercise, or defence of legal claims), read together with the applicable Schedule 1 DPA 2018 conditions. An appropriate policy document covering our processing of special category data in this capacity is maintained and available on request.

We apply heightened security controls to special category data, including strict role-based access restrictions and enhanced audit logging.

7. Automated Processing and AI-Generated Outputs

Frist uses an AI language model (provided by Anthropic) to generate written summaries of hazard cases. These summaries are drafts intended to assist landlord staff; they are produced by automated means and may contain errors or omissions.

Nature of AI outputs: AI-generated summaries are not verified facts. They are drafts for human review only and must not be relied upon without verification by a qualified person. Oshylabs Ltd does not warrant the accuracy, completeness, or fitness for purpose of any AI-generated output.

Automated decision-making (Article 22 UK GDPR): Frist is not designed or intended to make decisions that produce legal or similarly significant effects on residents solely by automated means. The AI summaries and evidence packs generated by Frist are tools to support human decision-making by landlord staff, not replacements for it. Landlords, as controllers, must ensure that a qualified human reviews all AI-generated outputs before using them as the basis for any decision that significantly affects a resident, including decisions about hazard categorisation, inspection timelines, or enforcement action. Oshylabs Ltd requires landlords to comply with this obligation under the DPA.

Profiling: Frist does not profile residents for the purpose of evaluating personal characteristics or predicting behaviour.

8. How Long We Keep Data

We keep account and billing data for the duration of the contract and for as long as we are legally required to do so afterwards (ordinarily six years for accounting records under the Companies Act 2006).

Resident data is retained in accordance with the landlord's instructions and their own statutory record-keeping obligations. On termination of the contract, resident data is deleted or returned to the landlord in accordance with the DPA, within the timescales set out therein.

9. Who We Share Data With

We use a carefully selected set of trusted sub-processors to deliver Frist. Each acts under written contract and only on our instructions. We do not sell personal data. Our current sub-processors are:

Supabase: database hosting. Data is hosted in the United Kingdom.

Vercel: application hosting. Vercel Inc. is a US-incorporated entity. Our deployment is configured to route and store application data within the UK/EEA region. Where any data is processed by Vercel infrastructure outside the UK or EEA, we rely on the safeguards described in Section 10 below.

Stripe: payment processing. Stripe is a US-incorporated entity operating globally.

Anthropic: AI language model powering the AI drafting feature. Anthropic is a US-incorporated entity. Resident data submitted for AI summarisation is transmitted to Anthropic's infrastructure for processing.

Email service provider (Resend): delivery of service and transactional messages. Resend is a US-incorporated entity.

A full and current list of sub-processors is set out in the DPA and is updated when sub-processors are added or changed. We will notify landlords of material sub-processor changes in accordance with the DPA.

10. International Transfers

Some of our sub-processors are based outside the United Kingdom and the European Economic Area, including in the United States (Stripe, Anthropic, Resend, and potentially Vercel). Where personal data is transferred outside the UK, we rely on one or more of the following safeguards: the UK International Data Transfer Agreement (IDTA) issued by the ICO; or the UK Addendum to the EU Standard Contractual Clauses (SCCs) together with the EU SCCs (Commission Decision 2021/914) where the EU GDPR also applies.

We have conducted Transfer Impact Assessments (TIAs) for transfers to the United States, having regard to the legal frameworks applicable in that jurisdiction and the technical and contractual safeguards in place. TIAs are maintained internally and are available to landlords on request under the terms of the DPA.

UK-EEA flows: transfers of personal data between the UK and the European Economic Area, and vice versa, are not subject to additional transfer mechanism requirements. The UK has an adequacy regulation in respect of EEA states, and the EU has an adequacy decision in respect of the UK (Commission Decision 2021/1772). No SCCs or IDTAs are required for such flows.

EU GDPR applicability: where a landlord is established in the EEA or processes personal data subject to the EU GDPR, the EU Standard Contractual Clauses (Controller to Processor, Module 2) apply in full to any onward transfers of that data to third countries, pursuant to Commission Decision 2021/914. The relevant SCCs are incorporated into the DPA.

11. How We Protect Data

Each landlord's data is isolated from every other landlord at the database level. Data is encrypted in transit using TLS and encrypted at rest. Access is governed by role-based access controls, and key actions are recorded in an immutable audit log. We retain resident data within the United Kingdom.

We maintain an information security programme proportionate to the risks associated with the data we process, including the processing of special category data.

12. Joint Controllership

Where two or more organisations jointly determine the purposes and means of processing personal data entered into Frist (for example, a housing association and a managing agent acting together in respect of the same residents), a joint controller relationship under Article 26 UK GDPR may arise between those organisations. Oshylabs Ltd is not a joint controller in such arrangements. Organisations that operate Frist in a joint controller capacity must notify Oshylabs Ltd in advance and must have in place a joint controller arrangement that satisfies Article 26. We will direct any resident enquiries to whichever controller the resident has a direct relationship with.

13. Your Rights

If we process your personal data as a controller, you have the following rights under UK GDPR:

Access: to obtain a copy of the personal data we hold about you.

Rectification: to require us to correct inaccurate or incomplete data.

Erasure: to request deletion of your data in certain circumstances.

Restriction: to limit the processing of your data in certain circumstances.

Objection: to object to processing based on legitimate interests (Article 21) or for direct marketing.

Portability: to receive your data in a structured, commonly used, machine-readable format where processing is based on contract or consent.

To exercise any of these rights, please email us at arnold.oshenye@oshylabs.eu. We will respond within one month of receiving your request (extendable by a further two months for complex requests, with notice).

If your data is resident data held on behalf of a landlord, please direct your request to that landlord as the controller. We will assist them in responding to your request.

14. Complaints

You may lodge a complaint with us at any time by contacting arnold.oshenye@oshylabs.eu. You also have the right to lodge a complaint with the Information Commissioner's Office at any time: ico.org.uk, 0303 123 1113.

If you are located in the EEA, you may also complain to the supervisory authority of your EU member state of habitual residence or place of work.

15. Changes to This Policy

We may update this policy from time to time. Where changes are material, in particular where they affect your rights or our processing purposes, we will provide at least 30 days' notice by email before the revised policy takes effect. Minor or administrative changes (such as updating contact details or correcting typographical errors) take effect on publication. The date at the top of this policy reflects the date of the most recent update.