OFF/MARKET

Off/Market Exchange Ltd (“we”, “us”, “the Company”) is the data controller for personal data processed through the Off/Market Exchange platform. We are incorporated in England and Wales and operate the platform at offmarket-exchange.com.

We take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

We collect and process the following categories of personal data:

Account and profile data

• Full name, email address, and phone number
• Company name and professional role
• LinkedIn profile URL (optional)
• Professional biography and profile photograph
• Account credentials (password stored as a secure hash via Supabase Auth)

Platform activity data

• Property listings and asset submissions you post
• Acquisition mandates you publish
• Deal room participation and document activity
• Deal room connections and counterparty activity

Payment data

• Subscription payments are processed by Stripe. We do not store card numbers or full payment details — Stripe holds this data under their own privacy policy.
• We retain a record of subscription status and billing history.

Technical data

• Session tokens stored as httpOnly cookies for authentication
• Server-side audit logs of privileged actions (admin actions, invitations)

We use your personal data for the following purposes:

• Platform operation — to provide you with access to the exchange, display your listings and mandates to other members, and facilitate introductions between matched parties.
• Member identity — your name, company, biography, and profile photograph are displayed to other members to establish trust and transparency on the platform.
• Billing — to manage your subscription, process payments via Stripe, and handle subscription renewals and cancellations.
• Communications — to send transactional emails including account setup links, subscription confirmations, deal room notifications, and platform updates. We use Resend to deliver these emails.
• Security and fraud prevention — to protect the platform, detect misuse, and maintain audit logs of key administrative actions.
• Legal compliance — to comply with applicable laws and respond to lawful requests from authorities where required.

We process your personal data on the following legal bases:

• Contract performance — processing necessary to provide you with platform access, manage your membership, and process payments.
• Legitimate interests — maintaining platform security, displaying member profiles to facilitate trust between members, and sending service-related communications.
• Legal obligation — where we are required to retain or disclose data to comply with applicable law.

We use the following third-party processors who may handle your personal data on our behalf. Each is bound by appropriate data processing agreements:

• Supabase — database and authentication infrastructure. Member records and account credentials are stored on Supabase servers (EU region).
• Stripe — payment processing. Stripe handles all card data and subscription billing. Stripe is certified to PCI DSS Level 1.
• Resend — transactional email delivery. Your email address is passed to Resend solely to deliver platform emails to you.
• Vercel — application hosting and edge delivery. Request data passes through Vercel's infrastructure.

We do not sell your personal data to third parties and do not use it for advertising or marketing purposes beyond the platform itself.

Your name, company, biography, and profile photograph are visible to other verified members of the platform. This is a core feature of the service — Off/Market Exchange is built on professional trust and transparency between members.

Your email address, phone number, and LinkedIn URL are not displayed publicly on your profile. Contact details are only shared with a counterparty through the deal room process when both parties have been connected by the platform.

We retain your personal data for as long as your account is active. If you cancel your membership, we will retain your account data for up to 12 months in case you wish to reactivate, after which it will be deleted or anonymised.

Billing records are retained for 7 years to comply with financial record-keeping obligations.

Under UK GDPR you have the following rights in relation to your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention obligations.
• Restriction — ask us to limit processing of your data in certain circumstances.
• Portability — receive a copy of your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.

Most of your profile data (name, company, biography, profile photo) can be updated directly in your account settings. For data deletion requests or other rights enquiries, contact us at the address below.

We use httpOnly session cookies to maintain your authenticated session on the platform. These cookies are strictly necessary for the platform to function and do not track you across other websites. We do not use advertising cookies or third-party analytics trackers.

We may update this Privacy Policy from time to time. Where changes are material we will notify you by email. Continued use of the platform after notification constitutes acceptance of the revised policy.

For any privacy-related enquiries or to exercise your rights, please contact us at ops@rothmoreproperty.com.

If you are not satisfied with our response you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.