This Data Processing Agreement (“DPA”) forms part of your subscription agreement with EstateHQ and governs how we process personal data on your behalf as required by Article 28 of UK GDPR.
Last updated: May 2026 · Governing law: England and Wales
Note: By accepting our Terms of Service, you also accept this DPA. No separate signature is required. If your organisation requires a signed DPA, contact hello@estatehq.co.uk.
This DPA is between:
EstateHQ, trading name of the company operating the EstateHQ platform. Company registration number: 17209704, registered in England and Wales.
Email: hello@estatehq.co.uk
The estate agency or individual who creates an account and accepts the Terms of Service (“Customer”). The Customer determines the purposes and means of processing personal data entered into the Platform.
Subject matter: EstateHQ processes Personal Data to provide the Platform and associated services to the Customer under the Terms of Service.
Duration: Processing continues for the term of the Customer’s subscription, plus up to 90 days after account closure during which the Customer may request a data export.
Nature of processing: Storage, retrieval, display, organisation, and transmission of Personal Data within the Platform, including generating reports and sending transactional emails on the Customer’s behalf.
Purpose of processing: To provide a compliance management and estate agency operations platform to UK estate agencies.
EstateHQ will process Personal Data only on documented instructions from the Customer — which include the Terms of Service, this DPA, and any further written instructions the Customer provides. If EstateHQ is required by applicable law to process Personal Data for another purpose, it will inform the Customer before doing so (unless prohibited by law).
EstateHQ will ensure that persons authorised to process Personal Data are subject to an obligation of confidentiality or are under an appropriate statutory obligation of confidentiality.
EstateHQ will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 UK GDPR. These measures include: encryption of personal data in transit (TLS) and at rest, access controls and row-level security policies, regular security reviews, and incident response procedures.
EstateHQ will not engage a new Sub-Processor without informing the Customer. Customers who subscribe to this DPA give general authorisation to EstateHQ to engage Sub-Processors listed in the Privacy Policy (currently: Supabase, Stripe, Resend, Vercel, PostHog, Microsoft (Azure AD), Google). EstateHQ will update its Privacy Policy with at least 14 days' notice before adding a new Sub-Processor. If the Customer objects to a new Sub-Processor, they may terminate their subscription within the notice period. All Sub-Processors are bound by data processing agreements imposing equivalent obligations.
EstateHQ will assist the Customer in fulfilling its obligations to respond to requests from data subjects exercising their rights under UK GDPR (Articles 12–22), taking into account the nature of the processing and the information available to EstateHQ.
EstateHQ will assist the Customer with: (i) Article 32 security obligations; (ii) notification of personal data breaches to supervisory authorities and data subjects under Articles 33–34; (iii) data protection impact assessments under Article 35; and (iv) prior consultation under Article 36. EstateHQ will notify the Customer of any Personal Data breach without undue delay and in any event within 48 hours of becoming aware of it. This 48-hour internal target is designed to allow the Customer sufficient time to assess whether the breach requires reporting to the ICO within 72 hours under UK GDPR Article 33(1).
At the choice of the Customer, EstateHQ will delete or return all Personal Data at the end of the service provision. Customer data is retained for 90 days after account closure to allow export; thereafter it is permanently deleted. All copies held by Sub-Processors will be deleted in accordance with their respective data retention policies.
EstateHQ will make available to the Customer all information necessary to demonstrate compliance with the obligations in Article 28 UK GDPR. EstateHQ will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice (14 days minimum) and agreement on scope. EstateHQ may satisfy audit obligations by providing up-to-date third-party audit reports (such as SOC 2 Type II) where applicable.
Personal Data is primarily stored on Supabase infrastructure located in the United Kingdom (AWS eu-west-2, London region). This does not constitute an international transfer under UK GDPR as the data does not leave the United Kingdom. Where Personal Data is transferred outside the UK to Sub-Processors located in the United States (Stripe, Resend, Vercel, Google, Microsoft) or the European Union (PostHog), such transfers are made subject to the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, as applicable, ensuring an equivalent level of protection to that provided under UK GDPR.
EstateHQ will not transfer Personal Data to a country outside the UK unless appropriate safeguards are in place.
The Customer, as data controller, is responsible for:
Each party’s liability under this DPA is subject to the limitations set out in the Terms of Service. EstateHQ will not be liable for any processing carried out by the Customer in breach of UK GDPR.
Where both parties are held liable for damage caused by processing, liability between the parties shall be apportioned in accordance with their respective fault.
This DPA is effective from the date the Customer accepts the Terms of Service and remains in force for the duration of the subscription. This DPA automatically terminates on termination of the Terms of Service.
On termination, the data deletion provisions in clause 5(g) apply.
This DPA is governed by and construed in accordance with the laws of England and Wales. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.
For questions about this DPA, or to request a separately signed DPA document, contact our data protection team:
Email: hello@estatehq.co.uk
Subject line: “DPA request — [your agency name]”
We take our obligations as your data processor seriously. Get in touch with any questions about how we handle your data.