Legal Data processing · UK GDPR

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between the Customer and Fortius Labs (trading as Covenant). It governs the processing of Personal Data by Covenant on the Customer’s behalf in connection with the Covenant service.

1. Preamble & roles

This DPA is entered into between the “Customer” (the letting agency or other organisation identified in the relevant Master Services Agreement or Order Form) and Fortius Labs, based in London, trading as Covenant (“Covenant”).

For the purposes of UK Data Protection Laws, the Customer is the controller of Customer Data and Covenant is the processor. Where the Customer is itself a processor for one of its own clients, Covenant acts as a sub-processor and the obligations in this DPA apply correspondingly.

This DPA takes effect on the date the Customer signs the Master Services Agreement (“MSA”) or otherwise accepts Covenant’s Terms of Service. In the event of a conflict between this DPA and the MSA in respect of data protection matters, this DPA prevails.

2. Definitions

Data Protection Laws

The UK GDPR (the retained EU Regulation 2016/679 as amended), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any successor or related legislation, together with guidance issued by the Information Commissioner’s Office (“ICO”).

UK GDPR

The General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

Personal Data

Any information relating to an identified or identifiable natural person, as defined in the UK GDPR.

Customer Data

All data, including Personal Data, supplied by or on behalf of the Customer to Covenant, or generated by Covenant in the course of providing the service to the Customer (for example, audit outputs, action lists, evidence packs, and outcome records).

Sub-processor

Any third party engaged by Covenant to process Customer Data on Covenant’s behalf in connection with the service.

Authorised Personnel

Covenant’s employees, contractors, and individual sub-processor personnel who have a clear need to access Customer Data to deliver the service.

Annex

The annexes set out at the end of this DPA, which form part of it.

3. Scope & instructions

Covenant will process Customer Data only on the documented instructions of the Customer. Documented instructions are: (a) the MSA and any Order Form; (b) this DPA and the service description it incorporates; and (c) ongoing instructions issued by the Customer in writing (including by email) during the term.

Covenant will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. Covenant will not process Customer Data for its own purposes, sell Customer Data, or use Customer Data to train any third-party model without the Customer’s separate, written authorisation.

4. Subject matter & duration

The subject matter of the processing is Covenant’s provision of the rent-roll audit, evidence pack, action list, and outcome reporting services described in the MSA. The duration of the processing is the term of the Customer’s subscription, plus a period of up to 30 days after termination for return and deletion of Customer Data in accordance with section 15.

5. Nature & purpose

The nature and purpose of processing are described in Annex 1. In summary, Covenant ingests the Customer’s rent roll and related operational data, analyses it to identify rent-review and retention opportunities, produces evidence packs and action lists, and tracks outcomes recorded by the Customer.

6. Types of personal data

The types of Personal Data typically processed are listed in Annex 1 and include:

• Property addresses and tenancy metadata.
• Current rent, historic rent changes, and lease start/end dates.
• Landlord names and contact details (email, telephone, postal address).
• Occasional tenant first names where included by the Customer in their rent roll.
• Internal agency notes attached to properties or landlords.
• Payment-method metadata (e.g., last 4 digits, billing contact) processed by Covenant’s payment sub-processor for subscription billing.
• Any other data the Customer chooses to include in the data set provided to Covenant.

Covenant does not request, and discourages the Customer from supplying, special category data or data relating to children. The Customer is responsible for the Personal Data it chooses to upload.

7. Categories of data subjects

• Landlords whose properties are managed by the Customer.
• Tenants, to the limited extent their first name or tenancy metadata appears in the rent roll.
• Agency staff at the Customer who use the Covenant service or are referenced in operational notes.

8. Confidentiality

Covenant ensures that all Authorised Personnel are bound by enforceable obligations of confidentiality, whether in their employment contracts, contractor agreements, or under statute. Authorised Personnel access Customer Data only on a need-to-know basis.

9. Security measures

Covenant implements appropriate technical and organisational measures (“TOMs”) to ensure a level of security appropriate to the risk, as set out in Annex 2. These include encryption in transit (TLS 1.2 or later) and at rest, role-based access control, audit logging, principle of least privilege, regular access reviews, and a documented incident-response procedure.

Covenant reviews and updates its TOMs periodically. Material changes will not reduce the overall level of protection provided to Customer Data.

10. Sub-processors

The Customer authorises Covenant to engage the sub-processors listed in Annex 3. Covenant remains responsible for the acts and omissions of its sub-processors as if they were its own.

Covenant will give the Customer at least 14 days’ prior notice by email of any addition or replacement of a sub-processor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot agree on a resolution, the Customer may terminate the affected services on written notice and receive a pro-rata refund of any pre-paid fees for the unused period.

Covenant enters into a written contract with each sub-processor containing data-protection obligations no less protective than those in this DPA.

11. Assistance

Taking into account the nature of the processing and the information available to it, Covenant will assist the Customer with:

• responding to data-subject requests under Articles 12–22 UK GDPR;
• data protection impact assessments and prior consultation with the ICO under Articles 35–36 UK GDPR;
• notifying personal data breaches to the ICO and to affected data subjects, where required; and
• responding to enquiries or investigations by the ICO or other competent authority.

Such assistance is provided at Covenant’s reasonable cost where the request is materially beyond the standard scope of the service.

12. Breach notification

Covenant will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a Personal Data breach affecting Customer Data. The notification will include, to the extent then known:

• a description of the nature of the breach and the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed to address the breach and mitigate its effects; and
• contact details of a person from whom further information can be obtained.

Covenant will provide the Customer with the information it reasonably needs to meet its own 72-hour notification obligation to the ICO under Article 33 UK GDPR.

13. Audit rights

On reasonable prior written notice (no less than 30 days, except in the case of a regulator-mandated audit or a confirmed material breach), the Customer may audit Covenant’s compliance with this DPA. Audits will be conducted during business hours, will not unreasonably interfere with Covenant’s operations, and will be limited to no more than once in any 12-month period unless required by a regulator or breach.

The Customer may, at Covenant’s option, accept a recent independent audit report or certification (e.g., ISO 27001, SOC 2) as a substitute for an on-site audit, where one is available. [REVIEW: certifications not yet held — to be added when complete.]

14. International transfers

Covenant will not transfer Customer Data outside the UK or EEA except where:

• the destination is covered by a UK adequacy decision or EU adequacy regulation;
• the transfer is made under the UK’s International Data Transfer Agreement (“IDTA”) or the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism under Chapter V UK GDPR is in place.

Likely transfer destinations are listed in Annex 3. [REVIEW: confirm final destinations once stack is locked.]

15. Return / deletion

On termination or expiry of the MSA, Covenant will, at the Customer’s choice, return all Customer Data to the Customer or securely delete it from production systems within 30 days. Covenant will provide written confirmation of deletion on request.

Customer Data residing in encrypted backups will be deleted on the standard backup-rotation schedule (no longer than 90 days from the date of deletion from production). During that period, the data remains subject to the security and confidentiality obligations in this DPA.

Covenant may retain Customer Data where required by law, in which case it will continue to protect it under this DPA and process it solely for that legal purpose.

16. Liability

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the MSA. Nothing in this DPA limits any liability that cannot be limited under applicable law.

Annex 1 — Subject matter, nature, purpose

Subject matter

Provision by Covenant to the Customer of the rent-roll audit, action-list, evidence-pack, and outcome-tracking services described in the MSA.

Nature of processing

Collection, storage, organisation, structuring, analysis, generation of derivative outputs, retrieval, transmission to the Customer, and (on instruction) deletion.

Purpose

• Rent-roll analysis and identification of revenue-leak and retention opportunities.
• Generation of landlord-ready evidence packs.
• Production of ranked landlord action lists.
• Tracking of activities, follow-ups, and outcomes recorded by the Customer’s team.
• Service delivery, support, and billing.

Categories of personal data

• Property addresses, tenancy dates, current and historic rent.
• Landlord names and contact details.
• Limited tenant first names where included by the Customer.
• Internal agency notes attached to properties or landlords.
• Payment-method metadata for billing.
• Any other data the Customer elects to include in its rent roll.

Categories of data subjects

• Landlords.
• Tenants (limited).
• Agency staff at the Customer.

Duration

Term of the Customer’s subscription, plus up to 30 days for return / deletion (and up to 90 days for backup deletion).

Annex 2 — Technical & organisational security measures

Covenant maintains the following measures, reviewed at least annually:

Encryption

• TLS 1.2 or later for all data in transit between Customer, Covenant systems, and sub-processors.
• Encryption at rest for production databases and object storage using industry-standard algorithms (AES-256 or equivalent).
• Encrypted backups; backup encryption keys held separately from production keys.

Access control

• Role-based access control (RBAC) with the principle of least privilege.
• Multi-factor authentication required for all administrative and production access.
• Quarterly access reviews; off-boarding procedure with same-day revocation.
• Customer Data segregated logically per Customer.

Logging & monitoring

• Audit logs for authentication, administrative actions, and access to Customer Data.
• Automated monitoring and alerting for anomalous activity.
• Logs retained for at least 12 months.

Incident response

• Documented incident-response procedure with defined severity levels.
• Named on-call responder and escalation path.
• Post-incident review and remediation tracking.

Organisational measures

• Confidentiality obligations on all Authorised Personnel.
• Data-protection training on onboarding and annually thereafter.
• Vendor due-diligence before engaging any sub-processor.
• Secure software-development practices, dependency review, and code review for production changes.

Business continuity

• Daily encrypted backups with documented restore tests.
• Recovery objectives (RTO / RPO) defined and reviewed annually. [REVIEW: publish specific RTO/RPO once finalised.]

Annex 3 — Sub-processor list

The following sub-processors may process Customer Data in connection with the service. Covenant will give 14 days’ notice before adding to or changing this list.

Sub-processor	Purpose	Location
Hetzner Online GmbH	Cloud hosting and database infrastructure	Germany / Finland (EEA)
Stripe Payments Europe Ltd	Subscription billing and payment processing	Ireland (EEA) / United States (SCCs in place)
Email delivery provider [REVIEW: Postmark or Resend — TBD]	Transactional email (audit-ready notifications, account messages)	United States (SCCs / IDTA in place) [REVIEW]
CRM provider [REVIEW: TBD]	Customer relationship management for sales & support	[REVIEW: TBD]
Cloud object storage [REVIEW: e.g., Hetzner Storage Box / S3-compatible — TBD]	Storage of generated evidence packs and exports	[REVIEW: TBD — EEA preferred]

Signatures

This DPA is executed as part of, and on the same date as, the MSA between the Customer and Covenant. No separate signature is required unless the Customer specifically requests one, in which case the block below applies.