Data Processing Agreement

When an estate agency, lettings agency or other business customer uses ProspectOS to manage campaigns, contacts, pipelines, letters, postcards, automations and related workflows, we often process personal data contained in that customer's data on the customer's instructions.

In those circumstances the customer is usually the controller and ProspectOS is the processor.

ProspectOS also processes personal data for its own business purposes (for example account management, billing, security and product improvement). In those cases ProspectOS acts as an independent controller. Those activities are described in our Privacy Policy.

2.1 Processor processing

We process Customer Personal Data (personal data within data you upload, enter or generate in ProspectOS) only to provide the Services, in accordance with our Terms, your documented instructions, applicable law, and as necessary to maintain the security and integrity of the platform.

2.2 Your responsibilities as controller

You are responsible for ensuring that:

• You have a lawful basis for all Customer Personal Data you provide or use through ProspectOS.
• You provide appropriate transparency information to data subjects.
• Your instructions comply with UK GDPR, the Data Protection Act 2018 and PECR where applicable.
• You maintain suppression lists, marketing preferences and objection records.
• You handle data subject rights requests where you are controller.
• Your Authorised Users only access data they are permitted to see.

2.3 ProspectOS Data

Property intelligence, market data, scoring, enrichment and certain platform-generated insights may be processed by ProspectOS as an independent controller, processor or data provider depending on the activity. Licence terms and restrictions may apply to ProspectOS Data and third-party data sources.

We process Customer Personal Data to deliver the ProspectOS platform, including:

• Hosting, storing and backing up Customer Personal Data.
• User, branch and permission management.
• Campaign creation, review, approval, dispatch and audit logging.
• CRM-style pipelines, notes, tasks, valuations and follow-ups.
• Reporting, attribution and exports.
• Customer support and troubleshooting.
• Security monitoring, fraud prevention and incident response.

If we believe an instruction would cause unlawful processing, we will inform you unless we are prohibited by law from doing so.

We implement appropriate technical and organisational measures designed to protect Customer Personal Data. Further detail is available on our Security page and in Schedule 1 of the Terms.

Measures may include, where appropriate:

• Access controls and role-based permissions.
• Authentication controls and account activity logging.
• Encryption in transit (HTTPS/TLS).
• Secure cloud hosting and database segregation.
• Monitoring, logging and backups.
• Staff confidentiality obligations.
• Supplier due diligence and incident response procedures.

No system is completely secure. You are responsible for protecting login credentials and configuring appropriate user permissions within your agency account.

You authorise us to use subprocessors (third-party service providers) that help us deliver the Services. These may include hosting providers, database providers, email providers, payment providers, e-signature providers, analytics tools, support tools, print partners, property data suppliers and communications providers.

We require subprocessors to protect personal data and process it only for authorised purposes. A current list is published on our Subprocessors page.

We remain responsible for subprocessor processing to the extent required by applicable Data Protection Laws.

We aim to host and process Customer Personal Data in the United Kingdom. Some subprocessors may process data outside the UK.

Where personal data is transferred internationally, we use appropriate safeguards under UK data protection law, which may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism.

Where you are controller, you are responsible for responding to data subject rights requests relating to Customer Personal Data.

Taking into account the nature of processing, we will provide reasonable assistance to help you respond to requests where required by law. If we receive a request relating to Customer Personal Data for which you are controller, we may refer the request to you unless law requires otherwise.

When your subscription ends or you request deletion, we will delete or return Customer Personal Data processed as processor, unless retention is required or permitted by law, backup cycles, dispute handling, audit requirements, fraud prevention or legitimate business record keeping.

You may export Customer Data through the platform where export features are available, subject to your plan and permissions.

If we become aware of a personal data breach affecting Customer Personal Data we process as processor, we will notify you without undue delay with information reasonably available to help you meet your obligations.

We may provide reasonable assistance with security, breach notification, data protection impact assessments, supervisory authority consultation and data subject rights, subject to the Terms (including any reasonable fees for excessive or complex requests).

ProspectOS is a trading name of PROSPECTOS LTD (company number 11491234).

Registered office

Data protection enquiries: hello@prospectos.co.uk

For the full Data Processing Schedule, see Terms of Service — Schedule 1.