District
Privacy policy
Working draftVersion 0.1-draftNo effective date set
On this page
- 1. Who we are and how to contact us
- 2. Who this policy covers
- 3. Information we collect
- 4. Where information comes from
- 5. Why we use information and our legal bases
- 6. Who can see your information
- 7. Where information is processed
- 8. How long we keep information
- 9. Marketing and cookies
- 10. Your rights
- 11. Privacy complaints
- 12. Automation, AI and changes
Draft v0.1 • Prepared 22 September 2026 • Effective date: [CONFIRM: effective date]
REVIEW DRAFT — NOT FOR PUBLICATION. This is proposed wording for the described launch model, not a statement that every feature or control is already live. Resolve all
[CONFIRM: …]items and optional modules against the implementation before issuing a clean version. Internal drafting instructions are not public policy copy.
1. Who we are and how to contact us
District helps businesses find managed workspace and connect with workspace operators. In this policy, “District”, “we”, “us” and “our” mean District HQ Ltd [CONFIRM: exact registered entity], company number [CONFIRM: company number], registered in [CONFIRM: jurisdiction], with registered office at [CONFIRM: registered office].
For questions, privacy requests or complaints, contact [CONFIRM: monitored privacy email] or write to our registered office, marked “Privacy”. You do not need a District account to contact us about your information.
District is the controller of personal information used for the marketplace, account administration, introductions, platform security and our own business records. A controller decides why and how personal information is used. Workspace operators are normally separate controllers for their own handling of enquiries and workspace agreements. Their privacy information also applies to that handling.
[CONFIRM: controller and processor roles for each workflow. Where District administers an operator's existing tenancies solely on its instructions, describe that service separately, name the responsible operator and provide its privacy notice. Do not publish a blanket independent-controller statement for those activities.]
2. Who this policy covers
This policy covers website visitors, occupier contacts, operator and landlord representatives, invited colleagues, viewing attendees, nominated signatories, professional advisers and people who contact our support team. A business email address or a person's name in a company contract can still be personal information.
District is intended for business workspace enquiries and business users aged 18 or over. It is not designed for children. Please contact us if you believe a child has supplied personal information through the service.
3. Information we collect
The information depends on how you use District:
| Activity | Information involved |
|---|---|
| Accounts and company profiles | Name, business email and telephone number, employer, job title, company details, account role, authentication information, preferences and account activity. |
| Operator onboarding | Business identity, nominated contacts, authority to market workspaces and evidence needed for the checks we actually perform. [CONFIRM: precise checks and whether identity documents are collected.] |
| Workspace searches and enquiries | Location, team size, budget, preferred move-in date, term, saved spaces, enquiry details and the workspace or operator contacted. We associate searches with your account only where the implemented service does so and this has been disclosed. |
| Viewings and communications | Requested and confirmed times, participants, contact details, messages, attachments, viewing changes and relevant correspondence. |
| Contracts, where enabled | Parties, representatives, nominated signatories, professional advisers, document versions, negotiation messages, signature status and execution evidence. [CONFIRM: signature supplier and exact audit information collected.] |
| Commercial and support records | Introduction and transaction references, fee calculations, invoice information, support requests, complaints and records needed to resolve disputes. |
| Website operation | IP address, device and browser information, login and security events, diagnostic information and cookie preferences. Optional tracking is described in our Cookie Policy. |
| Reviews, where enabled | Review text, rating, display name, operator response and information used to check eligibility. [CONFIRM: public author fields and verification process.] |
Please provide only information needed for your enquiry or transaction. Do not upload payment-card details, passports, medical records or other sensitive material unless we have specifically requested it through an appropriate process.
If you need an accessibility adjustment for a viewing, you can describe the practical help required without providing a diagnosis. [CONFIRM: whether District will collect health or other special-category information at all. If necessary, assess the additional legal condition and provide specific information at collection before enabling that workflow.]
4. Where information comes from
We receive information from you when you register, browse, enquire, upload documents, message another participant or contact us. We also receive information from:
- Your employer or an account administrator who adds you to a company account.
- An operator or occupier who identifies you as a viewing contact, colleague or signatory.
- Professional advisers and other authorised participants in the relevant transaction.
- Service providers supporting account access, communications and the enabled platform functions.
- Public company records or other specified sources used for operator checks.
[CONFIRM: actual sources; identify Companies House only if used.]
If another person supplies your details, we will explain the relevant source and purpose in our invitation or first appropriate communication, or otherwise within the applicable legal timeframe. The person providing details must have a lawful reason to do so. This does not replace our own obligations to inform you.
5. Why we use information and our legal bases
We identify a legal basis for each purpose. We do not treat accepting our terms or reading this policy as consent to all processing.
| Purpose | Proposed legal basis and explanation |
|---|---|
| Providing an account or service you personally contract for, including requested steps before that contract | Performance of that contract, where processing is objectively necessary. This basis does not automatically apply merely because your employer contracts with us. |
| Dealing with employees and representatives of business customers | Our legitimate interests, and those of the represented business, in administering business accounts and responding to workspace requirements. |
| Delivering enquiries, arranging viewings and enabling relevant messages | Contract where you are personally a party and the processing is necessary; otherwise legitimate interests in facilitating the business enquiry and related communications. |
| Recording introductions, transaction progress and operator fees | Legitimate interests in operating the marketplace, attributing introductions fairly and administering and evidencing payment entitlements. Contract applies only where the individual is personally a contracting party and the processing is necessary. |
| Enabling authorised document collaboration and signing, where available | Contract where applicable; otherwise legitimate interests in facilitating and evidencing the parties' business transaction. The workspace parties' own legal bases and notices also apply. |
| Protecting accounts, preventing misuse and investigating complaints | Legitimate interests in a secure and reliable service and in protecting users; a specific legal obligation where one applies. We consider the effect on individuals when assessing these interests. |
| Keeping legally required business records and responding to lawful demands | Compliance with the applicable legal obligation. [CONFIRM: relevant accounting, tax and other record obligations.] |
| Resolving disputes and establishing, exercising or defending legal claims | Legitimate interests in fair dispute resolution and protecting legal rights, with any additional legal conditions required for sensitive information. |
| Sending optional promotional emails | Consent under the proposed launch approach. Service communications, such as a viewing confirmation, are handled separately. |
| Optional website analytics and advertising technologies | Consent under the proposed launch configuration. Strictly necessary technologies are treated separately in the Cookie Policy. |
| Publishing and moderating reviews, if enabled | Legitimate interests in useful, authentic marketplace feedback, subject to the published Reviews Policy and checks on fairness and necessity. |
[CONFIRM: approve the purpose-to-basis mapping and record legitimate-interest assessments before use. Remove unused purposes. Any use of a statutory cookie exception or a different marketing route needs a documented assessment and matching wording.]
Where a form marks a field as required, we need it to provide the requested function or satisfy a stated obligation. For example, without a reply address we cannot deliver an account invitation or respond to your enquiry. Optional fields are identified separately. There is no general legal obligation to register with District.
6. Who can see your information
When you submit an enquiry, we share the relevant contact and workspace requirements with the named operator, including its authorised team members who handle the enquiry. The operator may suggest another workspace in its portfolio. Sharing your information with a different operator requires a separate, clearly explained step; we do not treat an enquiry as permission to circulate your details to every operator.
Within a company account, authorised administrators and assigned team members may see records available to their role. The platform must show the recipients of a message or shared document before you send it. Invited signatories and advisers receive access appropriate to the specific transaction and their role. Do not put confidential internal advice into a shared negotiation thread.
Authorised District personnel may access relevant records where needed to provide support, maintain security, investigate abuse or disputes, and administer the service and fees. Access is limited by role and purpose. We do not describe a shared platform conversation as end-to-end encrypted or inaccessible to District staff.
We also use suppliers for hosting, databases, authentication, email delivery, support, diagnostics and any enabled signing or payment functions. They receive the information needed for their role, under appropriate contractual arrangements. [CONFIRM: actual recipients and roles. The project has discussed Supabase, Vercel, Resend and Google Workspace; verify use, configurations and contracting entities before identifying them in the published notice.]
We may disclose relevant information to professional advisers, insurers, courts, regulators or law-enforcement bodies where justified or required. If our business is sold or reorganised, information may be shared under appropriate confidentiality and data-protection safeguards; affected users will be informed of material changes in control or use as required.
7. Where information is processed
[CONFIRM: complete the supplier and international-transfer assessment before publication, including hosting, backups, support access and subprocessors. Do not state that all information stays in the UK or EEA without evidence.]
Our information is processed in [CONFIRM: relevant countries or a precise, maintained description linked to the supplier register]. Where a transfer outside the UK is restricted by UK data-protection law, we use an applicable adequacy arrangement or other permitted safeguards, such as an appropriate UK transfer agreement, with the required assessment. The arrangements applying to our services are [CONFIRM: actual mechanisms]. Contact our privacy address for information about the safeguards or a copy, with appropriate redactions where necessary.
8. How long we keep information
We retain information for as long as reasonably needed for its stated purpose, subject to applicable record obligations and justified legal holds. We distinguish an open account, an unsuccessful enquiry and a completed transaction; they do not automatically have the same retention period.
| Record | Period or criteria to finalise |
|---|---|
| Account and company membership | While needed for the account, followed by [CONFIRM: closure period and treatment of inactive accounts]. Remove access promptly when membership ends. |
| Unsuccessful enquiries, viewings and messages | [CONFIRM: period after last meaningful activity], taking account of ongoing requirements, attribution and disputes. |
| Completed transaction and fee evidence | [CONFIRM: justified period and starting event], reflecting actual accounting and claim requirements. Separate necessary evidence from unnecessary full document copies. |
| Contracts and signature audit records | [CONFIRM: retention by document type, including deeds where relevant, and allocation between District and the workspace parties]. |
| Support requests and complaints | [CONFIRM: period after closure], extended only for a justified continuing issue or obligation. |
| Security and diagnostic records | [CONFIRM: each log category and short operational period]; isolate evidence needed for an incident. |
| Marketing preferences | Until you withdraw consent or the approved review period expires. Keep a minimal suppression record where necessary to respect an opt-out. |
| Cookies and browser storage | The verified durations listed in the Cookie Policy. |
| Backups | [CONFIRM: expiry cycle, restricted access and how deletion is reapplied after restoration]. |
Account closure does not automatically erase every record of an existing workspace agreement or a legally justified claim. We explain any applicable retention when responding to a request. Another controller, such as an operator, may retain its own copy under its own policy.
9. Marketing and cookies
You can withdraw marketing consent through the unsubscribe link or by contacting us. This does not stop necessary service messages about an active account, enquiry or transaction. We keep promotional messages separate from essential service communications.
Our Cookie Policy explains browser technologies and preference controls. You can reopen Cookie Settings from the footer. Optional consent is separate from account registration and acceptance of the terms.
10. Your rights
Depending on the circumstances, you can ask for access to your personal information, correction, deletion, restriction of its use, or a portable copy. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time, including related profiling. We will stop processing for direct marketing when you object.
Contact [CONFIRM: monitored privacy email]. We normally respond to a rights request within one month, subject to applicable legal rules on clarification, identity checks and extensions. We may need proportionate information to verify your identity; we do not routinely require a passport for every request. Rights are not absolute, and we will explain any relevant limitation.
11. Privacy complaints
Please tell us what happened and how we can contact you. You can complain by email or post without opening an account or using a mandatory special form. We will acknowledge a privacy complaint within 30 days of receipt, investigate it without undue delay and explain the outcome and any action taken. [CONFIRM: operational owner and process; review the current statutory complaints requirements before publication.]
You can also complain to the Information Commissioner's Office through the ICO complaints service. Our process does not remove your right to contact the ICO or seek another remedy.
12. Automation, AI and changes
[CONFIRM: launch statement against actual functionality.] We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Ordinary search filters, availability displays and operator-set term pricing help users compare workspaces; they do not themselves approve or reject a tenancy.
Any future AI assistant, automated eligibility assessment or call-recording service needs a specific assessment and updated information before it is enabled. This draft does not authorise using private messages or contracts to train AI models.
We keep this policy under review and show its effective date and version. If our use of information changes materially, we will give appropriate notice before the new use begins and obtain any consent required.