Data Processing Agreement

1. BACKGROUND

This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the House Made Ready Terms of Use and any executed customer agreement between House Made Ready Ltd ("Processor", "we", "us") and the business user ("Controller", "you") who uses the platform's CRM, pipeline, chain-repair, contact directory and related tools to store personal data about their own clients, contacts, deals and chain parties.

This DPA reflects the parties' rights and obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. ROLES AND SCOPE

You are the Data Controller and determine the purposes and means of processing your contact data. House Made Ready is the Data Processor and processes that data only on your documented instructions.

This DPA applies to the following categories of personal data you enter into the platform's business-user tools:

• Contact data: names, email addresses, telephone numbers and postal addresses of your clients, leads, chain parties and prospects
• Deal & pipeline data: deal stage, value, notes, key dates and project context
• Chain-repair data: chain position, status updates, blocker reasons and party roles
• Team member data: invited users' names, emails and access levels

This DPA does not apply to property scorecard data generated by homeowners or buyers directly, for which House Made Ready acts as Data Controller under the Privacy Policy.

3. PROCESSOR OBLIGATIONS

House Made Ready shall:

• Process the personal data only on your documented instructions, including with regard to transfers of personal data to a third country, unless required by UK or EU law
• Ensure that persons authorised to process the personal data are subject to a duty of confidentiality
• Take appropriate technical and organisational measures to secure the personal data (see Section 8)
• Not engage another processor without your prior authorisation; any sub-processor is bound by equivalent data-protection terms
• Assist you in responding to data-subject requests, taking into account the nature of processing
• Assist you in meeting your obligations regarding security, breach notification and data-protection impact assessments
• Delete or return all personal data after the end of the services, unless retention is required by law
• Make available to you all information necessary to demonstrate compliance with this DPA and allow for audits by you or your mandated auditor

4. CONTROLLER OBLIGATIONS

You warrant and undertake that you will:

• Establish a valid lawful basis (consent or legitimate interests) before entering any individual's personal data into the platform
• Provide those individuals with an appropriate privacy notice explaining how their data is processed
• Not enter special-category data (health, ethnicity, religion, sexual orientation, biometric or criminal-conviction data) into the platform
• Keep contact data accurate, minimise what you store, and delete records you no longer need
• Respond to data-subject requests from your own contacts within the statutory one-month period
• Ensure any team members you invite have a legitimate need to access the data and remove their access promptly when they leave
• Only send marketing communications to contacts who have not opted out, and honour opt-outs immediately
• Comply with all applicable data-protection laws in your use of the platform

5. SUB-PROCESSORS

House Made Ready uses the following categories of sub-processor to deliver the services. Each is bound by contractual terms no less protective than this DPA.

• Cloud hosting: UK/EU-region hosting provider for database and application storage
• Payments: Stripe for card payment processing
• AI / LLM providers: Google (Gemini), Anthropic (Claude) and OpenAI for AI report generation. We minimise the personal data transmitted and instruct providers not to use it for model training
• Email delivery: Transactional email providers for platform notifications
• Mapping & data sources: OpenStreetMap, Ordnance Survey, Mapillary, HM Land Registry, ONS, EPC register and local authorities

Transfers of personal data outside the UK are protected by Standard Contractual Clauses or the UK-US / EU-US Data Privacy Framework. You may request a copy of the current sub-processor list from privacy@housemadeready.co.uk.

6. DATA SUBJECT RIGHTS & REQUESTS

Where a data subject contacts House Made Ready directly regarding their personal data held in your CRM, we will forward the request to you without undue delay and assist you where reasonably requested. You remain responsible for responding to the data subject within the statutory one-month period.

You can delete individual CRM records, pipeline deals and chain contacts directly from the platform at any time. Full account deletion can be requested from privacy@housemadeready.co.uk.

7. PERSONAL DATA BREACH

House Made Ready will notify you of a personal data breach affecting your contact data without undue delay and in any case within 72 hours of becoming aware of it, providing the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed.

8. SECURITY MEASURES

House Made Ready maintains appropriate technical and organisational measures including:

• Encryption in transit (TLS) and at rest
• Role-based access controls and authentication
• Row-level security isolating each business user's data
• Regular security monitoring and patching
• Data backup and disaster recovery procedures
• Staff confidentiality obligations and data-protection training

9. AUDITS

You may audit House Made Ready's compliance with this DPA once per calendar year on reasonable notice. Audits may be conducted by you or a mandated auditor, provided the auditor is not a competitor and is bound by confidentiality.

10. DELETION & RETURN

On termination of your account, you may export your contact data in a structured, commonly used format. Following export, or upon your request, House Made Ready will delete your contact data within 30 days, unless retention is required by law (in which case storage is isolated and access restricted).

11. CONTACT

To enter into an executed copy of this DPA or request the current sub-processor list, contact privacy@housemadeready.co.uk.