Data Processing Addendum (DPA)

1. Parties and roles

For customer tenancy operations, the customer (landlord/business user) is the controller and smartHMO is the processor. Each party remains responsible for compliance with applicable UK data protection law.

2. Scope

smartHMO processes personal data only to provide platform services, maintain security, and deliver customer-configured workflows and integrations.

3. Processor obligations

• Process personal data only on documented customer instructions.
• Ensure confidentiality obligations apply to authorised personnel.
• Implement appropriate technical and organisational security measures.
• Maintain records and audit evidence for processing activities.
• Assist controller with rights requests and compliance duties where required.

4. Subprocessors

smartHMO may engage subprocessors for infrastructure and service delivery. smartHMO remains responsible for subprocessor performance under written terms. Current categories and processors are listed in the Subprocessor Register.

5. International transfers

Where a transfer outside the UK is required, smartHMO applies contractual safeguards (including UK IDTA or UK addendum to SCCs) and transfer-risk controls appropriate to the processing.

6. Security incidents and breach support

smartHMO will notify affected customers without undue delay after becoming aware of a personal data breach affecting customer data, and will provide available details to support statutory notifications.

7. Retention, return, and deletion

On termination or customer instruction, personal data is returned or deleted unless retention is required by law. Deletion schedules and controls are documented in the Data Retention and Deletion Standard.

8. Audit and assurance

smartHMO provides reasonable information to demonstrate compliance and supports proportionate audit requests subject to confidentiality, security, and operational safeguards.

9. Contracting

For a signed DPA schedule for your organisation, contact support@smarthmo.co.uk.