Parties and scope
This agreement forms part of the DueSafe Terms between the customer as controller and London Property Compliance LTD as processor. It covers storage, organisation, retrieval, export and deletion of customer portfolio data for the duration of the service and agreed closure process. Data subjects include landlords, tenants, occupants, customer staff, contractors and repair reporters. Data includes contact details, property and tenancy records, rent entries, compliance documents, repairs, photos and related messages. Customers should not upload unnecessary special-category or criminal-offence data.
Instructions and confidentiality
LPC processes customer data only on documented instructions, including authorised use of the portal, this agreement and verified support requests, unless UK law requires otherwise. Where permitted, we inform the customer of that legal requirement. We will inform the customer if an instruction appears to infringe data-protection law. Authorised personnel are subject to confidentiality obligations and access is limited to their duties. Customer data is not used for LPC advertising or unrelated purposes.
Security and incidents
LPC maintains measures appropriate to the processing risk, including access controls, account and role checks, private authenticated file delivery, HTTPS, expiring sign-in codes, logging and encrypted off-site recovery backups. We notify the customer without undue delay after becoming aware of a personal-data breach affecting its data, provide available information on nature, effects and mitigation, and send updates as investigation progresses. This is not a guarantee that every incident can be fully diagnosed within a fixed number of hours.
Sub-processors
The customer gives general authorisation to Hostinger for hosting/delivery and Google for transactional communications and encrypted recovery storage. Stripe is used for the customer’s subscription billing, with its role determined by its own terms; tenant portfolio documents are not sent to Stripe. Optional Google Analytics concerns public-site consent and does not receive workspace contents. Equivalent data-protection obligations must be put in place with sub-processors. LPC remains responsible for its processors’ performance of these obligations. We will notify customers at least 30 days before adding or replacing a portfolio-data sub-processor, except urgent protective changes where notice is given as soon as practical. A customer may raise a reasoned data-protection objection during that notice period; we will work to resolve it or arrange return/closure if no suitable alternative is available.
International processing
Processing outside the UK must use a lawful transfer basis, including applicable adequacy arrangements or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum where required. We will provide relevant information on reasonable request. No exclusive UK-hosting promise is made without checking the provider configuration.
Assistance and assurance
Taking account of the nature of processing and information available, LPC assists the customer with data-subject rights, security obligations, breach responses, impact assessments and required regulator consultations. LPC makes information necessary to demonstrate compliance available and allows reasonable audits and inspections by the customer or its mandated auditor. Audits must protect other customers, credentials and service security; practical arrangements do not remove statutory rights. LPC cooperates with the competent regulator.
Return, deletion and controller duties
On verified instructions at the end of the service, LPC returns or deletes personal data at the customer’s choice and deletes remaining copies unless law requires storage. The parties agree a practical export/deletion timetable, including how recovery snapshots are retired and how deleted data stays deleted after a restore. The customer is responsible for lawful collection, transparency notices, instructions, user permissions, record accuracy and deciding which legal property obligations apply. LPC remains responsible for its own processor obligations.