Please sign in

Terms of Service (Portal)

Last updated: 11 December 2025

1. Service scope

The Portal provides features to manage your tenancy: submit maintenance requests, access documents, and view statements or charges, as made available for your property. 

2. Registration and verification

Access is granted to verified tenants or authorised representatives. We may require proof of identity/authority and may suspend accounts used in breach of policy. 

3. Charges and payments

If the Portal enables payment or shows account balances (e.g., rent, service charges), applicable amounts are governed by your lease/licence and property agreements, not these Terms. Any online payment functionality will include specific payment terms and security measures. 

4. Maintenance and service availability

MRI manage this platform on behalf of Places for London. They may perform maintenance, updates, or enhancements that temporarily affect availability. They will aim to provide reasonable notice for planned downtime. 

5. Incident and data breach response

We operate security and incident response processes. Where a personal data breach occurs that risks your rights and freedoms, we will assess and notify affected users and regulators in accordance with UK GDPR. 

6. Termination

We may suspend/terminate your access for breach of these Terms, misuse, or where your tenancy/authority ends. You may request closure by contacting support.

7. Changes

We may update these Terms of Service periodically; continued use indicates acceptance.

Our website uses cookies to improve your experience and to ensure the website functions correctly. Below is a detailed description of the cookies we use.

What Are Cookies?

Cookies are small text files that are stored on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to the owners of the site.

How We Use Cookies

We use cookies for various purposes, which can be categorized as follows:

Strictly Necessary Cookies

These cookies are essential for the website to function correctly. Without these cookies, some parts of our website would not work. They do not store any personally identifiable information.

• cc_cookie
  • Purpose: Remembers if the user has consented to cookie usage.
  • Duration: 6 months
• • Purpose: Prevents Cross-Site Request Forgery (CSRF) attacks.
  • Duration: Session
• .AspNetCore.Identity.Application
  • Purpose: Manages user authentication and maintains session state.
  • Duration: Session
• .AspNetCore.Mvc.CookieTempDataProvider
  • Purpose: Temporarily stores data needed for the next request.
  • Duration: Session
• UMB-XSRF-V, UMB-XSRF-TOKEN
  • Purpose: Prevents cross-site scripting attacks.
  • Duration: Session
• UMB_UCONTEXT, UMB_UCONTEXT_C
  • Purpose: Maintains session state for logged-in users, visible only to administrators.
  • Duration: Session
• UMB_SESSION
  • Purpose: Preserves session state across page requests.
  • Duration: Session
• UMB_PREVIEW
  • Purpose: Allows previewed pages to function as published pages in the same browser session.
  • Duration: Session
• umb_installId
  • Purpose: Stores the Umbraco software installer ID.
  • Duration: Session
• UMB_UPDCHK
  • Purpose: Checks for Umbraco software updates.
  • Duration: Session
• TwoFactorRememberBrowser
  • Purpose: Remembers that two-factor authentication is not needed for the next login.
  • Duration: Session
• eng_amts
  • Purpose: Remembers the amounts used in the current payment in order to make a successful payment fail safe. An example of this would be when a user is logged out whilst making a successful payment.
  • Duration: Session
• eng_qids
  • Purpose: Remembers the qube ids of the items within a the current payment, in order to make a successful payment fail safe. An example of this would be when a user is logged out whilst making a successful payment.
  • Duration: Session

Analytics Cookies

These cookies collect information about how visitors use our website, such as which pages are visited most often. This helps us to improve the way our website works.

• __utma
  • Purpose: Distinguishes users and sessions for Google Analytics.
  • Duration: 2 years
• __utmb
  • Purpose: Identifies new sessions/visits for Google Analytics.
  • Duration: 30 minutes
• __utmc
  • Purpose: Determines the end of a browser session for Google Analytics.
  • Duration: Session
• __utmt
  • Purpose: Throttles request rate for Google Analytics.
  • Duration: 10 minutes
• __utmz
  • Purpose: Stores the traffic source or campaign that explains how the user reached the site.
  • Duration: 6 months
• _ga
  • Purpose: Distinguishes users for Google Analytics.
  • Duration: 2 years
• ar_debug
  • Purpose: Stores user preferences or debugging settings.
  • Duration: Session

Third-Party Cookies
Our website uses third-party cookies, which are cookies set by a domain other than our own. These cookies enable features or functionality provided by third parties in connection with our website, such as analytics, advertising, and social media interactions.

Flywire:

Managing Your Cookie Preferences

You can manage your cookie preferences at any time by selecting the "Manage Cookie Consent" option on the profile menu if logged in, or on the page footer if not logged in. Please note that if you disable cookies through your browser settings, some parts of our website may not function properly.

Changes to This Cookie Policy

We may update our Cookie Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We encourage you to review this policy periodically.

Contact Us

If you have any questions about our Cookie Policy, please contact us.

Privacy Policy

Last updated: 11 December 2025

1. Overview

We are committed to protecting personal information in line with UK data protection legislation (UK GDPR and Data Protection Act 2018). We process personal data lawfully, fairly, and transparently, applying the data protection principles.  

2. Who is the controller?

Places for London Limited is the data controller for Portal operations. We may share data within the TfL group as necessary to deliver property management services and comply with law. 

3. What data we collect

• Account data (name, contact details, role/authority, organisation, property unit).
• Tenancy/occupancy data (lease identifiers, correspondence, billing and service requests).
• Usage data (Portal activity logs, preferences, support tickets).
• Technical data (IP address, device/browser details, cookies—see Cookie Policy). 

4. Why we process your data (lawful basis)

We process personal data where it is necessary to:

• Provide and administer tenant services and fulfil our property management obligations (contract);
• Perform tasks carried out in the public interest or in the exercise of official authority vested in TfL/Places for London, where applicable to statutory functions (Article 6(1)(e) public task);
• Comply with legal obligations (e.g., safety, taxation, fraud/crime prevention);
• Pursue legitimate interests (e.g., service improvement, cybersecurity), balancing your rights—recognising evolving UK guidance including “recognised legitimate interests” under the Data Use and Access Act (DUAA) once fully in force. 

Special category data: If we ever need to process special category data (e.g., health data in incident reports), we will identify and document an appropriate legal basis and condition (e.g., substantial public interest, safeguarding, or legal claims) in line with UK GDPR/DPA 2018. 

5. How we use your data

We use data to:

• Issue correct rental invoices;
• Manage tenancy‑related communications, requests, and service delivery;
• Issue service messages (e.g., planned works, outages);
• Meet compliance, audit, and risk obligations (including incident reporting and responding to statutory requests). 

6. Sharing your data

We may share data with:

• TfL subsidiaries and approved service providers (e.g., property systems, payment processors, maintenance partners) under contract;
• Law enforcement or regulators where required by law;
• Other parties with your consent or as necessary to deliver services.

7. Security

We use industry‑standard security measures (including encryption in transit, access controls, and monitoring) to protect your data and investigate incidents. 

8. Data retention

We keep personal data only as long as necessary for the purposes stated, considering legal, operational, and audit needs; then we delete or anonymise it. (Data protection principle—storage limitation.) 

9. Your rights

Subject to applicable law, you have rights to: be informed, access, rectification, erasure, restriction, objection, and data portability; plus rights related to automated decision‑making. 

10. Accessing your data (Subject Access Requests)

You can submit a Subject Access Request (SAR) to obtain a copy of your personal data. We may ask you to clarify the scope to help locate records and to verify identity.

11. International transfers

If we ever transfer personal data outside the UK, we will use appropriate safeguards (e.g., UK Addendum/IDTA, adequacy regulations) and inform you where required.

12. Contact and complaints

• Data Protection Officer (DPO): MRI provide this Portal for Places for London, contact legal@mrisoftware.com. 
• Complaints: Contact us first. You may also contact the Information Commissioner’s Office (ICO) if you’re not satisfied. 

13. Changes to this policy

We may update this Privacy Policy; we will post changes on the Portal and, where appropriate, notify users.