Mandate is a free Right to Manage resource published by GreenCo Block Management Ltd. This policy explains what personal data we collect when you use the site, why we collect it, how long we keep it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
It is written to be read. If anything here is unclear, email the named contact below and we will rewrite the section.
Who is responsible
GreenCo Block Management Ltd is the data controller for everything you read here. We are based in Manchester, England.
Martin Conway — Director, GreenCo Block Management Ltd, is the named contact for privacy questions and subject-access requests. Email privacy@greenco.co.uk.
What we collect
We try to collect as little as possible. The data we do hold falls into four categories:
- Eligibility self-test answers — the responses you give to the on-site eligibility checker, plus an optional email if you ask for the result by email.
- RTM assistant chat — the questions you type into the AI assistant and the answers it returns, stored against an anonymous session so we can improve answers and audit accuracy.
- Course registrations — name and email when you enrol in the free RTM course, plus your progress through the modules.
- Newsletter subscribers — the email address you give the newsletter signup form, plus subscription metadata (date, source page).
Why we hold it (legal basis)
We rely on three lawful bases under UK GDPR Article 6:
- Consent — for the analytics cookies you accept on the banner, and for the newsletter (you tick the box to subscribe). You can withdraw consent at any time.
- Legitimate interest — for keeping the site secure, preventing abuse of the AI assistant, and understanding which guides are most useful in aggregate.
- Contract — when you enrol in the free course, we hold your details to deliver the course you signed up for.
How long we keep it
We keep the minimum needed to run the service and meet our legal obligations. Specific retention periods:
| Data | Retention | Why |
|---|---|---|
| RTM assistant chat sessions | 36 months | Quality and accuracy auditing; supports legal-content review cycles. |
| Eligibility self-test rows | 24 months | Aggregate analysis of where leaseholders get blocked; deleted on request. |
| Course registrations | Indefinite — until you ask us to delete | You enrolled in a free course we continue to host; you can request deletion any time. |
| Newsletter subscribers | Indefinite — until you unsubscribe | You asked to be sent the newsletter. Every email has a one-click unsubscribe. |
| Server logs (IP, user agent) | 30 days | Security and abuse prevention. |
Right to deletion is honoured on request — email privacy@greenco.co.uk and we will erase your data within 30 days, as required by UK GDPR.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you (right of access).
- Have inaccurate data corrected (right to rectification).
- Have your data deleted (right to erasure / "right to be forgotten").
- Restrict or object to processing.
- Receive a portable copy of data you gave us (right to data portability).
- Withdraw consent at any time — for analytics via the cookie banner, for the newsletter via the unsubscribe link in any issue.
Who else sees your data
We use a small number of processors to run the service. Each one only sees what they need to do their job:
- Vercel — hosts the website and runs the server-side code.
- Supabase — stores course registrations, eligibility responses, and assistant chat logs.
- Buttondown — sends the newsletter and stores subscriber email addresses.
- smtp2go / Resend — transactional email (course welcome, eligibility result emails).
- Plausible Analytics — privacy-friendly, cookieless aggregate analytics. No personal profiles built.
- OpenAI / Anthropic — process AI assistant prompts. No training on your data.
Cookies
Cookies, what they are for, and how to control them are covered on a dedicated page. See the cookies page for the full inventory and to change your preferences.
Complaining to the regulator
If you think we have mishandled your data and we have not put it right, you can complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this policy
When we add new analytics or measurement tools — for example a server-side analytics pipeline — we will update this page and, where the change is material, re-prompt for consent through the cookie banner. The "last updated" date at the top of this page is the authoritative version marker.