This Data Processing Agreement (“DPA”) forms part of the agreement between PropVerdict Ltd (“Processor”, “we”) and any business customer that submits personal data of its own clients or contacts through the Service (“Controller”, “you”) — for example, when you use white-label features to email a report to your client. It applies automatically from the point you first submit a client’s personal data through the Service, without requiring a separate signature, though a countersigned copy is available on request to sales@prop-verdict.com.
This DPA is intended to meet the requirements of Article 28 of the UK GDPR.
1. Roles
For the personal data described in Annex 1 (broadly: the name and email address of a report recipient, and any note you choose to include when sending them a report), you act as the data controller and we act as your data processor. For our own account-holder and billing data, we act as controller in our own right, as set out in our Privacy Policy — that relationship is not covered by this DPA.
2. Subject matter, duration, and purpose
We process the personal data described in Annex 1 for the duration of your subscription (plus our standard retention period thereafter, as described in our Privacy Policy), for the sole purpose of generating and delivering property reports on your instruction.
3. Our obligations as processor
We will:
- process personal data only on your documented instructions (which include the instructions inherent in your use of the Service’s features, such as entering a client’s name/email and clicking “send”);
- ensure people authorised to process the data are subject to confidentiality obligations;
- implement appropriate technical and organisational security measures, as described in Annex 2;
- not engage a new sub-processor without giving you prior notice and the opportunity to object, as set out in section 5;
- assist you, so far as reasonably possible, in responding to data subject rights requests relating to data processed under this DPA;
- assist you in meeting your obligations relating to data security, breach notification, and data protection impact assessments, so far as they relate to our processing;
- notify you without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA;
- at your choice, delete or return all personal data to you at the end of the relationship, save where we are required by law to retain it; and
- make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice.
4. Your obligations as controller
You confirm that you have a lawful basis under data protection law to submit your clients’ personal data to us for the purposes described in this DPA, and that you have given your clients any privacy information required by law regarding this processing (including, where relevant, that a report about a property is being generated using a third-party service).
5. Sub-processors
You authorise us to engage the following sub-processors, each engaged under a written contract imposing data protection obligations equivalent to those in this DPA:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | [CONFIRM hosting region] |
| Resend | Transactional email delivery | [CONFIRM hosting region] |
| Stripe, Inc. | Payment processing (billing data only, not report-recipient data) | US / global |
| Google (Google Maps Platform) | Address resolution, imagery, environmental data lookups | US / global |
We will notify you (by email or a notice within the Service) of any intended addition or replacement of a sub-processor at least 14 days before the change takes effect, giving you the opportunity to object on reasonable data protection grounds. If we cannot resolve your objection, either party may terminate the affected processing.
6. International transfers
Where a sub-processor is located outside the UK, transfers are made subject to appropriate safeguards, such as the UK International Data Transfer Agreement/Addendum or an adequacy mechanism recognised under UK data protection law.
7. Liability
Each party’s liability under this DPA is subject to the limitation of liability set out in our Terms of Use.
8. Term and termination
This DPA remains in effect for as long as we process personal data on your behalf under the Service, and terminates automatically when that processing ends.
Annex 1 — Details of processing
Categories of data subjects
Report recipients (your clients) and, where relevant, any other individual you name in a note sent with a report.
Categories of personal data
Name, email address, free-text note content (entered by you), and delivery/read status of the email sent.
Special category data
None. You must not submit special category data (e.g. health, financial hardship details) via free-text note fields.
Nature and purpose of processing
Generating a property report and delivering it by email or shareable link, on your instruction.
Duration
For the duration of your subscription and our standard post-cancellation retention period, as set out in our Privacy Policy.
Annex 2 — Security measures (summary)
Encryption of data in transit (TLS/HTTPS across the Service); encryption of data at rest via our infrastructure providers; role-based access controls; secure credential storage (passwords hashed, never stored in plain text); rate limiting on data-submission endpoints; and a documented incident-response process for personal data breaches.
Contact
Questions about this DPA: legal@prop-verdict.com.