Guiding your success: A case study by Freeths
Jos Pink, the director of startup proptech business Thovex Limited, had a bright idea. But he also knew that he had an issue. When he contacted us in early 2019, Jos and his team already had the concept of a platform that was going to revolutionise the way that land developers researched strategic land acquisitions. They had done a lot of work on the technical side, writing code to collect data from public databases on the internet and had made contact with official data custodians like HM Land Registry and Companies House, to establish what data of theirs could be included.
Jos’s concern came from understanding that there was a lot that he didn’t know, and in particular an awareness that data (specifically personal data) was a heavily regulated area where he couldn’t afford to put a foot wrong. He reached out to Freeths and embarked on what proved to be a pretty steep learning curve over the following few months.
We started, as we often do, with a wide-ranging initial conversation which gave Jos the chance, before he had even formally appointed Freeths, to get an insight into the steps he would need to take before being able to launch his product.
These covered a wide range of different activities, from incorporating the company and protecting its brand, through drafting formal customer contracts and terms of business, and putting in place suitable agreements for the staff and contractors who were going to be working to get the product completed. But Jos’s instinct that data protection was one of the main challenges they would face proved to be particularly insightful.
“Data protection and privacy (GDPR) is something that everyone thinks they understand,” says Jos, looking back on that preliminary meeting, “but in practice they rarely do.” Talking about what the project would involve it rapidly became clear that significant quantities of personal data would need to be collected, both from the datasets maintained by the Land Registry and Companies House, but also from the publicly available data which Jos’s software would locate on local authority websites, collect and make available in consolidated form on his ‘Landstack’ platform.
Even though this data was already freely available to anyone who wanted to look for it, Thovex were keen to ensure that they handled the data respectfully and in a way that went above and beyond the minimum compliance with the GDPR. This led to a series of more detailed meetings where they immersed themselves in the data protection principles, and critical concepts like the lawful bases of processing, and the central importance of a data protection impact assessment.
Jos was surprised at how wide-ranging this aspect of the project ended up becoming. “We enlisted the help of Freeths at the beginning of our development process, but didn’t realise just how impactful and important their guidance on data privacy and protection would be for our product.”
This included making sure that Landstack was designed, from the code up, to respect the core principles of data protection. Only data necessary for their customer’s purposes would be collected, it would only be able to be processed for limited purposes and subject to rigorous retention policies that would see significant quantities of even relevant data deleted as soon as it had exceeded its usefulness.
But Thovex, already on course to design a robustly compliant product, wanted to go even further. As they learned more about the concept of a data protection impact assessment, they decided that any such assessment would be incomplete without a sense of the attitude to this processing activity which ordinary data subjects might have. So they commissioned an online poll of the public at large, collecting a sample of over 1,000 responses within just a few days. The final analysis of the answers to these 20 questions revealed important information about the level of the public’s understanding around what personal data of theirs is available, but also the criteria on which they would be comfortable with that data being made available on a platform like Landstack.
Now, in late 2019, the Landstack platform is complete and Thovex already have a number of interested customers. Having built the platform from the ground up with compliance in mind, they have been able to use that element of respect for data protection as a selling point, to differentiate themselves from their competition.
But it also gives them, and their customers, the confidence that they can tackle any data protection concern or issue that might come their way. It’s a confidence that comes from properly understanding the regulatory space in which they operate, and seeing compliance as a core ingredient in their design rather than an after-thought, or window dressing. “With Freeths’ guidance, we have designed our system to make it clear and simple for any data protection query or issue we have to be handled.”