Data Processing Agreement
Last updated: 3 September 2026
This Data Processing Agreement ("DPA") forms part of the contract between RentFig ("Processor") and the registered landlord subscriber ("Controller") who uses the RentFig service. It is incorporated by reference into the Terms & Conditions. By creating a RentFig account and accepting the Terms & Conditions, the Controller agrees to this DPA. This DPA is intended to comply with Article 28 of the UK General Data Protection Regulation ("UK GDPR").
1. Definitions
- "Controller" means the landlord or property manager who holds a RentFig account and determines the purposes and means of processing tenant personal data.
- "Processor" means RentFig, which processes personal data on behalf of the Controller.
- "Personal Data", "Data Subject", "Processing", "Sub-processor" and "Supervisory Authority" have the meanings given in the UK GDPR.
- "Services" means the RentFig property management platform provided under the Terms & Conditions.
2. Subject Matter & Duration
This DPA covers the Processing of Personal Data by RentFig in connection with the provision of the Services. Processing will continue for the duration of the Controller's subscription and, where required by law, for up to six years after account termination to meet financial record-keeping obligations.
3. Nature & Purpose of Processing
RentFig processes Personal Data for the purpose of providing landlord property management services, including: tenancy management, rent collection, compliance tracking, document storage, tenant communications (email, SMS, WhatsApp, voice), financial reporting, and (coming soon) Making Tax Digital submissions to HMRC via our MTD partner, Tax'd.
4. Categories of Personal Data
RentFig may process the following categories of Personal Data on behalf of the Controller:
- Full name, date of birth, and contact details (email address, phone number, postal address)
- Tenancy information (start and end dates, rent amounts, deposit details)
- Financial records (invoices, payments, rent statements)
- Identity documents (copies uploaded for Right to Rent checks)
- Right to Rent check records and status
- Communications content (SMS messages, WhatsApp messages, email content, voicemail recordings and automated transcripts and summaries)
- Referencing and credit check results (where the landlord uses the tenant referencing feature)
- Emergency contact details (where provided)
5. Categories of Data Subjects
The Data Subjects are tenants and prospective tenants of the Controller, together with any additional occupants or guarantors whose Personal Data the Controller enters into RentFig.
6. Processor Obligations
RentFig agrees to:
- Process only on instructions. Process Personal Data only on documented instructions from the Controller, unless required to do so by UK law.
- Confidentiality. Ensure that all persons authorised to process Personal Data are bound by appropriate confidentiality obligations.
- Security. Implement appropriate technical and organisational measures under Article 32 UK GDPR, including encryption in transit (TLS), encryption at rest, row-level security policies, and access controls.
- Sub-processors. Only engage Sub-processors in accordance with Section 7 below, and remain liable for their acts and omissions to the same extent as its own.
- Data Subject rights. Assist the Controller in fulfilling obligations to respond to Data Subject rights requests under UK GDPR. Data Export requests can be made via Settings > Data Export; all other requests should be sent to support@rentfig.co.uk.
- Controller obligations. Assist the Controller in ensuring compliance with Articles 32–36 UK GDPR (security, breach notification, data protection impact assessments, and prior consultation).
- Deletion or return. At the Controller's election, delete or return all Personal Data on termination of the Services, unless UK law requires retention. Financial records are retained for the statutory six-year period and then permanently deleted.
- Audit and information. Make available all information necessary to demonstrate compliance with Article 28 UK GDPR, and allow audits by the Controller or its mandated auditor, subject to reasonable advance notice.
7. Sub-processors
The Controller hereby grants RentFig general written authorisation to engage the following Sub-processors. RentFig will inform the Controller of any intended changes with reasonable notice before the change takes effect.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database storage and authentication | EU / UK data centres |
| Vercel | Application hosting and serverless functions | EU / UK edge network |
| Resend | Transactional and broadcast email delivery | EU |
| Twilio | SMS, voice calls and voicemail recording, WhatsApp message delivery | UK / EU data centres |
| Stripe | Subscription billing (card / Bacs Direct Debit) and one-off card payment processing for pay-per-check tenant referencing | EU |
| Vorensys | Tenant referencing — carries out the credit check, affordability assessment, anti-money-laundering and sanctions screening, identity verification and Right to Rent check, and contacts the applicant, their employer, landlord and accountant directly to collect the information needed. | UK |
| Anthropic (Claude AI) | AI features across the Service — the in-app and WhatsApp assistants (which receive the portfolio records needed to answer a question, including tenancy, contact, payment, document and compliance data), document and receipt scanning, inbound email classification, advert description drafting, and voicemail summaries. Anthropic is contractually prohibited from training its models on this data. Inputs and outputs are deleted within 30 days, except where content is flagged by Anthropic's automated safety systems or retention is required by law. | USA (Standard Contractual Clauses) |
| Groq | Speech-to-text transcription of voicemail recordings and of voice notes sent to the WhatsApp assistant. Audio is not used to train Groq's models. | USA (Standard Contractual Clauses) |
| WhatsApp LLC (Meta) | WhatsApp Business API — delivery, receipt and storage of WhatsApp messages to and from tenants and Controller users, with onward transfer to Meta Platforms, Inc. | USA |
| Sentry | Application error monitoring and diagnostics | EU |
| PostHog | Product analytics on use of the Service | EU |
| Backblaze | Encrypted off-site storage of scheduled database backups | EU |
| Upstash | Rate limiting and abuse prevention | EU |
| Canopy | Tenant referencing — an additional identity, income, credit and residential check provider, alongside Vorensys, for applications routed through Canopy's own checks. | UK |
| Lunch Flow | Open-banking bank feed for landlord accounting — reads transaction data from a connected bank account. Not enabled for all Controllers. | UK / EU |
| Firma.dev | E-signature capture, hosting and delivery of tenancy agreements and other signed documents, including signer names, emails, IP addresses and signatures. | EU |
| Microsoft Clarity | Session-replay analytics, loaded only on the public marketing pages — not on the dashboard, and not on any page reachable by an unguessable link (application forms, the tenant portal, signing pages, and similar), which is enforced by an automated test. A visitor who logs in without a full page reload immediately after visiting a marketing page in the same browser tab may have session recording continue briefly into the authenticated session, since the provider does not support stopping a recording mid-session. Configured cookieless for EEA/UK/CH visitors. | USA (Standard Contractual Clauses) |
| Google (Gemini) | Not used by default. If a deployment is configured (via AI_MODEL_SONNET / AI_MODEL_HAIKU) to use Gemini instead of Claude, the same categories of data described in the Anthropic row above would be sent to Google instead. | Not applicable while unused |
8. International Transfers
Personal Data held in RentFig's own systems is stored at rest within the UK and EU. Some Processing takes place in the USA: AI features are provided by Anthropic, speech-to-text transcription by Groq, WhatsApp messages are delivered and stored by WhatsApp LLC, and session-replay analytics on the public marketing pages is provided by Microsoft Clarity, all in the USA. For each of those transfers RentFig relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses as the transfer mechanism. The Sub-processor table in Section 7 states the location applicable to each Sub-processor, including Google (Gemini), which is not currently in use — the transfer mechanism for it will be added here if and when it is switched on and its location is confirmed as outside the UK and EU.
9. Security Incident Notification
RentFig will notify the Controller without undue delay, and where feasible within 72 hours, of becoming aware of a Personal Data breach involving the Controller's data. Notification will include, to the extent known: the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed.
10. Controller Responsibilities
The Controller is responsible for:
- Establishing a lawful basis for processing tenant Personal Data (typically contractual necessity under Article 6(1)(b) and legal obligation under Article 6(1)(c))
- Providing tenants with a privacy notice — RentFig provides a template via the Communications Hub
- Registering with the Information Commissioner's Office (ICO) where required under the Data Protection (Charges and Information) Regulations 2018
- Ensuring Personal Data entered into RentFig is accurate and lawfully obtained
- Responding to Data Subject rights requests from tenants in a timely manner
11. Governing Law
This DPA is governed by the laws of England and Wales and incorporates the requirements of the UK GDPR and the Data Protection Act 2018.
12. Contact
For questions about this DPA, contact us at: support@rentfig.co.uk