Privacy Policy

England & Wales Legal Protocol Specialists (“EWLPS”, “ewlps”, “we”, “us”) provides housing disrepair (HDR) case vetting for Claims Management Companies (CMCs). EWLPS is the data controller for personal data described in this policy.

ICO registration number: ZB861396
Contact: info@ewlps.co.uk

This policy covers two related services operated by EWLPS:

• ewlps.co.uk — the marketing and information website (this site).
• app.ewlps.co.uk — the vetting portal where registered CMC users upload case packs and receive risk-rated reports.

Case files uploaded to the vetting portal may contain special category data and criminal offence data (for example health information, vulnerability indicators, or allegations relating to housing conditions). EWLPS treats all portal data as high-sensitivity and applies additional controls accordingly.

The marketing website is a static information site. EWLPS does not operate contact forms, account registration, or analytics cookies on ewlps.co.uk at launch.

Data that may be processed when visiting this site includes:

• Server and security logs — IP address, browser type, pages requested, and timestamps, processed by the hosting provider to deliver the site and maintain security.
• Email correspondence — if a visitor contacts EWLPS at info@ewlps.co.uk, the content of that email and associated metadata (sender address, date, subject) is processed to respond to the enquiry.

Registered CMC users of the vetting portal may provide:

• Organisation and user account details (name, work email, organisation name).
• Case pack documents and metadata (tenancy agreements, correspondence, photographs, expert notes, and other materials uploaded for vetting).
• Token purchase and usage records.
• Generated vetting reports and audit logs relating to each file processed.

EWLPS does not use uploaded case files to train machine learning models. EWLPS staff do not browse client uploads for purposes unrelated to support, security, or legal compliance.

EWLPS relies on the following lawful bases under UK GDPR, depending on context:

• Contract — to provide vetting services, manage accounts, and process token purchases for registered CMC customers.
• Legitimate interests — to operate and secure the websites, respond to enquiries, prevent fraud, and improve service reliability, balanced against the rights of data subjects.
• Legal obligation — where processing is required to comply with applicable law or regulatory requests.
• Consent — where explicitly obtained for a specific purpose not covered by another lawful basis.

Where special category data appears within uploaded case packs, EWLPS processes it under Article 9(2)(f) UK GDPR (legal claims) and/or Article 9(2)(g) (substantial public interest, where applicable), alongside appropriate safeguards.

EWLPS infrastructure is hosted on Amazon Web Services in the London region (eu-west-2). Client case data is not transferred to data centres outside the United Kingdom for storage or processing.

Marketing site server logs are retained only for as long as necessary for security and operational purposes, typically no longer than 90 days unless required for an incident investigation.

Vetting portal data retention periods are set out in the customer agreement and reflect the sensitivity of HDR case materials. CMCs may request deletion of account data subject to any legal or contractual record-keeping requirements.

EWLPS does not sell personal data. Data may be shared only where necessary with:

• Infrastructure providers acting as processors (for example AWS), under data processing agreements.
• Professional advisers (for example lawyers or accountants) where required.
• Regulators or law enforcement where EWLPS is legally obliged to disclose information.

Under UK GDPR, data subjects have the right to request access, rectification, erasure, restriction, portability, and to object to certain processing. Data subjects also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any right, contact info@ewlps.co.uk. EWLPS will respond within one calendar month.

EWLPS applies technical and organisational measures appropriate to the sensitivity of HDR case data, including access controls, encryption in transit, UK-only hosting, and regular review of data protection procedures. Georgie Stead oversees the regulatory and data protection framework.

EWLPS may update this policy from time to time. Material changes will be published on this page with an updated date. Continued use of the services after changes take effect constitutes notice of the revised policy.

See also the Terms of Service.