Data Processing Agreement

This Data Processing Agreement (the "DPA") sets out the terms on which Lettfolio processes personal data on behalf of its customers in connection with the Lettfolio service. It is designed to help both parties meet their obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Introduction and roles

This DPA forms part of, and is incorporated into, the agreement between you and us for the use of the Lettfolio service (the "Terms of Service" or "Principal Agreement"). In the event of any conflict between this DPA and the Terms of Service in relation to the processing of personal data, this DPA prevails.

In this DPA:

• "Lettfolio", "we", "us" means Lettfolio Ltd, a company registered in England & Wales (company no. 17306482) whose registered office is at Faulkner House, 31 West Street, Wimborne, Dorset, BH21 1JS. Lettfolio acts as the Processor.
• "Customer", "you" means the person or entity that has subscribed to the Lettfolio service (typically a landlord). The Customer acts as the Controller.

This DPA applies to our processing of personal data that you upload to or generate within the Lettfolio service — principally the data you hold about your tenants and related contacts. You determine the purposes and means of that processing; we process it on your behalf to provide the service.

2. Definitions

Unless otherwise defined in this DPA, the following terms have the meanings set out below. Terms not defined here have the meaning given in the UK GDPR.

• Controller — the party that determines the purposes and means of the processing of personal data (here, the Customer).
• Processor — the party that processes personal data on behalf of the Controller (here, Lettfolio).
• Personal Data — any information relating to an identified or identifiable living individual that is processed by us on your behalf under this DPA.
• Processing — any operation performed on personal data, such as collection, storage, organisation, use, disclosure, or deletion.
• Data Subject — the individual to whom personal data relates (for example, one of your tenants).
• Sub-processor — any third party engaged by us to process personal data on your behalf in connection with the service.
• UK GDPR — the United Kingdom General Data Protection Regulation as defined in the Data Protection Act 2018.
• Data Protection Laws — the UK GDPR, the Data Protection Act 2018, and all other applicable laws and regulations relating to the processing of personal data and privacy that apply to the parties.

3. Processing on the Customer's instructions

We will process personal data only on your documented instructions, including with regard to international transfers, unless we are required to do otherwise by law (in which case we will inform you of that legal requirement before processing, unless the law prohibits us from doing so).

Your instructions are set out in this DPA and the Terms of Service. The provision of the Lettfolio service — storing, organising and making available the records you enter — constitutes your documented instructions to us. Any additional or different instructions must be agreed in writing.

We will inform you if, in our opinion, an instruction infringes the UK GDPR or other Data Protection Laws.

4. Customer obligations

You warrant and undertake that, in relation to the personal data you provide to or process through the service:

• you have a valid lawful basis under the UK GDPR for the processing;
• you have the right to provide that personal data to us and to instruct us to process it as set out in this DPA;
• you have provided the relevant data subjects (for example, your tenants) with any privacy information required by the UK GDPR; and
• your instructions to us comply with Data Protection Laws.

As Controller, you are responsible for the accuracy, quality and legality of the personal data and the means by which you acquired it.

5. Confidentiality

We will ensure that all personnel authorised to process personal data under this DPA are bound by appropriate obligations of confidentiality, whether contractual or statutory, and are made aware of the confidential nature of the personal data. Access to personal data is limited to those personnel who need it to perform their duties.

6. Security (Article 32)

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include encryption of data in transit, database access controls with tenant / row-level isolation, restricted and role-based access on a least-privilege basis, authentication controls and regular backups.

A summary of the measures in place is set out in Annex 2. We may update these measures from time to time provided the level of protection is not materially reduced.

7. Sub-processors

You provide a general authorisation for us to engage the sub-processors listed in Annex 3 to process personal data in connection with the service.

Where we engage a sub-processor, we will impose on it, by written contract, data-protection obligations equivalent to those set out in this DPA. We remain fully liable to you for the performance of each sub-processor's obligations.

We will give you prior notice of any intended addition or replacement of a sub-processor (for example, by updating Annex 3 or by email). You may object to a new sub-processor on reasonable data-protection grounds within a reasonable period of being notified. If we cannot resolve your objection, you may terminate the affected part of the service.

8. Data-subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as this is possible, to respond to requests from data subjects exercising their rights under the UK GDPR — including rights of access, rectification, erasure, restriction, portability and objection.

If we receive a request directly from one of your data subjects relating to data we process on your behalf, we will, where lawful, promptly forward it to you and will not respond to the request ourselves except on your instructions.

9. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting the personal data we process on your behalf. The notification will include, to the extent available, the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

We will provide reasonable assistance to help you meet your own obligations to notify the Information Commissioner's Office (ICO) and, where required, affected data subjects.

10. Assistance with DPIAs and prior consultation

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance to you in carrying out data protection impact assessments (DPIAs) and any associated prior consultation with the ICO, where these are required under the UK GDPR.

11. International transfers

Personal data is hosted primarily in the United Kingdom. Where a sub-processor processes personal data outside the UK (for example, our application hosting provider Vercel, which operates in the USA), we will ensure that an appropriate transfer mechanism is in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required to ensure an adequate level of protection.

12. Audit

We will make available to you all information reasonably necessary to demonstrate compliance with our obligations under this DPA, and will allow for and contribute to reasonable audits, including inspections, conducted by you or an auditor mandated by you. Audits will be carried out on reasonable prior notice, no more than once per year (save where required by a supervisory authority or following a personal data breach), during normal business hours, and in a manner that does not disrupt our operations or compromise the security of other customers' data.

13. Return or deletion of personal data

On termination or expiry of the Terms of Service, we will, at your choice, delete or return the personal data we process on your behalf, and delete existing copies, unless we are required by law to retain it. You may also export your data from the service prior to termination. This is subject to any limited retention required for legal, accounting or backup purposes, during which the data will remain protected by this DPA.

14. Liability

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Service. This DPA does not limit any liability that cannot be limited or excluded under applicable law.

15. Governing law

This DPA is governed by the laws of England & Wales, and the parties submit to the exclusive jurisdiction of the courts of England & Wales, consistent with the Terms of Service.

Annex 1 — Details of processing

Annex 2 — Technical and organisational security measures

We maintain the following measures, which may be updated from time to time provided the overall level of protection is not materially reduced:

• Encryption in transit — data transmitted between users and the service is encrypted using TLS/HTTPS.
• Secure UK hosting — the primary database is hosted in a secure data centre in the United Kingdom.
• Tenant isolation — database row-level security and access policies ensure each customer can access only their own data.
• Access controls and least privilege — access to systems and data is restricted to authorised personnel on a need-to-know basis.
• Authentication — user accounts are protected by authentication controls.
• Backups — regular backups are taken to protect against data loss.
• Security headers — appropriate HTTP security headers are applied to the application.
• Vendor due diligence — sub-processors are selected and reviewed for their ability to provide appropriate security and data-protection guarantees.

Annex 3 — Approved sub-processors