Privacy Policy — Ploxit

1. Who we are

Ekofi Capital LLC, a limited liability company formed in Wyoming, United States("we", "us"), is the controller of personal data we collect about landlords who hold a Ploxit account.

For personal data about tenants (uploaded by landlords and processed through Ploxit), the landlord is the data controller and Ploxit is the data processor. Our Data Processing Addendum (the "DPA") governs that processing.

We are established in the United States. UK GDPR applies to our processing of UK individuals' data. We have not yet appointed an Article 27 representative for the UK; if you would normally contact a UK representative, please contact support@ploxit.com in the first instance and we will respond.

2. Personal data we collect about landlords

• Email address, name, and password hash (we never see your password in plaintext)
• Billing identifiers and last-four card digits (full payment data is processed by Stripe — we do not store it)
• IP address, user agent, and session metadata captured at sign-in and on sensitive actions
• Acceptance records for our Terms, Privacy Policy and DPA, including the version accepted, timestamp and IP
• Support correspondence you send us

3. Personal data we process about tenants (on behalf of landlords)

• Name, email address, and optional postal address
• Email send, open and bounce events (timestamp, IP, user agent)
• Acknowledgment events (timestamp, IP, user agent)
• The Information Sheet version served

4. Lawful basis

Landlord account data: contract performance (UK GDPR Art. 6(1)(b)) and our legitimate interests in operating, securing and improving Ploxit (Art. 6(1)(f)).

Tenant data: processed on the lawful basis identified by the landlord. We expect this to be the landlord's legal obligation to serve the Information Sheet under the Renters' Rights Act 2025 (Art. 6(1)(c)) or their legitimate interests in record-keeping (Art. 6(1)(f)). Landlords are responsible for identifying and recording the basis they rely on.

5. How long we keep data

Landlord account data: for as long as your account is active and for up to 6 months after account closure, except where longer retention is required by law (e.g. tax records).

Tenant data and audit logs: 6 years from the date of the relevant event, in line with statutory record-keeping under the Renters' Rights Act 2025. You may request earlier deletion at any time, and we will delete unless we have a lawful obligation to retain.

Backups: encrypted backups are retained for up to 35 days and overwritten on rotation.

6. Sub-processors

We use a small number of carefully selected sub-processors. See the DPA for the current list, including location and transfer safeguards. We will give 14 days' notice before adding a new sub-processor.

7. International transfers

We are based in the United States. Where personal data of UK individuals is transferred outside the United Kingdom, we rely on (a) the UK extension to the EU–US Data Privacy Framework where the recipient is certified, (b) the UK International Data Transfer Agreement (IDTA), or (c) EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, in each case supported by an appropriate transfer risk assessment.

8. Security

We protect personal data with encryption in transit (TLS 1.2+), encryption at rest, role- based access control, audit logging, time-bounded session cookies, password hashing using a modern adaptive algorithm, and least-privilege access by our personnel.

9. Cookies

Ploxit uses only strictly necessary cookies. See our Cookie Policy for details.

10. Marketing

We do not sell your data or share it with advertisers. We may send you operational messages about your account and the service (e.g. compliance notices and security alerts) on the basis of our legitimate interests; you cannot opt out of these while you hold an active account.

11. Automated decision-making

We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.

12. Your rights

You have rights under UK GDPR including access, rectification, erasure, restriction of processing, portability, and objection (including objection to processing based on legitimate interests). To exercise any of these, email support@ploxit.com. We will respond within one month.

You have the right to complain to the Information Commissioner's Office (ICO) about our processing: ico.org.uk. We'd appreciate the chance to address your concern first.

13. Tenants — if you received an email from a landlord via Ploxit

13.1 Your landlord is the controller of your personal data. Ploxit is the processor.

13.2 Contact your landlord first to exercise data protection rights. If you cannot reach them or are not satisfied with the response, contact support@ploxit.com and we will assist the landlord to respond.

13.3 You may at any time complain to the ICO at ico.org.uk.

14. Changes

We will update this Privacy Policy from time to time. Material changes will be notified by email or in-product message before they take effect.

15. Contact

Email: support@ploxit.com