Legal

Data Processing Agreement

Version 1.0 · Effective 30 July 2026

In one paragraph. Most of the time you are simply our customer and we are the data controller for your account. But when you use PropertyPredator to handle other people's personal data — an investor who enquires on your deal pack, a vendor you write to, contacts in your pipeline — you are the controller and we are your processor. This document sets out what we do with that data, what we will never do with it, and what you can require of us. It forms part of our Terms and needs no signature.

1. Who is who

Processor: MH196 2026 Ltd, a company registered in England and Wales (company number 16447992), whose registered office is Suite 34, Cariocca Business Park, 2 Sawley Road, Manchester M40 8BB, trading as PropertyPredator ("we", "us"). Controller: you, the account holder ("you").

This agreement applies only to Customer Personal Data — personal data you put into, or generate through, the service about people other than yourself. It does not apply to your own account data, where we are the controller and our Privacy Policy governs.

2. What we process, and why

Where	Whose data	What	Why
Deal packs	Investors and enquirers	Name, email, phone, message	To pass their enquiry to you and store it in your account
Pipeline	Owners, vendors, agents, contacts	Name, company, email, phone, your notes	To run your pipeline for you
Outreach sequences	Recipients of your letters	Name, property address	To draft and schedule your letters
Feedback and support	Anyone in a screenshot you send	Whatever the screenshot contains	To fix what you reported

Categories of data subject: property owners, vendors, investors, agents and your own contacts. Duration: for as long as your account is active, plus the retention period in section 8. No special category data is required by the service, and you should not put any into it.

3. Our undertakings

We process Customer Personal Data only on your documented instructions, which for these purposes means your use of the product's features and any written instruction you give us. If we ever believe an instruction breaches data protection law, we will tell you.
Everyone with access is bound by confidentiality, and access is limited to those who need it to run and support the service.
We keep appropriate technical and organisational measures (section 6).
We will assist you with data subject requests, data protection impact assessments and regulator consultations, so far as is reasonable and relevant.
On termination we will delete or return the data (section 8).
We will make available what you reasonably need to demonstrate compliance, and allow audits on reasonable notice.

4. What we will never do

These are commitments, not aspirations.

We do not sell, rent or broker Customer Personal Data. Ever, to anyone.
We do not use it to market to those people ourselves — an investor who enquires on your deal pack is your contact, not a lead of ours.
We do not use it to train models. Where a feature uses AI, the content is sent to the model provider to produce your output and is not used by us to train anything.
We do not buy or supply personal contact data. Our ownership intelligence comes from public registers only — Companies House and HM Land Registry — and we do not trace private individuals.

5. Sub-processors

We use a small number of providers to run the service. Each is bound by terms no less protective than these.

Provider	Purpose	Where
Application hosting	Running the platform	EU / UK region
Managed database	Storing your account and deal data	EU region
Transactional email	Alerts, enquiry notifications, receipts	EU / US (SCCs)
Payment processing	Subscriptions and payments	EU / US (SCCs)
AI model provider	Drafting letters, reading documents, verdicts	EU / US (SCCs)

We will give you reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds.

6. Security

Encryption in transit (TLS) for all traffic, and at rest for the database.
Authentication with hashed credentials and short-lived access tokens.
Access control on every endpoint that returns your data; screenshots you send with feedback are only ever served behind the administrator gate.
Least-privilege administrative access, and logging of administrative actions.
Regular dependency and configuration review.

7. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the facts we have, the likely consequences and the measures taken. We will help you meet your own notification duties to the ICO and to data subjects.

8. Retention, return and deletion

You can delete individual records — a pipeline deal, a deal pack and its enquiries, a campaign — at any time, and deletion removes the associated records too. On termination of your account we will delete Customer Personal Data within 30 days, except where we must keep something to comply with a legal obligation. Backups age out on a rolling cycle and are deleted within 90 days.

9. International transfers

Where a sub-processor processes data outside the UK or EEA, the transfer is covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with any additional measures required.

10. Your responsibilities

The part sourcers most often miss. When you write to a property owner who has not asked to hear from you, or hold an investor's details in a pipeline, you are the controller. That means you need:

a lawful basis — for direct-to-vendor post, usually legitimate interests, which requires you to have actually carried out and recorded the balancing test;
your own privacy notice, and a way for people to object or ask what you hold;
to register with the ICO if you are processing personal data as a business (it is currently a modest annual fee, and most sourcers are in scope);
to respect PECR if you move from post to email, text or calls — the rules there are much stricter, and screening against the TPS applies to telephone marketing.

We build the tools to support this — our letters are unpressured, every sequence stops on request, and a third letter always tells the recipient it is the last — but the compliance obligations of your own outreach are yours, not ours.

11. Liability and precedence

This agreement is subject to the limitations of liability in our Terms of Service. Where this agreement conflicts with the Terms on the subject of data protection, this agreement prevails. It is governed by the law of England and Wales.

12. Contact

Data protection questions, data subject requests and audit requests: privacy@propertypredator.com.

MH196 2026 Ltd (Co. 16447992) trading as PropertyPredator · Data Processing Agreement v1.0 · 30 July 2026 · propertypredator.com