Data processing terms
Last updated: 30/09/2026
These terms form part of the agreement between Habitix Ltd (company number 17254226, registered office 195 Wood Street, London, E17 3NU), the Processor, and the estate agency that uses Habitix (the Agency), the Controller. They apply to personal data that Habitix processes for the Agency under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. Roles
The Agency is the controller of the personal data it puts into Habitix (Agency Data). Habitix is its processor. Habitix is a controller only of its own account, security and website data, which the privacy notice covers.
2. Instructions
Habitix will process Agency Data only on the Agency's documented instructions. These terms, the Terms of Service and the Agency's use of Habitix's features are those instructions. If Habitix thinks an instruction breaches data protection law, it will tell the Agency.
3. Scope of processing
The details are in the schedule at the end of this page.
4. Confidentiality
Habitix will make sure everyone who can access Agency Data is bound by a duty of confidentiality, and gives access only where needed to run, support or secure the service.
5. Security
Habitix will keep appropriate technical and organisational measures in place, including those in the schedule. The Agency is responsible for its own users' sign-in details, role settings and devices.
6. Sub-processors
The Agency gives general authorisation for the sub-processors listed in the schedule. Habitix will tell the Agency by email at least 14 days before adding or replacing a sub-processor. The Agency can object on reasonable data protection grounds within that time. If the issue can't be resolved, the Agency may end the agreement without penalty. Habitix will put written terms on each sub-processor that give the same level of data protection as these terms, and remains responsible for their performance.
7. International transfers
Agency Data is held in the UK. Where it is processed outside the UK, Habitix will make sure the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum. Email sending via Resend takes place in Ireland, which is covered by UK adequacy regulations.
8. Helping the Agency
Habitix will, taking account of the nature of the processing and the information it has, help the Agency respond to requests from people exercising their rights (for example access or deletion), and will pass on any request it receives about Agency Data without replying to the person itself. Habitix will also help the Agency meet its security, breach notification and data protection impact assessment duties.
9. Personal data breaches
Habitix will tell the Agency without undue delay and within 48 hours after becoming aware of a breach affecting Agency Data. The notice will say what is known about what happened, the data and people affected, the likely effects, and the steps taken or proposed.
10. Return and deletion
When the agreement ends, the Agency can export its Agency Data for 30 days. After that Habitix will delete it, including from live systems, unless the law requires it to be kept.
11. Audits and information
Habitix will give the Agency the information needed to show it is meeting these terms, and will allow reasonable audits, no more than once a year, with 30 days' notice, during working hours, at the Agency's cost, by the Agency or an auditor it appoints.
12. Liability and law
Liability under these terms is subject to the limits in the Terms of Service. English law applies and the courts of England and Wales have exclusive jurisdiction.
Schedule
Part A: Details of processing
| Subject matter | Providing the Habitix CRM to the Agency. |
| Duration | The length of the agreement, then the export and deletion period in section 10. |
| Nature and purpose | Storing, organising, displaying, reminding about and exporting property, tenancy, contact, compliance and communication records so the Agency can run its sales, lettings and property management. |
| Types of personal data | Names, email addresses, phone numbers, addresses; property, tenancy, rent and deposit details; Right to Rent check records and related documents; compliance certificates and licence records; contractor details; internal messages; user account details and audit log entries. |
| People whose data it is | Landlords, tenants and prospective tenants, vendors and buyers, contractors and other contacts; the Agency's own staff. |
| Special category data | Not intended. The Agency should not enter it. |
Part B: Security measures
- Each agency's records are kept separate from other agencies' records through database access rules.
- Role-based access within each agency (director, admin, lettings, sales, property manager).
- Access to the platform admin tools requires two-step sign-in, and the platform admin cannot open any agency's properties, contacts, documents or messages.
- An audit log of create, edit and archive actions that can't be edited.
- Data is held in the UK on Supabase.
- Emails and invites sent from the app go through Resend, and the shared sandbox cannot send email.
Part C: Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | UK |
| Resend | Sends emails from the app such as reminders and account emails | Ireland |