Data Processing Agreement

This agreement is between you, the landlord using RenteRoo, and 4Real Estate Limited (company number 15119929), registered office 42 Ffordd Y Meillion, Llanelli, SA15 2EX, Wales, trading as RenteRoo.

It forms part of the Terms of Service and applies from the moment you create a landlord account. You do not need to sign anything separately — accepting the Terms accepts this, and we record which version you accepted and when.

What it is for. When you use RenteRoo to hold information about your tenants, you decide what that information is for and we act on your instructions. UK law calls you the controller and us the processor, and it requires the two of us to have a written agreement covering specific things. This is that agreement. It is the same for every landlord.

1. The words that matter

• UK data protection law means the UK GDPR and the Data Protection Act 2018, as amended.
• Controller, processor, personal data, processing, data subject and personal data breach mean what they mean in UK data protection law.
• Tenant data means personal data you put into RenteRoo, or that your tenants put in through the accounts you invite, about your tenants, your properties and your tenancies. Annex 1 describes it.
• Sub-processor means another company we use to help provide RenteRoo that handles tenant data. Annex 3 lists them.

2. Our roles

• You are the controller of tenant data. We are your processor. We hold it for you and act on your instructions.
• We are the controller of your own account data — your name, your email, your login, how you use the product. That is covered by our Privacy Policy, not by this agreement.
• We will never use tenant data for our own purposes. We do not sell it, we do not use it for marketing, and we do not use it to train any artificial-intelligence model, ours or anyone else's.

3. Your instructions to us

• We process tenant data only on your documented instructions. Your instructions are: these Terms, this agreement, the retention schedule in §11, and what you do in the product — recording a tenancy, uploading a document, inviting a tenant, sending a message, generating an inventory.
• If you want us to do something outside that, put it in writing to hello@renteroo.co.uk. We may charge for work that goes beyond the product, and we will tell you before we do anything.
• If we think one of your instructions breaks UK data protection law, we will tell you straight away and we may pause that instruction until it is resolved.
• If the law requires us to process tenant data for something other than your instruction, we will tell you before we do it unless the law forbids us from telling you.

4. What you can expect from us — the short version

The rest of this agreement sets out, in the order UK GDPR Article 28(3) asks for them, that we will: keep tenant data confidential (§6); secure it (§7); use sub-processors only under the conditions in §8; keep it in the UK or EEA, or protect it properly if not (§9); help you answer your tenants (§10); return or delete it when you leave (§11); tell you quickly about a breach and help you handle it (§12); and show you we are doing all of it (§13).

5. What you confirm to us

*We are not taking on your responsibilities and we are not advising you on them — but we do need you to confirm you have met them, because we cannot run the service lawfully if you have not.*

You confirm that:

1. You have a lawful basis under UK data protection law for holding your tenants' personal data and for putting it into RenteRoo.
2. You have given your tenants a privacy notice telling them how you use their data — including that you use a software supplier that holds it for you on your instructions.
3. You have the right to give us the data you give us, and to ask us to do what you ask us to do with it.
4. You will not put special category data into RenteRoo unless you need to and have a lawful basis under Article 9 — health, ethnicity, religion, sexuality, biometric data and the rest. The practical version: do not upload what you do not need.
5. You will keep your account secure — a strong password you use nowhere else, multi-factor authentication switched on, and you will tell us straight away if you think someone else has got in.
6. You will deal with your tenants' requests about their data, with our help under §10.

We do not advise you on any of this, and nothing in RenteRoo is that advice. If you are not sure, ask a qualified adviser. Free guidance for small organisations is at ico.org.uk.

6. Our people

Everyone we allow near tenant data is bound to keep it confidential, either by their contract or by a written undertaking, and that duty continues after they stop working with us.

Being straight with you about scale: RenteRoo is currently run by one person, the founder and director of 4Real Estate Limited. She is the only person with access to production systems. That is a genuine security advantage — the smallest possible number of people can see your tenants' data — and a genuine risk, which is why §7 covers what happens if that access is compromised and why every account she holds has multi-factor authentication on it.

7. Security

We take the technical and organisational measures required by Article 32. Annex 2 sets out what they actually are — not a list of adjectives, the real measures, including the one place we currently fall short.

We will keep those measures under review and may change them, but we will not reduce the overall level of protection.

8. Sub-processors

• You give us general written authorisation to use sub-processors. The current list is at /subprocessors and summarised in Annex 3.
• Before we add or replace one, we will tell you at least 30 days in advance — by email and on that page.
• You may object, in that 30 days, on reasonable data-protection grounds. Tell us why and we will try to resolve it. If we cannot, you may end your use of RenteRoo without penalty and take your records with you, and we will not charge you for anything you have not used.
• Every sub-processor is bound by written terms that are no less protective than this agreement, and we remain fully liable to you for what they do. If one of them fails, that is our failure to you, not something we point at.

9. Where we process it

• We process tenant data in the United Kingdom or the European Economic Area.
• If a sub-processor processes it outside the UK or EEA, we will only allow it where a mechanism recognised by UK law is in place — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — supported by an assessment of the risk, and we will say so on the sub-processor page.
• The current position for each supplier, including which regions are confirmed, is on /subprocessors.

10. Helping you answer your tenants

Your tenants have rights — to see their data, to have it corrected, to have it deleted, to object, to get a copy to take elsewhere. Those requests are yours to answer. We will help:

• The product does most of it. You can see, correct, export and delete a tenant's records yourself, without asking us.
• Where you cannot, we will. Email hello@renteroo.co.uk and we will help you find, correct, export or delete what you need — within 5 working days, so you can still meet your own one-month deadline.
• If a tenant comes to us directly, we will not answer for you. We will tell them to ask you, tell you they asked, and pass on what they said — within 5 working days. We will not change or delete anything of yours on a tenant's say-so.
• We will also help you with a data protection impact assessment, a security question, or a consultation with the ICO, if you need it and it relates to RenteRoo.
• This help is free for anything reasonable. If a request is excessive or repetitive we may agree a charge with you first, and we will never let a cost dispute stop you meeting a legal deadline.

11. How long we keep it, and what happens when you leave

Every landlord could have a different view of how long records should be kept, and we cannot run a different schedule for each one. So the schedule below is a published term you accept, and accepting it is your documented instruction to us to hold the records for that long.**

While you use RenteRoo, we keep tenant data for as long as you keep it. Delete something and it goes, subject to backups ageing out.

When you close your account or stop using RenteRoo:

1. You can export everything, at any time, and we offer the export at closure. Take it before you go.
2. Within 30 days, we will return or delete tenant data at your choice — except for the records in point 3.
3. Property, tenancy and compliance records are retained for 6 years after the tenancy ends or the property is closed, then anonymised. This is deliberate and it protects you as much as your tenant: these records describe a relationship between two people, either of whom may need them if something is disputed later, and six years matches the window for a contract claim under the Limitation Act 1980. By accepting these Terms you instruct us to keep them for that period.
4. You can instruct us to delete them sooner, in writing, and we will — unless the law requires us to keep them. If you do, understand what you are giving up: neither you nor your tenant will be able to get them back.
5. Backups age out on their own rotation. Data in a backup is not actively used and is deleted when that backup is deleted.

12. If something goes wrong

• If there is a personal data breach affecting your tenant data, we will tell you without undue delay and in any event within 48 hours of becoming aware of it.
• We will tell you what we know: what happened, roughly how many people and records are affected, what the likely consequences are, and what we are doing about it. If we do not know everything at 48 hours, we will tell you what we do know and follow up — we will not delay the first message to make it complete.
• We will help you meet your own duties — reporting to the ICO within 72 hours, and telling your tenants where you have to.
• We will not notify your tenants on your behalf unless you ask us to in writing. That is your call and your voice.
• We will not make a public statement naming you without telling you first.
• We keep a written record of every breach and you can ask to see the entry that concerns you.

13. Showing you we comply

*UK GDPR gives you a right to audit us. An unlimited right of inspection held by every landlord is not something a one-person company can survive, and a right that cannot be honoured is worse than one that is shaped honestly. So:*

• Ask us anything, in writing, and we will answer — how the security measures in Annex 2 work, what a sub-processor does, how a record is stored. Within 15 working days.
• We will give you evidence on request: our security documentation, the results of testing we have had done, our sub-processor terms.
• You may inspect in person, or send an auditor, on 30 days' written notice, during working hours, at your own cost, and not more than once in any 12 months — with a reasonable confidentiality undertaking from whoever does it.
• That once-a-year limit does not apply after a personal data breach affecting your data, or where the ICO requires an inspection. Then you may audit as soon as you reasonably need to.
• We will co-operate properly with any audit and will not treat it as an inconvenience.

14. Liability

• Our liability to you under this agreement is subject to the limits in Part B of the Terms of Service. There is not a second, larger pot of money behind this document.
• Those limits do not apply to anything UK data protection law does not allow us to limit, or to a fine or compensation you incur because we broke this agreement — within the cap in the Terms.
• Each of us is responsible for our own compliance. If your tenant suffers because of something you did, that is yours; if it is because of something we did, that is ours; if it is both, each of us pays our share.
• You will cover us against a claim by one of your tenants that is caused by your breach of this agreement — for example, data you had no lawful basis to give us, or a privacy notice you never gave them.

15. How long this lasts

This agreement starts when you create your account and lasts as long as we hold tenant data for you. §§11, 12, 13 and 14 continue to apply afterwards, for as long as we still hold anything of yours.

16. Changes to this agreement

We may update it — because the law changes, because the product changes, or because we improve something. We will email you and show a notice in the product at least 30 days before a material change takes effect. If you do not accept it, you may close your account and take your records, and we will not hold you to the new version.

We keep every published version. Your settings page shows which version you accepted and when, and lets you download it.

17. General

• If this agreement and the Terms of Service disagree about personal data, this agreement wins.
• This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
• If any part is unenforceable, the rest continues.

Annex 1 — What we process, for whom, and why

Required by UK GDPR Article 28(3).

Annex 2 — What we actually do to keep it safe

Required by UK GDPR Articles 28(3)(c) and 32. Written from what is in place, not from a template. Where something is not in place, it says so.

1. In transit. Everything travels over encrypted HTTPS. There is no unencrypted route into RenteRoo.

2. At rest. Our database and file storage providers encrypt data at rest as standard.

3. Who can get in. Sign-in is handled by a specialist authentication provider. Passwords are stored as one-way hashes and we cannot read them. Multi-factor authentication is available to every landlord and we recommend it. Every administrative account that can reach production data — nine of them, across the product, the database, hosting, source control, DNS, the mailbox, email sending, rate limiting and monitoring — has multi-factor authentication enabled, confirmed on 29 July 2026, with recovery codes held separately.

4. Keeping landlords apart. Every landlord's records are separated at the database level, by row-level security policies, not only by what the interface chooses to show. A fault in a page therefore cannot expose another landlord's data. This has been tested against live accounts across account boundaries, not only in theory.

5. Documents and photographs are held in private storage and are never publicly addressable. They are reachable only through short-lived signed links issued to someone entitled to see them. Anonymous access, direct access, and access by an unrelated landlord have each been tested and denied.

6. Sensitive actions are rate-limited — tenant invitations, account deletion, document access, email sending — using a shared store so the limit holds across servers. The identifiers used are pseudonymised rather than stored raw.

7. Monitoring, built to exclude personal data. Errors are captured to a monitoring service hosted in the EU, through a strict allow-list. Request bodies, query strings, cookies, tokens, file paths, customer identities and message content are all excluded before anything leaves. There is a written incident procedure and it has been rehearsed.

8. Building it. Every route that can bypass the database's own protections must check who is asking and whether they are entitled to the specific record, before it does anything. This is enforced as a standing rule in our engineering process and checked on every change. Dependencies are audited automatically and a high-severity finding stops a release.

9. Backups — the honest bit.

We hold a demonstrated recovery path for the database and have tested a full restore. Automated scheduled backups are not currently in place on our hosting plan; we take manual exports and are moving to an automated schedule before general release. Data in a backup is deleted as that backup ages out.

10. What we do not have, said rather than hidden. No independent penetration test has been completed yet — one is planned, and we will publish the fact when it is done. No ISO 27001 or SOC 2 certification, and we will not imply otherwise.

11. Reviewing all of it. These measures are reviewed when the product changes materially, when a new supplier is added, and after any security incident.

Annex 3 — Sub-processors

The current list, with what each company does and where it processes data, is at /subprocessors, which forms part of this agreement.

As at 11 August 2026: Supabase (database, file storage, authentication), Vercel (hosting), Resend (transactional email), Upstash (rate limiting) and Sentry (error monitoring).

We give 30 days' notice before adding or replacing any of them, and you may object under §8.

4Real Estate Limited (company number 15119929), trading as RenteRoo · registered office 42 Ffordd Y Meillion, Llanelli, SA15 2EX, Wales · hello@renteroo.co.uk

Schedule 1 — Data Processing Agreement · Version 1.0 · 11 August 2026 · Schedule to the Terms of Service v2.0