Privacy Policy

1. Who We Are

FYSH Ltd ("FYSH", "we", "us", "our") operates the online property classifieds platform at www.fysh.uk. We are the data controller for the personal data processed through this platform.

FYSH is a platform intermediary. We facilitate direct communication between vendors and buyers of residential property in the United Kingdom. We are not an estate agent and do not provide regulated property services.

FYSH Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Our registration is currently being completed. Once issued, our ICO registration number will appear here and in our registration summary above.

2. Personal Data We Collect

2.1 Information you provide directly

• Account registration: name, email address, password (stored only as a one-way hash), and account type (buyer or vendor).
• Property listings (vendors): property address, description, asking price, tenure, photographs, and any additional details included in the listing.
• Expressions of interest (buyers): the content of messages submitted to vendors.
• Account profile: optional professional title, contact number, and town or city.
• Support correspondence: any communications you send to us directly.

2.2 Information collected automatically

• Security audit data: Your IP address is collected during security-relevant events (account registration, login, password reset, and MFA changes) and stored immediately as a one-way SHA-256 hash. The raw IP address is never written to our database and cannot be recovered from the stored hash. This processing is carried out under our legitimate interest in preventing fraud and protecting user accounts.
• Property listing view counts: An aggregate view counter is incremented each time a property listing is visited. This is a numeric count only — no record of which user or device viewed a listing is retained. Vendors see this count to gauge interest in their listing.
• Session data: Session identifiers used to maintain your logged-in state.
• Cookies: see our Cookie Policy for full details.

2.3 Information we do not collect

We do not collect payment card details. Credit purchases are handled directly through our payment processor. We do not store card numbers, sort codes, or bank account details.

We also do not collect: browser type or version, device type, operating system, referring URLs, or individual page visit history. FYSH does not use any third-party analytics platform (such as Google Analytics), advertising pixels, session recording tools, or behavioural tracking technology of any kind.

3. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract performance (Article 6(1)(b)): processing your account data, listing data, and message data to provide the FYSH platform services you have requested.
• Legitimate interests (Article 6(1)(f)): platform security, fraud prevention, abuse detection, and service improvement, where these do not override your fundamental rights.
• Legal obligation (Article 6(1)(c)): retaining financial and transactional records as required by applicable law.
• Consent (Article 6(1)(a)): non-essential cookies, where you have given explicit consent via our cookie banner.

4. How We Use Your Personal Data

• To create and maintain your account.
• To publish and display property listings submitted by vendors.
• To facilitate expressions of interest and messaging between buyers and vendors.
• To process credit purchases and maintain credit balances.
• To send transactional emails (account verification, password reset, message notifications).
• To detect, investigate, and prevent fraudulent or abusive activity.
• To comply with legal obligations and respond to lawful requests from authorities.
• To improve platform performance, stability, and user experience.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Sharing Your Data

5.1 With other platform users

When a vendor opens a buyer's expression of interest, limited profile information (name, and the content of the message) is shared with that vendor. The buyer's email address is not shared unless the buyer chooses to include it in their message. Listing details submitted by vendors are visible to all visitors to the platform.

5.2 With service providers

We use a limited number of trusted third-party processors to deliver our services, including web hosting and server infrastructure, email delivery, and payment processing. These processors act only on our instructions and are contractually bound to maintain appropriate data security standards.

5.3 We do not sell your data

We will never sell, rent, or trade your personal data to third parties for marketing or any other commercial purpose.

5.4 Legal disclosure

We may disclose personal data where required to do so by law, court order, or regulatory authority, or where we reasonably believe disclosure is necessary to prevent fraud or serious harm.

6. International Transfers

We aim to store and process personal data within the United Kingdom and the European Economic Area. Where any transfer to a country outside these areas is necessary, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V, including reliance on adequacy decisions or standard contractual clauses.

7. How Long We Keep Your Data

Where an account is closed at your request, we will delete or anonymise your personal data within the periods above, except where retention is required by law.

8. Your Rights Under UK GDPR

Subject to certain conditions and exemptions, you have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification: to have inaccurate personal data corrected or incomplete data completed.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: to receive personal data you have provided to us in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month of receiving your request.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or loss. These include:

• HTTPS encryption for all data in transit.
• Envelope encryption (XSalsa20-Poly1305) for sensitive personal data stored at rest, with per-record encryption keys.
• One-way hashing of passwords using Argon2id.
• Restriction of platform system access to authorised personnel only.
• Regular review of security controls and software dependencies.

Despite these measures, no internet-based system can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, will inform affected users without undue delay.

10. Cookies

We use a small number of cookies that are strictly necessary for platform operation, and one cookie to record your consent preferences. We do not use tracking, analytics, or advertising cookies. For full details, please refer to our Cookie Policy.

11. Third-Party Services

FYSH makes limited use of third-party services to deliver platform functionality. We do not use advertising networks, behavioural analytics platforms, or tracking pixels of any kind. The services below are the complete list of third parties that may process data in connection with your use of FYSH.

11.1 Postcode lookup (Postcodes.io)

Address search and postcode validation uses the free, open-source Postcodes.io API. When you use the property search, your search terms are transmitted to the Postcodes.io service to return matching locations. No personal data beyond the search query text is sent. Postcodes.io is hosted within the United Kingdom.

11.2 Map tiles (CARTO)

Interactive property maps use map tile images served by CARTO. When you view a map page, your browser fetches tile images directly from CARTO's servers, which may involve transfer of your IP address to CARTO. We do not control CARTO's data processing. Please refer to CARTO's Privacy Policy for details.

11.3 Transactional email (Google Gmail)

Transactional emails (account verification, password reset, notification emails) are delivered via Google's Gmail service. The content and recipient address of each email are processed by Google's infrastructure solely for delivery purposes. FYSH does not authorise Google to use this data for any other purpose. For details, please refer to Google's Privacy Policy.

FYSH pages may contain links to external websites. This Privacy Policy does not apply to those sites. We recommend reviewing the privacy policy of any external site you visit.

12. Children

FYSH is not directed at children under the age of 18. We do not knowingly collect personal data from individuals under 18. If you believe a person under 18 has provided us with their data without appropriate consent, please contact us and we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where a change is material, we will notify registered users by email and update the effective date at the top of this page. Continued use of FYSH after notification constitutes acceptance of the updated policy.