EyeRent Data processing agreement

Version 1.1, last updated 10 November 2026

Effective date: 10 November 2026

Changes: we give at least 30 days' notice by email or in EyeRent before a material change to this agreement takes effect. Changes to sub-processors follow clause 4.

This agreement forms part of the EyeRent terms accepted by:

• CME Group Ltd, registered in England and Wales, company number 17536235, registered office 11a Mead Way, Fareham, PO16 7LA, trading as EyeRent ("we", the Processor); and
• the landlord or agent who holds the EyeRent account ("you", the Controller). An agent acting for a landlord confirms authority to give the landlord's processing instructions and secure the protections in this agreement for that processing.

Privacy contact: privacy@eyerent.co.uk. ICO registration reference: ZC282991.

Tenants, applicants, guarantors and referees are not parties. The EyeRent Privacy notice and the Controller's own notice explain how their data is used.

1. Scope

1.1 This agreement applies when we process personal data on your behalf in EyeRent (Customer Personal Data), as described in Schedule 1. It sets out the parties' obligations under Article 28 of the UK GDPR. References to data protection law mean the UK GDPR and the Data Protection Act 2018, as amended, and other applicable UK data protection law.

1.2 It does not govern processing where we act as a controller in our own right, such as account administration, billing, our own support records and security logs. The Privacy notice covers that processing. Keeping an operational security log does not turn the underlying tenant records into our controller data.

1.3 Where you instruct us to send data to a separate controller, this agreement covers our handling and disclosure on your behalf. That recipient's own processing is covered by its notice and the applicable sharing arrangements, not this processor agreement. Possible recipients include HMRC and PropertyGoose when their features are live, and a named enquiry recipient you confirm. We remain responsible for our own processing and disclosures.

1.4 If the EyeRent terms conflict with this agreement on data protection, this agreement takes precedence. Mandatory terms of an applicable IDTA or UK Addendum take precedence over conflicting terms here for the transfer they cover. This agreement is governed by the law of England and Wales. The courts of England and Wales have jurisdiction, without limiting any statutory rights of individuals or powers of a regulator.

2. Your responsibilities

2.1 You decide the purposes of processing and its essential means, have a lawful basis, give people the information required by law and keep your instructions lawful. You are responsible for any additional conditions needed for special category or criminal offence data. An applicant's authority to seek a reference does not by itself settle every lawful basis.

2.2 You confirm you have the right to upload the data and to instruct us. You keep it relevant and accurate and decide the retention appropriate to your legal obligations. Right to Rent checks remain your responsibility where they apply.

2.3 You can give documented instructions, obtain information and assistance, object to sub-processor changes, audit processing and choose return or deletion as set out below. You maintain a contact for security and rights requests and tell us promptly of relevant requests or incidents.

2.4 Tenant ID document features, ID checks and ID document OCR are unavailable, and live referencing is on hold. They are not authorised for live personal data until the relevant DPIA, notices, contracts and safeguards are in place. Managed listing services are outside this agreement and remain on hold pending separate agency terms and notice. Making Tax Digital is also unavailable; it cannot be bought or enabled until live.

3. Our obligations

We will:

3.1 process Customer Personal Data only on your documented instructions, including instructions about international transfers. These consist of this agreement, the features and settings you select, and written instructions agreed with us and capable of being saved. A feature selection does not authorise processing outside the stated scope. If UK law requires processing outside those instructions, we will tell you about the legal requirement before processing, unless the law prohibits this on important public interest grounds;

3.2 ensure every person authorised to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory duty of confidentiality, has suitable training and only accesses data for their authorised tasks;

3.3 take all measures required by Article 32, including the measures in Schedule 3, taking account of the state of the art, implementation costs, nature, scope, context and purposes of processing, and risks to individuals. We will maintain appropriate technical and organisational measures and not materially reduce the agreed protection during the service;

3.4 engage sub-processors only in accordance with clause 4 and Article 28(2) and (4);

3.5 taking account of the nature of processing, assist you through appropriate technical and organisational measures, insofar as possible, to respond to requests under Chapter III of the UK GDPR, including access, correction, erasure, restriction, portability, objection and rights relating to automated decisions. We will promptly forward requests received about Customer Personal Data and not answer on your behalf except on your instructions or where law requires;

3.6 assist you in meeting Articles 32 to 36, taking account of the nature of processing and the information available to us. This includes security risk assessment, breach assessment and notification to the ICO and affected people, DPIAs and prior consultation with the ICO. We will provide relevant processing, security and risk information in time for your applicable deadlines;

3.7 notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours. We will not wait for a complete investigation. We will give available details of the breach, affected people and records, likely consequences, contact point and measures taken or proposed; provide further information without undue delay as it becomes available; help contain and remedy it; and preserve relevant evidence. The 48 hours is an outer limit, not a waiting period;

3.8 at your choice, return or securely delete all Customer Personal Data after the processing services end, and delete existing copies unless UK law requires their storage. You have 30 days after account closure to obtain an export in a commonly used, machine-readable format, including files, or to choose earlier return or deletion. Unless you instruct return or earlier deletion, we will delete the remaining live copies at the end of that window. Export access is limited to return, not continued ordinary use. Backup copies are put beyond ordinary use and deleted within 35 days of deletion from the live system. Any legally required retained copy is isolated, used only for that legal purpose, protected under this agreement and deleted when the requirement ends. We will confirm completion on request. Schedule 4 sets service retention periods, not a right for us to retain your data after closure contrary to this clause;

3.9 make available all information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by you or an auditor you appoint. We will cooperate on reasonable notice and appropriate confidentiality and security arrangements that protect other customers without preventing verification of our compliance. Reports and certificates can support an audit but do not replace the right to audit or inspect. We will agree practical timing to minimise disruption; there is no annual limit where further checks are necessary to verify compliance, address an incident or meet a regulator's request;

3.10 not use Customer Personal Data for our own unrelated purposes, including AI model training, marketing or combining it with other customers' content; and

3.11 immediately tell you if, in our opinion, an instruction infringes UK GDPR or other applicable UK data protection law. We will suspend the affected instruction while we seek lawful clarification, except where law requires processing, and continue unaffected lawful services where possible.

4. Sub-processors

4.1 You give general written authorisation for the external sub-processors identified in Schedule 2, subject to this clause. A placeholder is not authorisation to use an unidentified provider.

4.2 We will give you at least 30 days' written notice by email or in EyeRent before adding or replacing a sub-processor, identifying its legal entity, service, processing location and relevant safeguards. You can object during that period on reasonable data protection grounds. We will work with you on a suitable alternative or safeguards before the change takes effect for your data. If unresolved, we will not send your data to the disputed provider; either party can end the affected service and clause 3.8 will apply to the affected data.

4.3 Before processing begins, we will bind each sub-processor by a written contract imposing the same data protection obligations as this agreement for its processing, including sufficient guarantees of appropriate technical and organisational measures, security, assistance, deletion and audit rights. We remain fully liable to you for the performance of the sub-processor's data protection obligations if it fails to fulfil them. We will keep a current list and provide relevant evidence of the contractual protections on request, subject to appropriate confidentiality safeguards.

5. International transfers

5.1 Stored Customer Personal Data is configured for the EU. Provider edge processing and support can involve other countries. Storage jurisdiction alone is not a guarantee that all processing remains in the EU.

5.2 We will make transfers subject to UK GDPR restrictions only on your documented instructions and in compliance with Chapter V, including onward transfers and overseas remote access. The mechanism will be applicable UK adequacy regulations or appropriate safeguards such as the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses. Where required, we will complete and document a transfer risk assessment and supplementary safeguards before transfer. Selecting a provider is not, by itself, a transfer safeguard.

5.3 We will provide information about destinations, recipients and safeguards, and copies of relevant transfer terms on request, with justified redactions for confidential information. If adequate protection cannot be maintained, we will suspend the affected transfer and work with you on lawful return, deletion or an alternative arrangement.

6. Staff access

6.1 EyeRent staff access Customer Personal Data only as authorised for support, security or your documented request, using least-privilege permissions and confidentiality controls.

6.2 Staff opening of a thread or download of a tenant document is logged and visible to you. There is no general permission for staff to browse tenant records or act as your agent under this agreement.

7. Liability

7.1 Liability between the parties is as set out in the EyeRent terms, to the extent permitted by law. This agreement sets no separate monetary cap and creates no cap where the terms contain none.

7.2 Nothing here excludes liability that cannot lawfully be excluded, limits an individual's rights to compensation under data protection law, restricts a regulator's powers, or removes our responsibility under clause 4.3. Any allocation between the parties operates only to the extent compatible with those obligations.

8. Term

8.1 This agreement takes effect with your acceptance of the EyeRent terms incorporating it, from the effective date shown above, and lasts while we process Customer Personal Data for you, including any limited export, backup or legally required retention period.

8.2 Confidentiality, assistance, security, audit and deletion duties continue for any retained data. Changes are recorded in writing; no change to the general terms reduces the protections in this agreement without an agreed lawful amendment.

Schedule 1: Processing details

Schedule 2: Sub-processors

CMeSign is an internal service of CME Group Ltd, not a separate sub-processor. Any external infrastructure used for it falls under the sub-processor and transfer controls above. Receipt photos are read on your device, so no OCR provider receives images for reading. Confirmed images are stored using the hosting and storage services above.

Separate controllers, not sub-processors for their own processing, include HMRC and PropertyGoose when available, and Octo Financial Planning Ltd or another recipient you confirm for an enquiry. This is not permission to activate a held feature. Separate controller sharing arrangements and notices are required before live sharing.

Schedule 3: Security measures

• Encryption in transit (TLS 1.2 or later) and at rest; appropriate protection and access controls for keys and credentials.
• Two-step sign-in for staff and admins, offered to all users; role-based, least-privilege access with access reviews and prompt removal when no longer needed.
• Tenant and landlord isolation: tenants see only their authorised tenancy data; requests are restricted to the authorised landlord and property scope.
• Staff access to threads and tenant documents logged and visible to the landlord; short-lived download links and recorded downloads.
• Location data removed from uploaded property photos; card numbers masked on receipts; receipt OCR on the user's device and no save to EyeRent until confirmation.
• Secrets kept outside source code in protected runtime configuration; no personal document content in application error logs.
• Appropriate confidentiality, integrity, availability and resilience of systems and services; timely restoration of availability and access after a physical or technical incident.
• Backups protected with equivalent access and storage-region controls. Deleted records put beyond ordinary use in backups and removed within 35 days of live deletion; deletion instructions reapplied after restoration before ordinary access resumes.
• Regular testing, assessment and evaluation of security measures; risk-based vulnerability and patch management; staff training and an incident response process supporting clause 3.7.
• Data minimisation and pseudonymisation where appropriate to the processing risk; generic push text with no names, addresses, message contents or financial details if push is enabled, and an off switch.
• A DPIA and appropriate safeguards before tenant ID checks, ID document OCR or live referencing. No live use of held features before those steps are complete.

Schedule 4: Retention

These are the service retention periods, subject to your lawful instructions and the return or deletion provisions in clause 3.8. We assist you with lawful rights requests even where ordinary users cannot edit or delete messages. A dispute or claim pause is limited to relevant records, supported by a documented lawful reason and reviewed until that reason ends; it does not authorise general or indefinite retention.

For clarity, our own controller records have separate periods in the Privacy notice, including sign-in and security logs for 12 months, and staff access and audit logs for 12 months (entries copied into a data rights case are kept 3 years, and into a security incident record 6 years). Those categories are kept distinct. Account closure provides a 30-day export window followed by deletion under clause 3.8; deleted data leaves backups within 35 days of live deletion.