Privacy Policy
Last updated: 8 July 2026
This policy explains how EWLPS ("EWLPS", "we", "us") collects, uses and protects personal data through the EWLPS CMC Vetting application (the "Service"). It's written for both the Claims Management Companies ("CMCs", "you", "your organisation") who hold accounts with us, and for individuals whose information is submitted to the Service by those organisations.
We are registered with the UK Information Commissioner's Office (ICO), registration reference ZB861396.
1. Who we are
EWLPS is a sole trader trading as EWLPS. You can contact us about anything in this policy at info@ewlps.co.uk.
2. Two kinds of personal data, two roles
The Service handles two distinct sets of personal data, and we act differently in respect of each:
a. Your organisation's account data - we are the controller
This is the information you give us to register and run your account: organisation name, contact name, business email and phone number, FCA reference number, and login credentials. We decide why and how this data is processed, so for this data we are the data controller under UK GDPR.
b. Data about your clients, submitted for vetting - we are the processor
When your organisation submits a case for vetting, you enter details about your own client and their tenancy - for example their name, contact details, property address, landlord details, tenancy and arrears information, a description of the alleged defects, and any supporting documents you upload. We process this data only on your instructions, to provide the vetting result back to you. For this data, your organisation is the data controller and EWLPS is the data processor. You remain responsible for having a lawful basis for collecting and submitting your client's data, including telling your client how their data will be used and, where applicable, obtaining any consent needed.
3. Special category data
Some fields in a vetting submission can amount to special category data under Article 9 UK GDPR - most notably the vulnerability flag, and any document you upload and categorise as "medical". Because this data is submitted by your organisation about your client, your organisation is responsible for identifying an appropriate Article 9 condition (such as your client's explicit consent, or another applicable condition) before submitting it. We process it strictly as your processor, under the same instructions and safeguards as the rest of the case data.
4. What we collect
- Account & billing data: organisation name, contact name, email, phone, FCA reference number, password (stored as a salted hash, never in plain text), token purchase and usage history.
- Vetting case data: client name, contact details, property address and postcode, landlord name and type, tenancy dates and type, rent arrears, described defects, notice details, repair costs, vulnerability and DIY-redecoration flags, and any documents uploaded (e.g. notice letters, photos, correspondence, tenancy agreements, medical documents).
- AI-generated output: the rating and analysis our AI pipeline produces from the case data above (see section 6).
- Technical data: standard server logs and the session cookies needed to keep you signed in. We do not use analytics or advertising cookies.
5. How we use it
- To create and administer your organisation's account.
- To process token purchases and maintain your balance.
- To run the vetting pipeline you submit a case to, and return the resulting analysis to your organisation.
- To maintain the security and integrity of the Service.
- To comply with our legal obligations.
6. Automated processing
Case data you submit is analysed by an AI model to produce a RED / AMBER / GREEN rating and supporting commentary. This output is decision-support for your organisation - it is provided back to you, the CMC, and is not used by us to make any automated decision that produces legal or similarly significant effects for your client. Any decision about how to act on a case remains yours.
7. Who we share data with
We use the following sub-processors to run the Service. Each processes data only as needed to provide their part of the infrastructure, under contractual data protection terms:
- Supabase - database, authentication and document storage. Our project is hosted in the EU (London, UK) region.
- Anthropic - we send case data (including any special category data within it) to Anthropic's Claude API to generate the vetting analysis. Anthropic is based in the US; transfers are made under appropriate safeguards recognised by UK GDPR (such as the UK's international data transfer framework). Anthropic does not use API data submitted through this route to train its models, in line with its standard API terms.
- Stripe - payment processing for token purchases. We do not receive or store your card details.
- AWS Amplify - application hosting.
We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
8. International transfers
Where any of the sub-processors above are located outside the UK, we rely on the UK's recognised transfer mechanisms (such as the International Data Transfer Addendum to the EU Standard Contractual Clauses, or a UK adequacy finding) to ensure your data continues to receive an appropriate level of protection.
9. How long we keep data
We retain account and case data for as long as your organisation's account is active, and for a reasonable period afterwards to meet our legal, accounting and dispute-resolution obligations. If you close your account, contact us and we'll confirm our current retention and deletion process for your organisation's data.
10. Security
Case data is isolated between organisations at the database level (row-level security scoped to your organisation), documents are stored in a private, access-controlled store, and access to your account is protected by your password and standard session security. No system is completely secure, and we keep our safeguards under review.
11. Your rights
Subject to certain exemptions, UK GDPR gives individuals the right to: access the personal data we hold about them; have inaccurate data corrected; have data erased; restrict or object to processing; and receive a copy of their data in a portable format. If your organisation's client wants to exercise these rights over the data submitted about them, they should contact your organisation first, as the controller of that data - we'll support you in responding to that request as your processor.
For account data where we're the controller, you can exercise these rights by contacting info@ewlps.co.uk.
12. How to complain
If you're unhappy with how we've handled personal data, please raise it with us first at info@ewlps.co.uk so we can look into it. You also have the right to complain directly to the UK's supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Changes to this policy
We may update this policy as the Service changes. We'll update the "last updated" date above, and where changes are significant we'll let account holders know directly.