Customer Privacy Notice

Last updated September 19, 2026

This privacy notice tells you what to expect us to do with your personal information.

The context of this privacy policy applies to any application or service provided by WAVEFORM LABS LTD. In particular, Lot Locker web application and website at https://lotlocker.com.

Contact Details

Email: [email protected]

To exercise your data protection rights (access, rectification, erasure, restriction, portability or objection) you may email us directly, or use our Data Access / Privacy Request Form which will prepare an email for you to send. Using the form helps ensure we receive the key information needed to process your request promptly.

What Information We Collect, Use, and Why

To provide services and goods

We collect or use the following information to provide Lot Locker services:

• Names and contact details
• Account information, including registration details
• Payment details processed by Stripe (we do not store full card numbers)
• Property, buyer, deal, and matching data that you enter into the application (including addresses, coordinates, financial estimates, notes, and custom fields)
• Property, owner, and contact information retrieved through paid lookup features (including property data enrichment, skip tracing, area pulls, and similar), which we may host, cache, and reuse as described in our Terms of Service
• Website user information (including user journeys and cookie tracking)

For the operation of customer accounts and guarantees

We collect or use the following information:

• Names and contact details
• Account information, including registration details
• Information used for security purposes (authentication)
• Subscription and billing status

For research or archiving purposes

We collect or use the following information:

• Website and app user journey information
• Technical logs required to operate and secure the service

To comply with legal requirements

We collect or use the following information:

• Any personal information required to comply with legal obligations (including tax and accounting records related to subscriptions)

For dealing with queries, complaints or claims

We collect or use the following personal information:

• Names and contact details
• Account information

Lawful Bases and Data Protection Rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about lawful bases and your rights on the ICO's website.

Your Data Protection Rights

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure - You have the right to ask us to delete your personal information.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
• Your right to object to processing - You have the right to object to the processing of your personal data.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our Lawful Bases for the Collection and Use of Your Data

To provide services and goods:

• Contract: processing is necessary to provide Lot Locker account, matching workspace, and paid subscription you have requested.
• Legal obligation: we have to collect or use your information so we can comply with the law.
• Legitimate interests: Our legitimate interest is to provide, maintain, and improve the core services of Lot Locker application. The processing is necessary for the app to function as expected by users. We have conducted a balancing test and concluded the user benefits significantly outweigh the minimal and foreseeable privacy impacts, particularly in relation to:
  1. Providing Core App Functionality
  2. Processing Subscription Payments
  3. Communicating Essential Service Information
  4. Ensuring Service Security and Improvement

For the operation of customer accounts and guarantees:

• Contract: processing is necessary to create and operate your account.
• Legal obligation: we have to collect or use your information so we can comply with the law.
• Legitimate interests: Our legitimate interest is to provide, maintain, and improve the core services of Lot Locker application.

For research or archiving purposes:

• Legitimate interests: To analyse aggregated and pseudonymised user data for internal research to understand usage trends, diagnose problems, and improve the app. Additionally, to archive essential records as necessary to comply with legal and financial obligations and to establish or defend against legal claims.

For legal requirements:

• Legal obligation: we have to collect or use your information so we can comply with the law.

For dealing with queries, complaints or claims:

• Legitimate interests: to respond to support and privacy requests.
• Legal obligation: we have to collect or use your information so we can comply with the law.

Where We Get Personal Information From

• Directly from you
• Third parties, including:
  • Stripe: Payment processing
  • Amazon Web Services: Hosting and authentication infrastructure
  • Geocoding providers: Address lookup used when you search for a property or location
  • Property data and skip-trace providers: Paid enrichment and contact lookup features when you request them

How Long We Keep Information

For information on how long we keep personal information, see our retention schedule at: https://lotlocker.com/data-retention.html

Who We Share Information With

Data processors

• Stripe: Payment processor. This data processor processes subscription payments in a PCI-compliant way.
• Amazon Web Services: Cloud hosting, storage, and authentication.

We do not sell your personal information. Property, buyer, and deal records you enter remain in your account and are not used to market third-party products. Third-party property, owner, and contact data obtained through paid lookups may be cached and reused across accounts (including showing limited property information to other users) to operate the Services and reduce duplicate vendor requests, as described in our Terms of Service.

Sharing Information Outside the UK

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place. For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us.

• Organisation name: Stripe
• Category of recipient: Payment Processor
• Country the personal information is sent to: United States
• How the transfer complies with UK data protection law: Stripe is certified under the EU-U.S. Data Privacy Framework, which is covered by the UK-U.S. Data Bridge, providing a valid adequacy decision for the transfer. Our agreement with Stripe also incorporates the UK's Standard Contractual Clauses (SCCs), which legally require Stripe to protect the data to a standard equivalent to that of the UK.

How to Complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice. If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint