Data processing agreement

We process customer personal data only on your documented instructions, including for transfers outside the UK. Your instructions are these terms, this agreement, and the actions you take in Letfolio, such as adding a tenant, sending a letter or reference request, or using an AI feature. We will not use customer personal data for any purpose of our own, and we do not sell it.

If UK law requires us to process customer personal data other than on your instructions, we will tell you before we do, unless that law forbids it. We will tell you straight away if we think an instruction breaks data protection law.

Everyone we authorise to access customer personal data is bound by a duty of confidentiality, by contract or by law, and has access only as far as they need it to run and support the service.

We take the technical and organisational measures required by Article 32 of the UK GDPR, appropriate to the risk, to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Annex 2 summarises them. We may improve them over time but will not reduce the overall level of protection.

• You are responsible for having a lawful basis for the customer personal data you enter and for the instructions you give us.
• You are responsible for telling the people whose data you enter how it is used, including that Letfolio and the sub-processors in Annex 3 process it.
• You should enter only the data you need. Letfolio does not ask for special category data (such as health or ethnicity) or criminal offence data, and you should not enter it in free-text notes.
• Legal duties that are yours as a landlord, such as Right to Rent checks and keeping records for HMRC, remain yours. Export what you must keep before you delete your account.

You give us general authorisation to use the sub-processors listed in Annex 3. Each is bound by a written contract that imposes data protection obligations equivalent to those in this agreement, and we remain responsible to you for their performance.

We will email the account holder at least 30 days before we add or replace a sub-processor, and update Annex 3. You may object on reasonable data protection grounds by emailing info@zolvra.co.uk within that period. We will then try to find a reasonable alternative, such as not using that sub-processor for your data. If we cannot, you may end your subscription before the change takes effect and we will refund any fees you paid in advance for the period after it ends.

Letfolio lets you view, correct, export and delete the customer personal data in your account, which is how most requests from individuals (for access, correction, erasure, restriction or portability) can be met. Where you need more, we will help by appropriate technical and organisational measures, as far as possible. If an individual contacts us directly about customer personal data, we will pass the request to you within five working days and will not answer it ourselves unless you ask us to.

We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We will tell you, as far as we know them: what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we have done or propose to do. Where we cannot give everything at once we will give it in stages without further undue delay. This gives you time to decide whether to notify the Information Commissioner within the 72 hours the law allows you.

We will also help you, taking into account the nature of the processing and the information available to us, to meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner (Articles 32 to 36 of the UK GDPR).

While your account exists you can export your records at any time, and a lapsed subscription stays readable for that purpose. When you delete your account, we stop processing customer personal data straight away and delete it from our live systems within 30 days. Copies in our database provider’s point-in-time backups expire on its rolling cycle of no more than 30 days after that.

We keep customer personal data after that only where UK law requires us to, and then only for as long as it requires.

We will make available to you the information necessary to show that we meet Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, by you or an auditor you appoint. To keep this proportionate, we will first answer your written questions and share our security policy summary and relevant sub-processor certifications. If you still need an audit, you will give us at least 30 days’ notice, it will take place in working hours no more than once a year (unless the Information Commissioner requires it or it follows a breach), your auditor will keep what they learn confidential, and you will bear its cost.

Some sub-processors process customer personal data outside the UK, as shown in Annex 3. We transfer it only where it keeps the protection UK law requires: to a country or scheme covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for US providers certified to it), or under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner.

This agreement lasts for as long as we process customer personal data for you. Each party’s liability under it is subject to the limits in the terms of service, except where the law does not allow liability to be limited.

• Subject matter: providing Letfolio, a property management service, to you under the terms of service.
• Duration: for as long as your account exists, and then until deletion under clause 8.
• Nature and purpose: storing, organising, displaying and exporting your records; sending the emails, letters, reference requests and job sheets you trigger; collecting the answers referees and contractors give; producing reminders, reports and calculations; and, when you use them, reading receipts and answering questions with AI providers.
• Categories of people: tenants and prospective tenants (applicants), guarantors, referees (such as employers and former landlords), contractors and tradespeople, your team members, emergency contacts, and other contacts you record.
• Types of personal data: names and contact details; addresses and previous addresses; date of birth; tenancy details, rent, deposit, payment and arrears history; Right to Rent check records (document type, reference and expiry date); for applicants, employment, employer, income, time at address, guarantor details and any adverse credit the applicant declares; referees’ answers (such as income confirmed, whether rent was paid on time and whether they would rent to the person again); maintenance reports, photos and documents; letters and messages sent; bank mandate references where you use Direct Debit; and notes you write.
• Special category and criminal offence data: none is requested. See clause 4.

• Encryption in transit (TLS) and at rest by our hosting and database providers.
• Every account’s data is separated by its owner, and automated tests fail our build if a query is added that is not scoped to one account.
• Team members act under roles you set; referees and contractors reach only the one request or job sheet they were sent, through a random link that expires.
• Tokens for third-party services you connect are encrypted with keys held separately from the database.
• A security event log for sensitive account actions.
• A written incident response plan and a breach log.

• Vercel: Application hosting, file storage and scheduled jobs. United States, with content delivery worldwide.
• Neon: Database hosting and backups. United Kingdom (London).
• Clerk: Sign-in and account security for tenant and team logins. United States.
• Resend: Sending emails you trigger to tenants, referees and contractors. United States.
• Microsoft Azure: Reading receipts and invoices you scan. United Kingdom (UK South). Only when you scan a receipt.
• Google Gemini API: The assistant and daily briefing, and receipt reading if Azure is unavailable. United States. Only when you use the AI features.
• Anthropic: The assistant and receipt reading, when Gemini is not in use. United States. Only when you use the AI features.

If you connect your own GoCardless or Xero account, that provider acts under your own contract with it, not as our sub-processor.