Version 1.0 — effective from 18 August 2026
This Data Processing Addendum ("DPA") forms part of the agreement between the landlord customer ("Controller") and Private Shares Limited, a company registered in England and Wales (company number 08367665), whose registered office is 1 Billing Road, Northampton, NN1 5AL, trading as RentDocs.co.uk ("Processor", "we"), for the RentDocs platform (the "Service"). It reflects the requirements of Article 28 UK GDPR and the Data Protection Act 2018.
For personal data described in Annex A that the Controller inputs into the Service about tenants, guarantors, occupiers and other third parties, the Controller is the controller and Private Shares Limited is the processor. For account, billing and product-analytics data about the Controller themselves, Private Shares Limited is a separate controller and its use of that data is governed by our Privacy Notice.
Subject-matter: processing tenant, guarantor and property personal data so the Controller can meet UK letting compliance obligations, share document packs, collect rent evidence, and communicate with tenants. Duration: for as long as the Controller has an active account, plus the retention periods in the Privacy Notice.
Storing documents, sending SMS and email communications, generating tenancy agreements and Legionella risk assessments, e-signature capture, hosting a tenant portal, and providing an audit trail.
See Annex A at the end of this DPA.
The Processor shall:
The Controller provides general written authorisation for the Processor to engage the subprocessors listed on the Subprocessors page. The Processor will give reasonable prior notice of intended additions or replacements via that page (or by email if the Controller has subscribed to change notifications), and the Controller may object on reasonable data-protection grounds; if the objection cannot be resolved, the Controller may terminate the affected part of the Service.
Where a subprocessor processes personal data outside the UK, the Processor relies on the UK IDTA, the UK Addendum to the EU SCCs, or an adequacy regulation, as identified per provider on the Subprocessors page.
The technical and organisational measures currently in place are described on the Security page and are reviewed periodically. They include TLS 1.2+ in transit, encryption at rest at the platform layer, row-level security for tenant isolation, hashed passwords with leaked-password checks, per-property tenant portal revocation, short-lived signed download URLs and access logging.
The Processor will respond to reasonable written security questionnaires from the Controller once per twelve-month period, and provide summaries of third-party attestations held by subprocessors where available. On-site audits are not currently offered; the Controller may instead review this DPA, the Security page and the Subprocessors page.
Each party's liability under this DPA is subject to the liability and indemnity provisions of the main Terms.
Data subjects: tenants, prospective tenants, guarantors, occupiers, emergency contacts, and other individuals whose personal data the Controller enters into the Service.
Categories of personal data: name, address, email, phone number, tenancy dates, rent amounts, rent payment status, uploaded compliance documents (which may include names, ID numbers on certificates, engineer details), communications with the tenant, e-signature audit metadata (IP, user agent, timestamp, SHA-256 hash of signed content).
Special category data: the Service is not designed to process special category data. Do not upload health data, biometric data or similar unless strictly necessary and lawful.
Frequency: continuous, on Controller instruction via the Service.
Retention: as set out in the Privacy Notice retention schedule.
Recipients: Controller, tenants named by the Controller, subprocessors listed on the Subprocessors page.
Questions about this DPA: hello@rentdocs.co.uk.