This Data Processing Agreement ("DPA") forms part of the PropertyPort Terms of Service between:
- the estate agency that holds the PropertyPort account (the "Customer"), as controller; and
- Adam Peter Thornley Groves, trading as PropertyPort, Maling Exchange, Hoults Yard, Newcastle upon Tyne NE6 2HL ("PropertyPort"), as processor.
It applies to personal data PropertyPort processes on the Customer's behalf ("Customer Personal Data"). It meets the requirements of Article 28 of the UK GDPR. Terms such as controller, processor, personal data and personal data breach have the meanings given in the UK GDPR.
1. Details of the processing
| Subject matter | Providing PropertyPort, a sales progression service for estate agencies |
| Duration | For as long as the Customer's account exists, plus the deletion periods in section 9 |
| Nature and purpose | Storing, organising, displaying, scoring, reporting on and sharing (by share link, on the Customer's instruction) sale progress information; sending service emails to the Customer's Users; support |
| Types of personal data | Names, contact details (email, phone, address), property addresses, agreed and asking prices, fees, mortgage and chain status, milestone dates, notes, contact logs, and User account and activity data. Where the Customer enables online offer forms: the offer, the buyer's position and the identity and funding documents the buyer uploads (for example photo ID, proof of address, proof of funds or deposit, agreement in principle) |
| Categories of data subjects | Buyers, sellers, their solicitors, brokers, lenders' contacts and other parties to a sale; the Customer's staff (Users) |
| Special category data | None is required. The Customer should not record special category or criminal offence data in PropertyPort. Identity and funding documents collected through online offer forms can be sensitive; they are stored privately, access-logged, and retained only for the periods in section 9. Because this involves identity documents at scale, we recommend the Customer completes a Data Protection Impact Assessment before switching the feature on |
2. Customer instructions
PropertyPort will process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the service's features (including creating share links) are the Customer's instructions. If PropertyPort believes an instruction breaks data protection law, it will tell the Customer. If the law requires PropertyPort to process data otherwise, it will tell the Customer first unless the law prevents this.
3. The Customer's obligations
The Customer confirms it has a lawful basis for the personal data it records, has given data subjects the information the law requires, and will only record data that is necessary for progressing sales.
4. Confidentiality
PropertyPort ensures that anyone authorised to process Customer Personal Data is bound by confidentiality. Access by PropertyPort's support team is limited to what is needed, and every support action is logged and visible to the Customer's admins under Settings, Support activity.
5. Security
PropertyPort will maintain appropriate technical and organisational measures, including:
- encryption in transit (TLS) and at rest;
- logical separation of each customer's data, enforced in the database and tested automatically with each release;
- role based access for Users, controlled by the Customer's admins;
- two factor authentication for PropertyPort's support console;
- hashed, revocable share link tokens that show limited progress information only;
- audit logs of changes to sales and of support access;
- hosting of the main database in the United Kingdom; and
- regular backups.
6. Sub processors
The Customer gives general authorisation for PropertyPort to use sub processors. The current list is:
| Sub processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | Data hosted in London, UK |
| Vercel Inc. | Application hosting | Application runs in London, UK |
| Resend Inc. | Service emails to Users | United States |
| Stripe | Payments (Customer billing contact data only) | UK, EU, United States |
| Google LLC (Workspace) | Support email | UK, EU, United States |
| Ideal Postcodes Ltd | Address lookup (postcode only) | United Kingdom |
PropertyPort will impose data protection terms on each sub processor that are no less protective than this DPA, and remains responsible for their performance. PropertyPort will give the Customer at least 30 days' notice by email of any new sub processor. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may cancel without penalty and receive a refund of any prepaid fees for the unused period.
7. International transfers
Customer Personal Data is stored in the United Kingdom. Where a sub processor processes data outside the UK, PropertyPort ensures the transfer is protected by UK adequacy regulations (including the UK US Data Bridge where applicable) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
8. Assistance
Taking into account the nature of the processing, PropertyPort will:
- help the Customer respond to requests from data subjects (the service lets the Customer view, correct, export and delete data itself; PropertyPort will pass on any request it receives directly);
- help the Customer with security, breach notification, data protection impact assessments and consultations with the ICO, where relevant to PropertyPort's processing.
9. Return and deletion
The Customer can export its data at any time from Settings, and can delete its agency and all its data at any time. The export and the deletion both include online offers and their uploaded documents. When an account ends, Customer Personal Data is permanently deleted 30 days after a subscription stops, or 60 days after a free period ends without a subscription, after a 7 day warning email. Data in backups is overwritten in the normal backup cycle. PropertyPort may keep data only where the law requires it.
While the feature is in use, online offer documents are also deleted automatically on a schedule the Customer relies on to meet its own retention duties: uploads that are never submitted within 24 hours; rejected or withdrawn offers and their documents after 12 months; and identity and funding documents for a sale that proceeds 5 years after the sale completes or falls through (anti money laundering retention). On the Offers plan, where an accepted offer does not become a sale in PropertyPort, its identity and funding documents are kept for 6 years after the offer was accepted, or for 5 years after the agency records that the sale completed or fell through if it does so, then deleted.
10. Personal data breaches
PropertyPort will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. It will provide the information the Customer reasonably needs to meet its own obligations, and take reasonable steps to contain the breach.
11. Audits
PropertyPort will make available the information reasonably necessary to demonstrate compliance with this DPA. Where that is not sufficient, the Customer may carry out an audit, at its own cost, on at least 30 days' notice, no more than once a year, during normal business hours and subject to confidentiality.
12. Linking sales with other agencies (future feature)
If PropertyPort offers a feature that lets the Customer link a sale with a sale handled by another agency (for example, the other side of a property chain), linking will only happen when the Customer chooses it. The Customer instructs PropertyPort to share the limited progress information described in the feature (such as milestones completed and expected dates) with that agency. Personal contact details, fees, notes and risk scores will not be shared. Either agency can unlink at any time.
13. Aggregated data
PropertyPort may create aggregated and de-identified statistics from use of the service (for example, typical time between milestones) to improve the service, including its risk scoring. Such statistics do not identify the Customer, any individual or any property, and are not personal data.
14. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA takes precedence.
15. Governing law
This DPA is governed by the law of England and Wales.