Data processing agreement

This is a draft. A solicitor has not yet reviewed it, and it may change before the first order is confirmed. Each order records the version the buyer read.

It forms part of the product agreement between the council that places the order (the controller) and the supplier named on the terms page (the processor). It sets out the terms that Article 28(3) of the UK GDPR requires.

1. Subject matter

The supplier provides the licensing software for the council's scheme: online applications, case work, licences, the public register and renewals.

2. Duration

For the term of the product agreement, and after it until the council's data is returned and deleted under section 9.

3. Nature and purpose

• The supplier stores, organises, shows, exports and deletes records so the council can run its licensing scheme.
• The supplier hosts the software, backs it up and gives support.
• The supplier uses the council's data for no other purpose.

4. Types of personal data

• Names, addresses, email addresses and phone numbers.
• Property details, and the people connected to each property.
• Certificates and other uploaded files.
• Fee payment records: amounts and references, with no card details.
• Case notes, letters, inspection visit records and the history of each case.
• Officer names and work email addresses.
• Audit log entries, including the IP address of each request.

5. Categories of data subject

• Applicants, licence holders and managers.
• Other people with an interest in a licensed property, such as owners, mortgage lenders and freeholders.
• The council's officers.

6. The supplier's obligations

• The supplier acts only on the council's documented instructions, including on any transfer of data outside the UK, unless the law requires otherwise. If so, it tells the council first, unless the law forbids that.
• Everyone the supplier allows to process the data is bound to keep it confidential.
• The supplier takes the security measures that Article 32 requires. The IT and information governance pack describes them.
• The supplier tells the council of a personal data breach that affects its data without undue delay, and within 24 hours of becoming aware of it.
• The breach notice describes what happened. Where possible, it says what kinds of people and records are affected, and roughly how many of each.
• The breach notice gives the name and contact details of the person at the supplier who can tell the council more.
• The breach notice describes the likely effects of the breach on the people concerned.
• The breach notice describes what the supplier has done, or plans to do, about the breach, including steps to limit any harm to the people concerned.
• If the supplier cannot give all of this within the 24 hours, it gives what it knows by then and the rest as soon as it can, without undue delay.

7. Sub-processors

• The council gives general written authorisation for these sub-processors: Vercel (application hosting), Supabase (database and files, in EU (Ireland)) and Resend (sign-in links and notices).
• The application's server code runs in Dublin, Ireland (Vercel region dub1).
• Data is processed outside the UK in Ireland, the United States, Singapore and Hungary. Each transfer is made under a transfer mechanism that UK data protection law allows, as each provider's terms name it below. Ireland and Hungary are EEA states, which UK law treats as adequate (Data Protection Act 2018, Schedule 21, paragraphs 4 and 5). Anything marked "to be confirmed" is confirmed before the first order.
• Vercel processes data in Ireland (the application's server code, in Vercel's dub1 region in Dublin) and the United States (Vercel's primary processing facilities). Transfer mechanism: the ICO's UK transfer terms, which Vercel's data processing addendum says are deemed entered into for transfers from the UK; it calls them the UK IDTA and sets them out as the addendum to the EU standard contractual clauses, so which of the two ICO documents applies is to be confirmed. Still to be confirmed: the countries of Vercel's own sub-processors, which its published list did not show when read. Sources: data processing addendum, region list, function regions.
• Supabase processes data in Ireland (the database and files, stored and primarily processed in the region chosen), Singapore (Supabase Pte. Ltd., the contracting company, and support), the United States (support, hosting and monitoring sub-processors) and Hungary (a feature flag sub-processor). Transfer mechanism: the UK Addendum to the EU standard contractual clauses, which Supabase's data processing agreement makes part of it. Sources: data processing agreement, sub-processor list, regions.
• Resend processes data in the United States (account data, email metadata and logs, and Resend's sub-processors). Transfer mechanism: the UK Addendum to the EU standard contractual clauses, under Resend's data processing addendum, which also says Resend complies with the UK Extension to the EU-US Data Privacy Framework. Still to be confirmed: the sending region, which is chosen when the sending domain is added (Ireland is one of the choices). Sources: data processing addendum, sub-processors, sending regions.
• The supplier tells the council before it adds or replaces a sub-processor, so the council can object.
• If the council objects and the objection is not resolved within 30 days, the council can end the agreement by written notice. Its data is then returned and deleted under section 9.
• Each sub-processor is bound by the same data protection duties as this agreement, and the supplier stays responsible for its work.

8. Assistance

• The supplier helps the council answer requests from people about their data. The software finds a person's records and builds a subject access bundle.
• The supplier helps the council meet its duties on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner.
• The supplier tells the council at once if it thinks an instruction breaks data protection law.

9. Deletion or return

• At the end of the agreement, the council can download a full export of its data first.
• Within 30 days of the agreement ending, the supplier deletes the council's personal data, unless the law requires it to be kept.
• The supplier then gives the council written confirmation that the data has been deleted, naming anything the law requires it to keep.
• Backups are taken daily from go-live and kept for 7 days, so copies in backups are gone within 7 days of deletion.

10. Audits

• The supplier gives the council the information it needs to show that this agreement is kept.
• The supplier allows and contributes to audits and inspections by the council, or by an auditor the council appoints, on reasonable notice.

See also the product agreement.

Changes to this draft

Version draft-2026-10-31, last changed 31 October 2026.

• 31 October 2026: Section 6: what a breach notice contains. Section 7: the right to end the agreement over an unresolved objection. Section 9: deletion within 30 days, confirmed in writing.
• 28 October 2026: Section 7: sub-processors, where data is processed and the transfer mechanisms.
• 25 October 2026: First draft.