Trust & Compliance

DisrepairIQ processes personal data as a data processor on behalf of instructing firms, which act as data controllers in respect of their clients' information. Processing is governed by the UK GDPR and the Data Protection Act 2018.

• Data controller: the instructing firm, which retains responsibility for lawful basis and client notification.
• Data processor: RESOLVEMYDISPUTE LIMITED, processing claim and tenant data solely to provide the platform.
• Purposes: claim assessment, quantum calculation, document extraction, Letter-of-Claim drafting, and disclosure review.
• Lawful basis: the firm's basis (typically legal obligation and/or contract) for client data; legitimate interests/contract for firm user data.
• Rights: data subject requests are routed to the instructing firm; we assist firms in fulfilling them within statutory timeframes.

A formal DPA is available to instructing firms on request and before any pilot or paid engagement. It reflects the Article 28 UK GDPR requirements and sets out subject-matter, duration, nature, purpose, data types, categories of data subjects, and the firm's obligations as controller.

• Processing only on the firm's documented instructions.
• Confidentiality obligations for all personnel with access.
• Sub-processor engagement only with the controller's authorisation and under equivalent terms.
• Assistance with data subject rights, security of processing, breach notification, and impact assessments.
• Deletion or return of data on termination, at the controller's election.

We rely on the following categories of sub-processor to deliver the platform:

• Cloud hosting & infrastructure: the platform's hosting provider, used for application and data storage.
• AI processing: enterprise AI APIs used for extraction, assessment, quantum and drafting, engaged under terms that prohibit use of customer data for model training.
• Email delivery: a transactional email service used for automated status and review notifications.

Firms are notified of material sub-processor changes in advance, with the opportunity to object. A current, named sub-processor list is provided with the DPA.

Customer data is hosted on infrastructure located in the United Kingdom / European Economic Area. The hosting provider operates under terms consistent with UK GDPR transfer requirements. No customer data is deliberately transferred to jurisdictions outside the UK/EEA; any necessary transfer is carried out only with appropriate safeguards (such as UK Addendum / Standard Contractual Clauses).

• Uploads: documents uploaded for AI extraction are permanently deleted immediately after analysis — they are not retained by the AI provider or used for model training.
• Claim records: retained for the duration of the firm's engagement and accessible to the firm. Firms may delete cases at any time; supervisor approval is required to delete a case once created, for audit integrity.
• On termination: on the firm's election, data is either returned (export) or securely deleted within a defined period set out in the DPA.
• Backups: retained on a short rolling cycle and purged within the period stated in the DPA.
• What remains in the claim record: the structured claim information you approve (parties, tenancy, defects, notice history, special damages), generated drafts, disclosure reviews and supervisor review notes. Uploaded source documents are purged after extraction; only the extracted and approved data is retained as part of the case.

We maintain an incident response process covering detection, containment, assessment, notification and remediation. In the event of a personal data breach, we notify the affected firm without undue delay and assist it in meeting its own notification obligations to the ICO and affected data subjects under UK GDPR timescales (ordinarily 72 hours where required).

• Encryption: TLS 1.3 in transit; encryption at rest for stored data and backups.
• Access control: role-based access (admin / fee earner / supervisor) with per-user and per-firm row-level security to prevent cross-firm data exposure.
• Authentication: managed authentication with email verification and password policies; session controls handled by the platform.
• Network & app security: managed infrastructure hardening, dependency patching, and input validation.
• Separation: customer data is logically isolated per firm; access to production data is least-privilege and logged.

DisrepairIQ was created by a housing disrepair barrister for housing disrepair solicitors. Legal content — the grounding legislation, case digests, and Pre-Action Protocol references used by the platform — is curated and reviewed by a legal editor, supported by an advisory panel of regulated practitioners.

• Legal editor: responsible for the accuracy and currency of the legal sources embedded in the platform, and for approving additions or changes.
• Advisory panel: solicitors and counsel who review output quality, edge cases, and protocol alignment, and feed back on real-world use during pilots.
• Independence: the platform is a drafting aid only. It does not provide legal advice and does not create a solicitor–client relationship with end users.

Named members of the legal editor and advisory panel are disclosed to instructing firms as part of onboarding. We do not publish individuals' details on this public page without their consent.

The law embedded in DisrepairIQ is updated through a defined review cycle:

• Monitoring: the legal editor tracks changes to the underlying statutes (e.g. Landlord and Tenant Act 1985, Homes Act 2018), the Pre-Action Protocol, CPR, and relevant case law.
• Review: proposed updates are reviewed by the legal editor and, where material, the advisory panel before release.
• Release: updates are versioned and dated; material changes are communicated to firms with the effective date.
• Limitation: where the law is unsettled or a point is not covered by supplied sources, the platform is instructed to say so rather than guess.

The current source library was last reviewed by the legal editor in 2026; the review date is recorded against each source and made available to instructing firms on request.

For the full DPA, sub-processor list, security questionnaire responses, or to arrange a due-diligence call, contact RESOLVEMYDISPUTE LIMITED:

• Company: RESOLVEMYDISPUTE LIMITED
• Company No.: 15182581
• Registered Office: Room 8 Redhills House, Redhills, Penrith, CA11 0DT
• Jurisdiction: England and Wales