← LetTrack
Draft — not legally reviewed. This document is a placeholder only and has not been reviewed by a solicitor. Do not rely on it as legal advice.

Data Processing Agreement

Last updated: 25 October 2026

This Data Processing Agreement ("DPA") forms part of your agreement with JR (COV) LTD trading as LetTrack (company number 14842927) and governs our processing of personal data on your behalf as required by UK GDPR Article 28.

1. Definitions

  • "Controller": you (the landlord or agency using LetTrack)
  • "Processor": JR (COV) LTD trading as LetTrack
  • "Data Subjects": your tenants and any other individuals whose personal data you upload
  • "UK GDPR": the UK General Data Protection Regulation as retained in UK law

2. Scope of processing

We process personal data only on your documented instructions for the purpose of providing the LetTrack service. We will not use tenant personal data you upload for our own marketing or analytics purposes.

3. Data security

We implement appropriate technical and organisational measures including: TLS encryption in transit, encryption at rest, row-level security at the database layer, access controls, audit logging, and incident response procedures.

4. Sub-processors

We use the following sub-processors. We will notify you of changes with at least 14 days notice.

  • Supabase Inc — database, authentication and file storage (AWS Ireland, EU)
  • Vercel Inc — application hosting (US-headquartered, global edge)
  • Resend Inc — transactional email (US)
  • Sentry (Functional Software Inc) — error monitoring, with personal data minimised where possible (US)
  • Anthropic PBC — AI processing for features you use, such as reading uploaded documents to pre-fill details and drafting messages and reports; not used to train models; Right to Rent records and AML data are never sent, and an identity document uploaded as an ordinary document is discarded as soon as it is recognised (US)
  • Ideal Postcodes Ltd — UK address lookup for property addresses, including addresses read from uploaded certificates
  • postcodes.io — postcode lookups to find a property’s local area
  • Stripe Inc — payment processing for LetTrack subscriptions; no tenant data is shared (US/global)
  • Only if a user chooses to connect them: Google LLC and Microsoft Corporation — calendar sync, and mailbox connection for Microsoft 365

5. Data subject rights

We will assist you in fulfilling data subject access requests, erasure requests, and other rights within 5 business days of your request.

6. Breach notification

We will notify you of personal data breaches affecting your data within 48 hours of becoming aware of the breach, to enable you to meet your 72-hour ICO notification obligation.

7. Data transfers

Our database and file storage are in the EU (AWS Ireland), covered by the UK’s adequacy regulations. Where a sub-processor above processes data outside the UK or EU, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard recognised under UK GDPR.

8. Deletion

On termination we will delete your personal data within 30 days, except where we are required to retain it by law.

9. Governing law

This DPA is governed by the laws of England and Wales.

Data protection contact

dpo@lettrack.co.uk (Data Protection Lead) · ICO registration in progress · This DPA requires legal review before production use.

LetTrack · All documents are drafts pending legal review · 2026