Data Processing Agreement

Scope

This DPA applies where an estate agent or service provider uploads client data to the Platform andTrueDeed processes it on their instructions.

Roles

TrueDeed’s Role: Data Processor (under Art. 28 UK GDPR).

The estate agent or service provider who uploads client data acts as the Data Controller, determining the purposes and means of processing.

Controller Obligations

The controller must:

• Have a lawful basis for the personal data it uploads;
• Have provided appropriate privacy notices to data subjects;
• Not instruct TrueDeed to process data in a manner that would breach UK GDPR.

TrueDeed Obligations

TrueDeed will:

• Process data only on documented instructions from the controller;
• Implement appropriate technical and organisational security measures;
• Notify the controller of any data breach without undue delay;
• Assist the controller in fulfilling data subject requests;
• Delete or return all personal data on termination;
• Make available information necessary to demonstrate compliance.

Sub-Processors

TrueDeed uses the sub-processors listed in our Privacy Policy (Section 5). We will notify controllers at least 30 days before adding a new sub-processor. Controllers may object, and if the objection cannot be resolved, may terminate the DPA.

International Transfers

International transfers are handled as described in our Privacy Policy (Section 7). Transfers outside the UK are protected by UK adequacy decisions or Standard Contractual Clauses (SCCs).

Audit Rights

Controllers may audit TrueDeed’s compliance with this DPA with reasonable notice and during business hours, subject to confidentiality obligations.

Full DPA

The full Data Processing Agreement is available on request from privacy@truedeed.co.uk.