Data Processing Addendum
This Data Processing Addendum defines the roles, obligations and safeguards for personal data processed by GotMyTenants on behalf of landlords and property managers using the Platform.
Version: 2026-07-v1
Last updated: 23 July 2026
Governing law: England & Wales
This Data Processing Addendum ("DPA") forms part of the agreement between GotMyTenants ("Processor") and the landlord or property manager ("Controller") who uses the Platform to manage tenant, property and referencing data. This DPA applies when GotMyTenants processes personal data on behalf of the Controller in the course of providing the Platform.
"Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on personal data including collection, storage, use, disclosure and deletion. "Data Controller" means the landlord or property manager who determines the purposes and means of processing. "Data Processor" means GotMyTenants which processes data on behalf of the Controller.
GotMyTenants processes personal data to provide property management, tenant management, referencing, compliance monitoring, maintenance coordination, messaging, accounting, tax reporting and AI-powered features. Processing continues for the duration of the Controller's subscription and any applicable data retention period thereafter.
Personal data processed includes: tenant names, contact details, addresses, dates of birth, employment information, income data, rental history, references, identity documents (passports, driving licences), financial documents (payslips, bank statements), compliance records, maintenance requests, messages, photographs and property operational data.
Data subjects include: tenants, prospective tenants, applicants, referees, contractors, guarantors and other individuals whose data is uploaded or managed by the Controller through the Platform.
GotMyTenants shall: (a) process Personal Data only on documented instructions from the Controller; (b) ensure that persons authorised to process Personal Data have committed themselves to confidentiality; (c) implement appropriate technical and organisational security measures; (d) not engage another processor without prior specific or general written authorisation; (e) assist the Controller in responding to data subject requests; (f) assist the Controller in ensuring compliance with security, breach notification and data protection impact assessment obligations; (g) delete or return all Personal Data to the Controller after the end of the provision of services; (h) make available all information necessary to demonstrate compliance.
The Controller shall: (a) ensure they have a lawful basis for collecting and processing Personal Data through the Platform; (b) provide data subjects with transparent information about how their data is processed; (c) obtain all necessary consents for data processing; (d) ensure that instructions to GotMyTenants comply with applicable law; (e) be independently responsible for ICO registration where required; (f) respond to data subject requests that relate to processing they control.
GotMyTenants uses the following sub-processors to provide the service: Supabase (database hosting), Clerk (authentication), Stripe (payment processing), Resend (email delivery), Groq (AI language model processing), Vercel (hosting and deployment). The Controller authorises GotMyTenants to engage these sub-processors. GotMyTenants will notify the Controller of any material changes to sub-processors.
Where Personal Data is transferred outside the UK or EEA, GotMyTenants ensures appropriate safeguards are in place including adequacy regulations, EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and transfer risk assessments where required.
GotMyTenants will notify the Controller without undue delay (and within 48 hours) after becoming aware of a personal data breach affecting the Controller's data. Notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences and measures taken or proposed to address the breach.
GotMyTenants will provide reasonable assistance to the Controller in carrying out data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to GotMyTenants.
GotMyTenants will make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections. Audits may be conducted upon 30 days' written notice and no more than once per year, except in the event of a data breach.
GotMyTenants retains Personal Data for the duration of the Controller's subscription. Upon termination, the Controller may export their data. GotMyTenants will delete all Personal Data within 90 days of subscription termination, except where retention is required by law (e.g. tax records, compliance records, dispute resolution). Document retention periods are governed by the Document Retention Policy.
This DPA is governed by the laws of England and Wales. For questions about this DPA or data processing, contact support@gotmytenants.com.
