Privacy notice
What King's Wharf Management Limited keeps about you on this site, why, who sees it, and what you can ask for.
Who we are
The King's Wharf Management System (“the site”) is run by King's Wharf Management Limited (“KWML”, “we”), to be confirmed: company number and registered office. KWML manages the common parts of King's Wharf, Gibraltar, and is the controller of the personal data on the site.
Contact for anything in this notice: to be confirmed: privacy contact.
The site runs in KWML's own Microsoft Azure account. The person who built and supports it, to be confirmed: support developer, can access it only to maintain it, under a written agreement with KWML, and acts only on KWML's instructions.
What we hold about you
- Your account: name, email address, role (for example resident, caretaker or Council member), whether your account is active, and when you joined.
- Sign-in security: a scrambled (hashed) password, your authenticator-app secret (encrypted), passkey public keys, one-time email codes and recovery codes (hashed), and your active sign-ins.
- What you add: tickets, comments, photos and files you upload, meeting papers, minutes, decisions and documents. For Council members, also your declarations of interest.
- Activity records: an audit log of important actions, such as signing in, changing a ticket or opening a restricted document, with the time and your IP address. It keeps the site secure and lets the Council account for its decisions.
- Email preferences: whether you want key-date reminders or new-document emails.
Photos can show people, car number plates or the inside of a flat. Please photograph the problem only. When you upload a JPEG, PNG or WebP photo we remove its location and camera details. Other formats, such as iPhone HEIC photos, are kept as they are, so check your phone's location setting for the camera.
We use no advertising, tracking or analytics cookies. The only cookies are the ones that keep you signed in and protect forms.
Why we use it, and our legal basis
| Purpose | Legal basis (Gibraltar GDPR, Art. 6) |
|---|---|
| Running your account and keeping the site secure | Legitimate interests: running the estate's records safely |
| Handling repair and maintenance tickets | Legitimate interests, and KWML's obligations to owners under the leases and management arrangements |
| Council business: meetings, minutes, decisions, documents, declarations of interest | Legal obligation (company records) and legitimate interests (good governance) |
| Health and safety records, such as lighting, fire and lifts | Legal obligation |
| Key-date reminders and new-document emails | Your choice: off unless you turn them on, and you can turn them off at any time under Account |
We do not use your data for marketing, we do not sell it, and we make no automated decisions about you.
Who can see it
- Everyone with Tickets access (residents, caretakers and the Council) can see tickets, their comments and photos. Do not put private information in a ticket.
- Council members and admins see Council records according to their role. Some documents, and actions agreed at Council meetings, are restricted further.
- Admins can see the member list and the audit log.
- Our suppliers, only to run the site: Microsoft (Azure), under KWML's own account, for hosting, the database, file storage and sending email, all in the UK South region; and the support developer named above, for maintenance only. Gibraltar law recognises the UK as giving adequate protection for personal data.
- Others, only where the law requires it (for example a court order) or to deal with an emergency.
How long we keep it
- Accounts: closed when you leave the estate or your role. Your name stays on records you created, such as tickets and minutes, because those are the estate's records. Your sign-in data is deleted 30 days after closure.
- Tickets and their photos: 6 years after the ticket is resolved.
- Council records (minutes, decisions, documents, declarations of interest): as long as company law and good practice require. For minutes this is normally permanent.
- Audit log: 2 years.
- Email codes and sign-in links: minutes to days. They expire and cannot be reused.
- Backups: daily backups for 7 days and weekly backups for 12 weeks, then they are overwritten.
Your rights
You can ask us for a copy of your data, to correct it, to delete it or limit how we use it, or to move it to someone else. You can also object to how we use it. Some rights have limits where we must keep records by law.
Contact us at to be confirmed: privacy contact. We will reply within one month.
If you are unhappy with our answer, you can complain to the Gibraltar Regulatory Authority (Information Rights), www.gra.gi.
Security
All traffic is encrypted. Passwords and codes are stored only in scrambled form. You sign in with a password and a second check: an email code, an authenticator app. Important actions are recorded in the audit log. The site is in testing, so please also read the Beta terms.
Changes
If this notice changes, we will show you the new version the next time you sign in.