Privacy Policy

RE:match is operated by Brick Capital Ltd (company number: 08137293), registered in England and Wales. Our registered office is at Dove Barn, Bartestree, Hereford, United Kingdom, HR1 4DA.

⚠ Action required: Confirm our ICO data protection registration number at ico.org.uk (registering/paying the fee requires an ICO account, so this must be done directly by Brick Capital Ltd) and insert it here once issued.

RE:match is the data controller for all personal data collected through this website and associated services. If you have any questions about how we handle your data, please contact us at hello@rematch.co.uk.

We collect the following categories of personal data:

• Account data — your name, email address, company name, phone number and account type (occupier or landlord/agent) when you register.
• Requirement data — details of commercial property requirements you post, including location, size, budget, use class, timing and description.
• Enquiry data — messages sent between occupiers and landlords/agents via the platform.
• Usage data — pages visited, search queries, requirement views and other interactions with the website, collected automatically.
• Technical data — IP address, browser type, device type, operating system and referring URLs, collected automatically by our hosting infrastructure.
• Payment data — billing name and address. Card details are processed directly by Stripe and are never stored on our servers.

We use your personal data for the following purposes:

• To create and manage your account.
• To publish and administer your commercial property requirements.
• To facilitate enquiries and communications between occupiers and landlords/agents.
• To send you transactional emails — for example, requirement approval notifications, enquiry alerts and account-related messages.
• To process subscription payments and manage billing.
• To moderate content posted to the platform.
• To improve the website and our services through analysis of usage patterns.
• To comply with our legal obligations.

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases for processing your personal data:

• Contract — processing necessary to provide the services you have signed up for, including account management, requirement publishing and facilitation of enquiries.
• Legitimate interests — improving our platform, preventing fraud, ensuring security and sending relevant service communications. We have balanced these interests against your rights and are satisfied they do not override them.
• Legal obligation — where we are required to process data to comply with applicable law.
• Consent — where we ask for your consent (for example, for marketing emails). You may withdraw consent at any time.

We do not sell your personal data. We share it only with the following categories of third parties, and only to the extent necessary:

• Supabase — our database and authentication provider. Data is stored on servers within the European Economic Area (EEA) and subject to appropriate safeguards.
• Vercel — our website hosting provider, based in the United States (see Section 12 for transfer safeguards).
• Resend — our transactional email provider, based in the United States, used to send account and enquiry notifications (see Section 12).
• Stripe — our payment processor. Stripe handles card data directly and is PCI DSS compliant. We do not receive or store your full card details.
• Mapbox — based in the United States, used to geocode location data entered into requirement forms. Only the location text (e.g. town or postcode) is transmitted (see Section 12 for transfer safeguards).
• Law enforcement or regulators — where we are legally required to disclose information.

When occupiers post a requirement, their business name may be displayed publicly on the requirements board. Personal contact details are never displayed publicly; they are shared with responding landlords/agents only through the platform's enquiry system.

• Account data — retained for the duration of your account. If you close your account, we will delete or anonymise your personal data within 90 days, unless we are required to retain it by law.
• Requirement data — retained while your account is active and for up to 12 months after a requirement is withdrawn or expired, for audit and dispute resolution purposes.
• Enquiry messages — retained for 12 months after the enquiry is closed.
• Billing records — retained for 7 years in accordance with HMRC requirements.
• Usage and technical data — retained in aggregated or anonymised form indefinitely; identifiable logs are deleted after 90 days.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to ask us to delete your personal data where there is no compelling reason for us to continue processing it.
• Right to restriction — to ask us to restrict processing of your data in certain circumstances.
• Right to data portability — to receive your personal data in a structured, commonly used and machine-readable format.
• Right to object — to object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — we do not make automated decisions with legal or similarly significant effects.

To exercise any of these rights, please email hello@rematch.co.uk. We will respond within one calendar month.

We use the following:

• Strictly necessary cookies — a session cookie set by our authentication provider (Supabase) to keep you signed in. These cannot be disabled without breaking core functionality, and do not require consent under the Privacy and Electronic Communications Regulations (PECR).
• Analytics — we use Vercel Web Analytics to understand overall site usage. It does not set cookies or store anything on your device: visits are identified using a temporary, salted hash of the request that is discarded after 24 hours, and only aggregated, anonymised statistics are retained. It does not track you across other websites and does not build an individual profile of you.

Because we do not use cookies or similar technologies beyond what is strictly necessary, we do not currently need to ask for cookie consent under PECR. If this changes — for example, if we add advertising or cross-site tracking technologies in future — we will update this policy and put a consent mechanism in place before those technologies are activated. You can control cookies through your browser settings; disabling the strictly necessary cookie will prevent you from logging in to your account.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. These include encrypted connections (HTTPS), row-level security on our database, and access controls restricting who can view personal data within our systems.

No method of transmission or storage is 100% secure. If you believe your data has been compromised, please contact us immediately at hello@rematch.co.uk.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by UK GDPR Article 34, and will provide details of the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

If you discover or suspect a security incident involving your data, please contact us immediately at hello@rematch.co.uk.

You have the right to request deletion of your personal data at any time. To close your account and request erasure of your data, please email hello@rematch.co.uk with the subject line "Account deletion request". We will process your request and confirm deletion within 30 days. Note that we may be required to retain certain data (for example billing records) for legal compliance purposes, as set out in Section 6 above.

Some of the third parties listed in Section 5 are based outside the UK, principally in the United States. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place — such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation — for:

• Vercel (hosting) — United States.
• Mapbox (geocoding) — United States.
• Stripe (payments) — United States.
• Resend (transactional email) — United States.

Supabase, our database and authentication provider, stores data within the European Economic Area (see Section 5) and this does not involve an international transfer.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK's data protection supervisory authority:

We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at hello@rematch.co.uk.