Draft for legal review. Not yet in force.
Data processing agreement
Last updated: 10 November 2026
1. About this agreement
1.1 This agreement is between Barecode Limited, trading as Landlord Registration Tracker, a company registered in England and Wales with company number 11637872 and its registered office at 8 Rushall Manor Road, Walsall, England, WS4 2HA ("we", "us"), and the letting agency that subscribes to Landlord Registration Tracker ("you").
1.2 It forms part of our terms of service. It sets out the terms that Article 28 of the UK GDPR requires for the personal data we process on your behalf. If it conflicts with the terms of service about that personal data, this agreement wins.
1.3 "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended.
1.4 [TO CONFIRM: how this agreement is accepted and recorded, for example together with the terms at sign-up.]
2. Roles
2.1 You are the controller of the agency data, and we are your processor.
2.2 "Agency data" means the personal data that you, your staff or your landlords put into the service, or that the service creates for you. It covers landlords' and contacts' details, properties, certificates, the emails sent to landlords, call notes, imports and your agency's activity log.
2.3 We are the controller of staff accounts, billing contacts, website visitors, beta applicants, people we contact about the product, and support emails. Our privacy notice covers those, and this agreement does not.
2.4 [TO CONFIRM: the line between staff accounts, where we are the controller, and staff names and actions in your activity log, which are agency data.]
3. Details of the processing
3.1 Subject matter: providing Landlord Registration Tracker to you.
3.2 Duration: for as long as you have an account, and then until the agency data is deleted under section 13.
3.3 Nature: storing, organising, checking, displaying, exporting and deleting agency data; sending emails to your landlords in your name; preparing packs; finding each property's region from its postcode; and recording activity.
3.4 Purpose: to help you prepare the landlords you act for to register on the government's "Register your rental property" service, to chase them by email, and to keep a record of what you told them.
3.5 Data subjects:
- landlords you act for, including joint owners and the people behind organisation landlords;
- landlords' contacts;
- other people named in your records or in certificates [TO CONFIRM: which, for example third-party contacts or the engineers named on certificates]; and
- your staff, as they appear in the activity log.
3.6 Personal data:
- names, email addresses, phone numbers and correspondence addresses;
- organisation details;
- property addresses, postcodes and the property and tenancy details the register asks for;
- certificates such as gas safety records, electrical reports and EPCs, with their dates;
- landlord registration numbers and rental property numbers;
- emails sent to landlords, and their delivery results;
- call notes;
- imported files and rows;
- link activity, identity check attempts (without the values entered) and landlords' confirmations; and
- the activity log.
3.7 Not collected: a landlord's date of birth, home address (other than a correspondence address you already hold) or GOV.UK One Login details. [TO CONFIRM: some certificates show an address. Agree how a home address that appears on an uploaded certificate is treated.]
3.8 Special category and criminal offence data: the service is not designed for these, and you should not put them in. [TO CONFIRM: wording, and what happens if such data appears in notes or files.]
4. Your obligations
4.1 You must have a lawful basis to give us agency data and to contact your landlords, and you must tell them how you use their data, including that a service provider processes it for you.
4.2 Your instructions to us must comply with data protection law.
4.3 You must put in only the data the service needs, and keep it accurate.
4.4 You must send emails only to landlords you already act for, use them only as service messages and never for marketing, and respect any request to stop.
4.5 You are responsible for answering requests from your landlords and contacts about their data, with our help under section 9.
5. Our obligations
5.1 We process agency data only on your documented instructions, including on any transfer outside the UK, unless the law requires otherwise. If it does, we will tell you first, unless the law forbids that.
5.2 Your instructions are these terms, this agreement, and the choices you make through the service's settings and features.
5.3 We will tell you at once if we think an instruction breaks data protection law.
5.4 Everyone we allow to process agency data is bound to keep it confidential. [TO CONFIRM: how our staff and contractors are bound.]
5.5 We take the security measures in section 6, use sub-processors only as section 7 sets out, and transfer data outside the UK only as section 8 sets out.
5.6 We help you answer data subjects' requests (section 9) and handle personal data breaches (section 10).
5.7 We help you meet your duties on security, data protection impact assessments and prior consultation with the ICO, as far as the nature of the processing and the information available to us allow. [TO CONFIRM: whether we may charge for help beyond the service's own tools.]
5.8 We delete or return agency data at the end of the service (section 13).
5.9 We give you the information you need to show that we meet Article 28, and allow audits (section 11).
5.10 We do not sell agency data or use it for our own purposes. We never use it to market to landlords. [TO CONFIRM: whether we may use anonymised, aggregated statistics, for example to improve the product.]
6. Security
6.1 We take appropriate technical and organisational measures to protect agency data. They include:
- every record belongs to one agency, and every query is limited to that agency;
- data hosted in the UK;
- documents kept in private storage, downloaded only through short-lived signed links, with every download logged;
- landlord links that carry a random token and nothing else, expire on a sliding window, can be revoked by your staff, show nothing until the person confirms a detail you already hold, and lock after three failed attempts, telling you;
- optional two-factor sign-in and passkeys for staff, and two-factor sign-in required for our platform admins;
- an activity log that is append only;
- support access that is read only, limited and logged (section 12);
- no personal data in links, logs or error reports, and monitoring data sent with personal data removed; and
- [TO CONFIRM: encryption at rest, backups, and how security measures are tested.]
6.2 You are responsible for your side of security: who has an account, what permissions they hold, how they sign in, and revoking landlord links when needed.
7. Sub-processors
7.1 You give us general authorisation to use sub-processors. We currently use these. [TO CONFIRM before publishing: the whole list below.]
| Sub-processor | What for | Where | Notes |
|---|---|---|---|
| DigitalOcean | Server hosting | London, UK | |
| Resend | Email delivery | United States | [TO CONFIRM: UK IDTA/addendum] |
| Stripe | Payments and billing | [TO CONFIRM: Stripe entity and location] | Receives no landlord data. [TO CONFIRM: whether to list it here, since it handles only billing data, for which we are the controller] |
| Laravel Nightwatch, run by Laravel | Application monitoring | EU region | Sent with personal data removed: users as ids only, and no IP addresses, tokens or email addresses |
| [TO CONFIRM: Plausible or Fathom] | Website analytics | [TO CONFIRM: location] | No cookies, no personal data. Runs on our public pages only, not on staff or landlord pages |
| postcodes.io | Finding a property's region from its postcode | [TO CONFIRM: location] | Only a property's postcode is sent |
7.2 Fonts are served from our own server. No third-party font service receives any data.
7.3 [TO CONFIRM: whether to add the object storage provider for documents and exports, and the server management service.]
7.4 Each sub-processor is bound by a written contract with the same data protection obligations as this agreement. [TO CONFIRM: that each contract meets Article 28(4).]
7.5 We will tell you of any intended addition or replacement of a sub-processor [TO CONFIRM: how, and how far in advance]. You may object on reasonable data protection grounds. If we cannot resolve your objection, you may cancel. [TO CONFIRM: any refund on cancellation for this reason.]
7.6 We remain liable to you for our sub-processors' performance of their obligations.
8. Transfers outside the UK
8.1 Agency data is hosted in the UK. We transfer it outside the UK only with the safeguards that data protection law requires.
8.2 Resend is a US company. Landlords' names, email addresses and the content of the emails sent to them pass through Resend. [TO CONFIRM: UK IDTA/addendum.]
8.3 Laravel Nightwatch uses its EU region and receives data with personal data removed. [TO CONFIRM: the safeguards in Laravel's own terms.]
9. Data subjects' rights
9.1 The service gives you tools to answer requests:
- staff can correct details, and landlords can correct their own on their page;
- an owner can erase a single landlord's personal data at that landlord's request, leaving the records as placeholders;
- an owner can export everything the agency holds;
- staff can revoke a landlord's link; and
- each email carries a way to ask you to stop the reminders.
9.2 If a data subject contacts us about agency data, we will pass the request to you [TO CONFIRM: within how many days]. We will not answer it ourselves, other than to say we have passed it on, unless you ask us to.
10. Personal data breaches
10.1 We will tell you without undue delay after becoming aware of a personal data breach affecting agency data. [TO CONFIRM: whether to add a fixed maximum time.]
10.2 We will tell you, as far as we know it at the time, and in stages if needed:
- what happened;
- the categories and approximate number of data subjects and records affected;
- the likely consequences;
- what we have done or propose to do about it; and
- who you can contact for more information.
10.3 We will send the notice to your owners' email addresses. [TO CONFIRM: who receives breach notices, and whether agencies may name a contact.]
10.4 We will take reasonable steps to contain and investigate the breach and help you deal with it. You decide whether to notify the ICO and data subjects. We will not notify them for you unless you ask or the law requires us to.
11. Information and audits
11.1 We will give you the information reasonably needed to show that we meet Article 28.
11.2 You, or an independent auditor you appoint who is bound by confidentiality, may audit our compliance with this agreement. [TO CONFIRM: notice period, how often, who pays, and whether a written questionnaire comes first.]
11.3 Your activity log shows every support session, so you can check our access to your account at any time.
12. Support access
12.1 A member of our support team, a "platform admin", may view your account to help you. Access is read only and lasts up to 60 minutes per session, after the platform admin gives a reason.
12.2 The start of each session, with the reason, and its end are written to your activity log, which your staff can see.
12.3 Support cannot change anything during a session. Platform admins must use two-factor sign-in.
12.4 [TO CONFIRM: when support may open a session, for example only at your request or also to investigate a fault, and what other screens platform admins see across agencies, such as email delivery results.]
13. Retention, return and deletion
13.1 Return. An owner can export everything at any time. The export is a ZIP file of your agency's data and files. It can be downloaded for 7 days, then we delete it.
13.2 Deletion on request. Once no more payments are due, an owner can delete everything at once. The owner is signed out, and is emailed when the deletion is done.
13.3 Deletion after the service ends. A read-only account is purged 12 months after it became read only. We email every owner 30 days and 7 days before, and again when it is done. Subscribing again stops the purge. You instruct us to keep agency data for that period, so that you can come back, export it or deal with disputes. You can delete it sooner under 13.2. [TO CONFIRM: that this is a valid instruction under Article 28(3)(g).]
13.4 What a purge removes. Every record and file, including the activity log and staff accounts. It cannot be undone. Our application log keeps only your agency's id and the reason for the purge.
13.5 A single landlord. An owner can erase a single landlord's personal data at that landlord's request. The records stay as placeholders.
13.6 Background jobs. Records of failed background jobs are deleted after 7 days.
13.7 Backups. [TO CONFIRM: whether backups are kept, for how long, and when deleted data leaves them.]
13.8 Billing. Payments and invoices stay with Stripe under Stripe's own retention. They are not agency data.
13.9 We keep agency data after these points only where the law requires it. [TO CONFIRM: whether any such requirement applies.]
14. Liability
14.1 Each of us is liable for its own breaches of data protection law. Liability under this agreement is subject to the limits in the terms of service. [TO CONFIRM: whether data protection claims have a separate cap.]
15. Duration, changes and law
15.1 This agreement lasts for as long as we process agency data.
15.2 We may update this agreement to reflect changes in data protection law or in our sub-processors, as section 7 sets out. Other changes follow the terms of service.
15.3 This agreement is governed by the law of England and Wales, and the courts of England and Wales have the jurisdiction set out in the terms of service.