Valuation Studio · 11 September 2026

Data processing agreement.

This agreement forms part of the applicable Studio terms when a business uses Studio to process visitor enquiries.

Scope and instructions

The customer business is the controller and The Upgrade Authority Ltd is its processor for visitor enquiry data. Processing consists of collecting, hosting, organising, retrieving, displaying, exporting and deleting property enquiries, reports and conversations, including assistant processing and necessary support. It continues for the service period and the agreed return or deletion period. People affected include website visitors, property owners, prospective buyers and people acting for them. Data may include contact details, property facts, questions, replies, reports, referral information and recorded permissions. Special category and criminal offence data are not intended to be submitted.

We process this data only on the customer’s documented instructions, including these terms and authorised settings, unless law requires otherwise. Where permitted, we will tell the customer about that legal requirement before processing. We will promptly tell the customer if an instruction appears to infringe data protection law. The customer is responsible for its lawful basis, notices, necessary permissions and the accuracy and lawful collection of its data.

Confidentiality and security

We restrict access to authorised people who need it to provide, support or secure the service and who are subject to confidentiality obligations. Measures include encrypted connections, verified account access, workspace isolation, protected visitor identifiers, request limits, restricted database roles and recorded support access. We will maintain technical and organisational measures appropriate to the nature of the processing and the risk to people. Those measures address confidentiality, integrity, availability and resilience, recovery after an incident and regular review of their effectiveness.

Other processors and transfers

The customer authorises Vercel for hosting and delivery, Supabase for database and authentication infrastructure, OpenAI for assistant processing and Resend for service email delivery where it processes customer data. We will bind each processor to written data protection obligations that offer the same level of protection required by this agreement and remain responsible for its performance of those obligations. We will give at least 30 days’ notice before adding or replacing a processor, so the customer can object on reasonable data protection grounds. We will discuss an alternative; if none is reasonably available, the affected service may be ended.

We will not arrange a restricted international transfer of customer personal data unless the applicable legal transfer requirements are met. This may require recognised adequacy arrangements or approved contractual protections and a transfer assessment. The customer may request the current processing locations, supplier list and relevant safeguards. A provider’s marketing statement alone does not replace those requirements.

Requests, incidents and assistance

Taking account of the processing and information available to us, we will use appropriate technical and organisational measures to assist the customer with individual rights requests. We will also assist with security obligations, breach assessment and notifications to the ICO or affected people, impact assessments and consultation with regulators where required. If an individual contacts us about the customer’s processing, we will refer the request to the customer unless the customer authorises us to respond or law requires us to do so. We will notify the customer without undue delay after becoming aware of a personal data breach affecting its data, provide information as it becomes available and cooperate in containment and remediation.

Evidence and review

We will make available information reasonably needed to demonstrate compliance with this agreement and allow audits or inspections by the customer or an independent auditor bound by confidentiality. The parties will agree reasonable notice, scope and security arrangements, except where an urgent incident or regulator requires otherwise. An audit must protect other customers’ data and service security. Reasonable assistance beyond the ordinary service can be charged only where agreed in advance and where doing so is permitted by law.

Return and deletion

At the end of the service, the customer may choose return or deletion of its personal data. We will provide an available structured export and delete remaining live customer data within 30 days of a verified instruction, unless law requires retention. We will explain any retained category and restrict its use to that requirement. Backup copies are isolated from ordinary use and expire under the applicable backup schedule; a controlled restoration must reapply deletion instructions. We will provide confirmation of the action taken when requested.

This agreement takes priority over conflicting subscription or pilot wording about processing customer personal data. It does not remove either party’s responsibilities under applicable data protection law.

Pricing · Pilot terms · Subscription terms · Privacy · Data processing agreement

Questions can be sent to hello@theupgradeauthority.co.uk.