Privacy Policy

Last updated: 17 May 2026

This Privacy Policy explains how H1 Global Ltd ("H1G", "we", "us", "our") collects, uses, shares and protects personal data when you visit our websites, sign up for or use the Habita platform (the "Service"), or otherwise interact with us. Habita is owned and operated by H1 Global Ltd. This policy applies to every visitor, applicant, customer, end-user, advertiser and service provider who engages with Habita.

Where Habita is offered to you by a management company, housing association, building owner or similar organisation (your "Organisation"), that Organisation is the controller of the personal data it submits and instructs us to process about its residents, employees and contractors. H1G acts as the processorfor that data on the Organisation's behalf. For data we collect directly from you (e.g. when you sign up, fill in our forms, or browse our public site) H1G is the controller.

1. Who We Are

Legal entity

H1 Global Ltd

Company registration number

14382424 (England & Wales)

Registered office

27 Old Gloucester Street, London, United Kingdom, WC1N 3AX

Data protection point of contact

[email protected]

Habita is a trading product of H1 Global Ltd. If you have any question about this policy, or wish to exercise the rights described below, please contact us using the details above.

2. Scope

This policy applies to personal data we process when you:

• visit habitaviva.com or any related Habita web property;
• submit a registration, application, contact, support or partnership form;
• use the Service as a management admin, block president, owner, tenant, service provider, advertiser, or in any other role;
• communicate with us by email, phone, WhatsApp or post;
• are referenced in content uploaded to the Service by an Organisation.

It does not cover third-party websites or services we link to. Those have their own policies; please review them.

3. Personal Data We Collect

3.1 Information you provide

• Identity & contact, first name, last name, email, phone, WhatsApp, postal address.
• Organisation & community, company name, role, building, unit, and similar information needed to set up access.
• Account credentials, password hash, two-factor authentication secrets, recovery information.
• Billing & payment, billing address, VAT number, plan, currency. Full card details are entered directly into Stripe and never stored on our servers; we only receive a token, brand, last four digits, and expiry month/year.
• Content you submit, tickets, posts, comments, messages, photos, documents, meeting minutes, e-signatures, ratings and reviews.
• Preferences, language, notification settings, accessibility preferences, opt-ins for marketing or research panels.
• Identity verification, where required for trust and safety (e.g. advertiser verification), we may collect business registration evidence or government-issued ID. We retain only what is needed to confirm verification status.

3.2 Information we collect automatically

• Device & technical, IP address, device type, operating system, browser, screen size, language, time zone.
• Usage, pages viewed, actions taken, features used, referrer URLs, time stamps, error logs.
• Cookies & similar, see section 12.
• Location (approximate), derived from IP for security, fraud prevention and local-currency defaults. We do not track precise GPS without your explicit consent.

3.3 Information from third parties

• Your Organisation, they may provide your contact details and role when inviting you, and may upload content that references you.
• Identity providers, if you sign in via a single-sign-on provider, we receive the basic profile fields you authorise (e.g. name, email).
• Service providers, anti-spam, fraud detection (e.g. Google reCAPTCHA), email deliverability and payment confirmation providers may send us signals about your interaction with the Service.
• Public records, for B2B due-diligence on management companies and advertisers, we may consult business registries.

4. Why We Use Your Personal Data and Our Legal Bases

Under the UK GDPR and EU GDPR we may only process your personal data when at least one legal basis applies. The table below sets out the main purposes for which we process data and the legal basis we rely on for each.

Where we rely on legitimate interests, we have carried out a balancing test and are satisfied that our interests are not overridden by your rights. You can ask us for a copy of the balancing assessment at [email protected].

5. Sharing and Disclosure

We share personal data only when necessary and only with:

• Your Organisation, admins of the Organisation that invited you can see information needed to administer your account and community.
• Other end-users of the Service, depending on your role and settings, certain profile fields, posts and ticket comments may be visible to other members of your community.
• Sub-processors we engage to run the Service (see section 6).
• Professional advisors, auditors, accountants, lawyers and insurers under appropriate confidentiality obligations.
• Authorities, courts, regulators and law enforcement where we are legally required to disclose, or where disclosure is reasonably necessary to protect the rights, property, or safety of any person.
• Acquirers, a successor in a merger, acquisition or asset sale, who must respect this Privacy Policy or notify you before changing it.

We do not sell your personal data. We do not use your content to train public AI models.

6. Sub-processors

We engage trusted sub-processors to operate the Service. Each is bound by a written data processing agreement consistent with Article 28 of the UK GDPR and EU GDPR. The table below describes the categories of sub-processor we use and the regions in which they process personal data.

The current named list of sub-processors is available on request from [email protected]. We will give reasonable advance notice to Organisation customers of any change. To object to a new sub-processor, contact us within 30 days of the notice and we will work with you to find a reasonable alternative or, failing that, allow you to terminate the affected services.

7. International Data Transfers

Some of our sub-processors are located outside the UK or European Economic Area, principally in the United States. Where we transfer personal data outside these regions, we rely on one or more of:

• an adequacy decision by the European Commission or the UK government;
• the EU Standard Contractual Clauses and the UK International Data Transfer Addendum;
• certification under the EU-U.S. Data Privacy Framework and the UK Extension where the recipient is certified;
• your explicit consent where appropriate.

You can request a copy of our transfer safeguards by emailing [email protected].

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.

9. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include:

• encryption in transit (TLS 1.2+) and at rest;
• strong password hashing (bcrypt / argon2) and optional two-factor authentication;
• tenant isolation via PostgreSQL row-level security;
• least-privilege role-based access with audit logging on privileged actions;
• encrypted, geographically redundant backups;
• regular dependency scanning and security review of new features;
• incident response procedures and a documented breach-notification process.

Despite our efforts, no method of transmission or storage is 100% secure. If you believe your account has been compromised, contact [email protected] immediately.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify you without undue delay where the law requires.

10. Your Rights

Subject to applicable law, you have the following rights with respect to your personal data. We will respond to requests within one calendar month, extendable by a further two months for complex requests.

• Access, a copy of the personal data we hold about you.
• Rectification, correction of inaccurate or incomplete data.
• Erasure(the "right to be forgotten"), deletion of data we no longer have a lawful reason to keep.
• Restriction, limit how we process your data while a query is resolved.
• Portability, receive your data in a structured, commonly used, machine-readable format.
• Objection, object to processing based on legitimate interests, or to direct marketing at any time.
• Withdraw consent, where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• No automated decisions, we do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects.
• Complain, lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or the supervisory authority in the EU country where you live or work.

To exercise any of these rights, email [email protected] from the address associated with your account. We may ask for additional information to verify your identity before acting on a request. Where the requested data was provided to us by an Organisation, we may need to direct your request to that Organisation.

11. Marketing Communications

We send marketing emails only where the law allows: with your consent, or to existing customers about similar products and services on a soft opt-in basis. Every marketing email contains an unsubscribe link. You can also email [email protected] to opt out at any time. Transactional messages (security alerts, billing notices, ticket updates) are not marketing and will continue while your account is active.

12. Cookies and Similar Technologies

We use the following categories of cookies and similar technologies:

Strictly necessary cookies do not require consent. For analytics cookies we ask for your consent on your first visit and you can change your preferences at any time via your browser settings or our cookie banner. Blocking strictly necessary cookies may prevent parts of the Service from working.

13. AI and Automated Processing

Habita uses AI to translate posts and tickets between languages, draft suggested replies, triage incoming tickets, and summarise meeting minutes. These features are designed to assist a human, not to replace one. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

Content sent to our AI provider for processing is transmitted under contractual terms that prohibit training the provider's public models on your data. Where available, we use zero-data-retention configurations so that prompts and responses are not retained by the provider beyond the time needed to return a response.

14. Children

The Service is intended for use by adults. We do not knowingly collect personal data from anyone under 16. If you become aware that a child has provided us with personal data without parental consent, please contact [email protected] so we can delete it.

15. Third-Party Links

Our public site and the Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with personal data.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you, for example by email or by a prominent notice in the Service, before the change takes effect. The "Last updated" date at the top tells you when this version was published. Previous versions are available on request.

17. How to Contact Us

If you have any question, request or complaint regarding this Privacy Policy or our processing of your personal data, please contact:

Data controller / processor

H1 Global Ltd (company number 14382424)

Data protection point of contact

[email protected]

Postal address

H1 Global Ltd, 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX

Supervisory authority (UK)

Information Commissioner's Office, ico.org.uk