Data Processing Agreement

This Data Processing Agreement (“DPA”) is between SWPI Consultancy Ltd (company number 17310962), registered office 66 Paul Street, London, EC2A 4NA (“SWPI”), and a sourcer, agent, partner or other business that supplies or processes personal information in connection with SWPI (“Business User”).

It forms part of our Terms & Conditions and applies where one party processes personal data on documented instructions for the other. It also records the parties’ separate responsibilities where each independently determines how and why information is used. In this DPA, Data Protection Law means the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations 2003, each as amended.

• Controller means the person or organisation deciding why and how personal data is processed.
• Processor means an organisation processing personal data for a controller on documented instructions.
• Personal Data, Data Subject, Personal Data Breach and processing have the meanings given by UK GDPR.
• Business Data means information supplied, uploaded, stored or managed by or for a Business User in connection with SWPI's services.
• Services means SWPI's website, sourcing and consultancy activity, investor and seller services, Co-Source portal and the SWPI areas of SOURCEFOLIO.

• SWPI is controller for investor criteria, seller and property enquiries, sourcer accounts, deal submissions, due diligence, matching, introductions, communications, transaction administration, strikes and blocklist records because SWPI decides the business purposes and essential means of that processing.
• A Business User is a separate controller for personal data it obtains and uses for its own sourcing, agency, customer, investor, supplier or professional relationships. Each controller is independently responsible for its own lawful basis, notices and handling.
• Only where SWPI processes third-party personal data solely to carry out a specific documented task for a Business User does SWPI act as that Business User's processor under the processor obligations in this DPA.
• Where a Business User processes information solely on SWPI's documented instructions, that Business User acts as SWPI's processor and the equivalent obligations in this DPA apply to it.
• The parties are not joint controllers unless they expressly agree their joint purposes and responsibilities in writing.

SWPI uses SOURCEFOLIO, a separate software service, to host or support investor onboarding, criteria and relationship records, enquiries, deal information, videos, presentations and investor portals. SOURCEFOLIO only holds personal information that an investor, seller or other user submits through the SWPI forms, onboarding questions or portal fields on that platform. For personal information placed in SWPI’s account for SWPI’s business purposes, SWPI remains the controller and SOURCEFOLIO acts as a technology provider processing that information to provide its platform and related services.

SOURCEFOLIO does not decide why SWPI collects investor or property information, verify SWPI’s opportunities or provide investment advice. SOURCEFOLIO may separately act as controller for limited information needed to administer its own service, security or legal obligations. Its current terms and privacy information are available at www.sourcefolio.uk.

The Services are not designed for highly sensitive personal information. A Business User must not place the following in ordinary forms, CRM fields, notes, deal records or uploads:

• passwords, authentication codes or security answers;
• bank account information, payment card information or online-banking credentials;
• passports, driving licences, government identification numbers or identity documents;
• medical, biometric, genetic, criminal-offence or other special-category information; or
• irrelevant or excessive information about vendors, tenants, investors or other individuals.

Where identity or anti-money-laundering evidence is lawfully required, it must be handled through a specifically approved secure process or appropriate regulated professional, not through general-purpose fields or uploads.

Each party acting as controller must:

• have a lawful basis for collecting, using and disclosing personal information and document it where required;
• provide clear privacy information to affected people and obtain consent where consent is the appropriate lawful basis;
• collect only information that is relevant and necessary and take reasonable steps to keep it accurate;
• respect objections, withdrawals of consent, deletion requests and communication preferences where the law requires;
• ensure it has authority to upload and share documents, images, links, communications and third-party contact information;
• comply with applicable property, consumer, financial-promotion, anti-money-laundering and data-protection obligations; and
• control access to its accounts and shared links and remove access when no longer appropriate.

Where either party acts as processor, it will:

• process personal data only on the controller's documented instructions, including instructions given through the Services, unless law requires otherwise;
• notify the controller if an instruction appears to infringe Data Protection Law and, unless prohibited by law, before processing required by law outside those instructions;
• ensure authorised personnel are subject to confidentiality obligations;
• apply appropriate technical and organisational measures taking account of the nature, scope, context and risks of processing;
• reasonably assist with data-subject requests, security obligations, impact assessments, regulator consultations and breach response, taking account of the processing and available information;
• notify the controller without undue delay after becoming aware of a Personal Data Breach affecting the controller's data and provide available information reasonably needed for the controller's assessment;
• on termination and written request, delete or return the data where reasonably possible, except where law or the establishment, exercise or defence of claims requires retention; and
• provide information reasonably necessary to demonstrate compliance and permit proportionate audits subject to confidentiality, reasonable notice, business-hours access and appropriate cost allocation.

• Authenticated access, individual accounts and role-based permissions.
• Row-level access controls intended to limit Co-Source users to their own records and authorised administrators to operational records.
• Private storage and time-limited access methods for submitted deal media where applicable.
• Encryption in transit and provider-managed encryption at rest.
• Input validation, restricted file types and file-size limits for deal uploads.
• Restricted administrative access, monitoring, maintenance, backups and incident-response processes appropriate to the service.
• Separation between authentication credentials and readable business records; SWPI does not receive readable account passwords.

No online system can guarantee absolute security. Each party is responsible for protecting credentials, devices, shared links and configurations under its control and for promptly reporting suspected compromise.

A controller authorises the use of service providers reasonably required to operate the Services. Relevant providers or categories may include:

• SOURCEFOLIO for SWPI's investor onboarding, CRM, deal presentations, videos and investor portals;
• application hosting, content-delivery and managed infrastructure providers;
• database, authentication, security, backup and private file-storage providers;
• transactional email, support, analytics and communication providers; and
• professional advisers or transaction professionals where they act as processors rather than independent controllers.

Where Data Protection Law requires it, a processor will impose appropriate data-protection obligations on its sub-processors and remain responsible for its own compliance. Providers may change as the Services evolve. SWPI will provide reasonable information about material changes on request; if a justified data-protection objection cannot be resolved, the affected service may be terminated.

SOURCEFOLIO and Co-Source may facilitate CRM records, deal information and shared access. The person deciding what to enter, whom to contact, what to share and who receives a link is responsible for the lawfulness, accuracy and access decision. Shared information must be limited to authorised recipients and access must be withdrawn when no longer needed.

A technology provider is not responsible for a user sharing a link with the wrong person, failing to remove access, entering unlawful information or a recipient redistributing information after it has been lawfully shared, except to the extent caused by that provider’s own breach of law or contract.

Some providers may process personal data outside the United Kingdom. Where restricted transfers occur, the responsible exporter will use a lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary measures where appropriate.

SWPI retains information under the periods described in its Privacy Policy and only for as long as reasonably necessary for the relevant relationship, transaction, legal obligation, security purpose or claim. Following termination, data may be deleted, returned or anonymised where appropriate. Rolling backups may remain for a limited period before being securely overwritten, and records required by law or for fraud prevention and legal claims may be retained.

On reasonable written request, a processor will provide information reasonably available to demonstrate its compliance. Unless a regulator or confirmed incident requires otherwise, an audit must give at least 30 days’ notice, occur no more than once in 12 months, avoid access to another customer’s information, preserve confidentiality and be at the requesting controller’s reasonable cost.

Each party will cooperate in good faith with reasonable data-protection enquiries. A Business User remains responsible for its own property sourcing, investor contact, financial-promotion and business compliance; neither SWPI nor SOURCEFOLIO determines that compliance for the Business User.

Liability under this DPA is subject to the applicable limitations in our Terms & Conditions, except where liability cannot legally be limited. Each controller is responsible for its own decisions and compliance failures. A Business User indemnifies SWPI against losses, fines, claims and reasonable costs arising from that Business User’s unlawful collection, instructions, disclosure, upload or use of third-party personal data, except to the extent caused by SWPI’s breach.

This DPA continues for as long as either party processes personal data for the other. If it conflicts with the Terms & Conditions, this DPA prevails only for the processing matters it governs. We may update it to reflect changes in law, providers or processing, and the date at the top identifies the version in force.

Data-protection notices and requests concerning SWPI should be sent to SWPI@SWPIConsultancy.co.uk.

This DPA is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.