---
title: "Manage.Management | Data Processing Agreement"
url: https://manage.management/dpa
description: "Standard UK GDPR Article 28 Data Processing Agreement governing how Manage.Management processes personal data on behalf of customer organisations."
publisher: Manage.Management
language: en-GB
---

# Data Processing Agreement

Data Processing Agreement · v1.0

Last updated: 13 November 2026

England & Wales

## Manage.Management Data Processing Agreement

Standard UK GDPR Article 28 Data Processing Agreement governing how Manage.Management processes personal data on behalf of customer organisations across the United Kingdom.

Legal Entity

MANAGE.MANAGEMENT LIMITED (No. 16619867 · ICO ZC092250)

Data Hosting & Role

UK GDPR Article 28(3) processor terms · UK (London) hosting

Legal & DPA Notices

[legal@manage.management](mailto:legal@manage.management)

Overview

## How this DPA works

Version 1.0 · Effective 13 November 2026

Managing agents can sign this in [Settings > Data protection](https://manage.management/settings?tab=data-protection).

This Data Processing Agreement (**DPA**) forms part of the Manage.Management [Managing Agent Terms of Service](https://manage.management/terms/managing-agents) (the **Terms**). It is incorporated into the Terms by clause 6 and binds the parties when the customer organisation accepts the Terms, signs an Order Form, or uses the Platform, whichever comes first. It applies whether or not it is signed. Manage.Management signs each version when it is published. The Customer may also sign it electronically in the Platform under [Settings > Data protection](https://manage.management/settings?tab=data-protection), and both parties then receive a signed copy. The DPA is the same for every customer and cannot be amended for an individual customer except by an Order Form as set out in clause 1.3.

It is made between:

1. **MANAGE.MANAGEMENT LIMITED**, a company registered in England and Wales (company number 16619867), whose registered office is at The Square, 10 Exeter Road, Bournemouth, England, BH2 5AN (**Manage.Management**, **we**, **us**); and
2. the **customer organisation** that has accepted the Terms or signed an Order Form (the **Customer**, **you**).

## 1. Definitions and interpretation

1.1 Capitalised terms not defined in this DPA have the meaning given in the Terms.

1.2 In this DPA:

- **Data Protection Legislation** means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025), and any other law relating to personal data that applies in the UK.
- **UK GDPR** has the meaning given in section 3(10) of the Data Protection Act 2018.
- **Controller**, **Processor**, **Data Subject**, **Personal Data**, **Personal Data Breach**, **Processing** and **Supervisory Authority** have the meanings given in the UK GDPR. **ICO** means the Information Commissioner.
- **Customer Personal Data** means Personal Data contained in User Content, or otherwise provided to or collected by the Platform for the Customer, that Manage.Management processes as a Processor (or Sub-processor) on the Customer's behalf under the Terms.
- **Client** means a third party for whom the Customer manages a building or estate, such as a residents' management company (RMC), right to manage (RTM) company, landlord, freeholder or commonhold association.
- **Sub-processor** means another processor engaged by Manage.Management to process Customer Personal Data.
- **Restricted Transfer** means a transfer of Customer Personal Data to a country or international organisation outside the UK that is not covered by regulations made under Article 45A of the UK GDPR.
- **Sub-processor List** means the Sub-processors published on the Trust Centre at [trust.manage.management/subprocessors](https://trust.manage.management/subprocessors), as updated under clause 7. Annex 3 shows the list at the date of this version.

1.3 If there is a conflict between this DPA and the Terms on a data protection matter, this DPA prevails. An Order Form prevails over this DPA only where it expressly refers to the clause of this DPA it varies.

## 2. Scope and roles

2.1 This DPA applies only where Manage.Management processes Customer Personal Data as a Processor or Sub-processor. It does not apply to Personal Data that Manage.Management processes as a Controller as described in clause 6 of the Terms (for example user account registration, billing, subscription administration, relationship management, security telemetry and Usage Data). That data is covered by the [Privacy Policy](https://manage.management/privacy).

2.2 **Customer as Controller.** Where the Customer decides why and how Customer Personal Data is processed, the Customer is the Controller and Manage.Management is its Processor.

2.3 **Customer as Processor for a Client.** Where the Customer processes Customer Personal Data as a processor on behalf of a Client, Manage.Management is a Sub-processor. In that case the Customer:

- (a) warrants that its Client has authorised the Customer to use Manage.Management, and to use the Sub-processors in Annex 3, on terms consistent with this DPA;
- (b) passes on its Client's instructions to Manage.Management and is the single point of contact for Manage.Management under this DPA; and
- (c) is responsible for passing to its Client any notices, information and assistance Manage.Management gives under this DPA.

2.4 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

## 3. Customer obligations

3.1 The Customer is responsible for:

- (a) having a lawful basis under Article 6 of the UK GDPR, and where relevant a condition under Article 9 or Article 10, for all Customer Personal Data it uploads or asks the Platform to process;
- (b) giving Data Subjects (including leaseholders, residents and directors) the information required by Articles 13 and 14 of the UK GDPR, including that the Customer uses Manage.Management as a service provider;
- (c) the accuracy of Customer Personal Data and the lawfulness of its instructions; and
- (d) having its own complaints procedure for Data Subjects as required by section 164A of the Data Protection Act 2018.

3.2 The Platform is not designed for health, criminal offence or other special category data. If the Customer uploads it (for example, mobility or health information for evacuation planning, or reports about criminal behaviour), the Customer must have a valid legal condition, keep it to what is necessary, and use the access controls the Platform provides to restrict who can see it.

## 4. Processing on documented instructions

4.1 Manage.Management shall process Customer Personal Data only on the Customer's documented instructions, including for Restricted Transfers, unless UK law requires otherwise. In that case Manage.Management shall tell the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 The Customer's documented instructions are:

- (a) the Terms, this DPA and any Order Form;
- (b) the Customer's and its authorised users' configuration and use of the Platform, including integrations the Customer chooses to enable;
- (c) the instruction to anonymise Customer Personal Data to create Aggregated Data, as set out in clause 5 of the Terms. Once anonymised, Aggregated Data must not be capable of identifying any individual, Customer or Client; and
- (d) any other reasonable written instruction sent to [legal@manage.management](mailto:legal@manage.management) that is consistent with the Terms. Manage.Management may charge for instructions outside the scope of the Platform on prior written notice.

4.3 Manage.Management shall promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Legislation, and may suspend that instruction until it is confirmed or changed.

4.4 Manage.Management shall not sell Customer Personal Data, use it for its own purposes except as allowed by clause 4.2(c), or use it to train artificial intelligence models, and shall not allow its Sub-processors to use it to train their models.

4.5 Manage.Management shall not share, disclose or give access to Customer Personal Data to any block management, managing agent or property management business connected with Manage.Management, its directors or its shareholders, and shall not use it (including Aggregated Data derived from it) for the benefit of any such business.

## 5. Confidentiality of personnel

Manage.Management shall ensure that every person it authorises to process Customer Personal Data (including employees, contractors and agency workers) is under a written or statutory duty of confidentiality, receives appropriate data protection training, and has access only to the extent needed for their role.

## 6. Security

6.1 Manage.Management shall implement the technical and organisational measures in Annex 2 to provide a level of security appropriate to the risk, as required by Article 32 of the UK GDPR.

6.2 Manage.Management may update those measures, provided updates do not materially reduce the overall level of protection. Current measures are published on the Trust Centre.

## 7. Sub-processors

7.1 **General authorisation.** The Customer gives Manage.Management general written authorisation to engage the Sub-processors on the Sub-processor List.

7.2 **Notice of changes.** Manage.Management shall give at least 30 days' written notice before engaging any new or replacement Sub-processor. Notice will be given by email to the Customer's notices email address (or, if none is set, its account administrators), shown in the Platform under [Settings > Data protection](https://manage.management/settings?tab=data-protection), and published on the Trust Centre. Customers may also subscribe to updates through the Trust Centre.

7.3 **Objections.** The Customer may object on reasonable data protection grounds by writing to [legal@manage.management](mailto:legal@manage.management) within the notice period. The parties shall discuss the objection in good faith. If it is not resolved within 30 days of the objection, the Customer may terminate the affected subscription on written notice and receive a pro-rata refund of prepaid fees for the period after termination. That is the Customer's sole remedy for the objection.

7.4 **Flow-down.** Manage.Management shall engage each Sub-processor under a written contract that imposes data protection obligations giving at least the same level of protection as this DPA and Article 28(3) of the UK GDPR, including sufficient guarantees of appropriate technical and organisational measures.

7.5 **Responsibility.** Manage.Management remains fully liable to the Customer for each Sub-processor's performance of its data protection obligations.

7.6 **Integrations the Customer enables.** Third-party services that the Customer chooses to connect (such as MRI Qube, Xero, Microsoft 365, Checkatrade and payment services provided by Mollie under its own terms), although they appear on the Trust Centre for transparency, are not Sub-processors of Manage.Management. Data passed to them is transferred at the Customer's instruction, and the Customer's own contract with that provider governs their processing.

## 8. International transfers

8.1 Customer Personal Data in the Platform database, uploaded files and their backups is hosted in the United Kingdom (London).

8.2 Manage.Management shall make a Restricted Transfer only to the Sub-processors and locations on the Sub-processor List, and only where:

- (a) the transfer is made under a valid transfer mechanism, such as the ICO's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified; and
- (b) Manage.Management has, acting reasonably and proportionately, assessed that the data protection test in the UK GDPR is met, so that the standard of protection for Data Subjects after the transfer will not be materially lower than under UK law.

8.3 The Customer authorises the Restricted Transfers described in the Sub-processor List. Manage.Management shall provide a copy of the relevant transfer mechanism (redacted for commercial terms) on request.

## 9. Data Subject rights and complaints

9.1 Manage.Management shall provide Platform tools that let the Customer find, export, correct, restrict and delete Customer Personal Data, to help the Customer respond to requests from Data Subjects.

9.2 If Manage.Management receives a request or complaint from a Data Subject about Customer Personal Data, it shall forward it to the Customer within 3 Business Days and shall not respond (other than to acknowledge receipt and refer the person to the Customer) unless the Customer instructs it to or the law requires it.

9.3 Manage.Management shall give the Customer reasonable assistance, taking account of the nature of the processing, with subject access and other rights requests and with complaints the Customer handles under section 164A of the Data Protection Act 2018.

## 10. Personal Data Breaches

10.1 Manage.Management shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2 The notice shall include, as far as it is then known: the nature of the breach, the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed to address it and reduce its effects; and a contact point for more information. Where not all information is available at once, Manage.Management shall provide it in phases without further undue delay.

10.3 Manage.Management shall take reasonable steps to contain and investigate the breach, keep a record of it, and cooperate with the Customer so it can meet its obligations under Articles 33 and 34 of the UK GDPR, including reporting to the ICO within 72 hours where required.

10.4 Manage.Management shall not notify the ICO or Data Subjects about a breach of Customer Personal Data on the Customer's behalf unless the Customer agrees in writing or the law requires it.

10.5 Notifying a Personal Data Breach is not an admission of fault or liability.

## 11. Impact assessments and consultation

Taking account of the nature of the processing and the information available to it, Manage.Management shall give the Customer reasonable assistance with data protection impact assessments and any prior consultation with the ICO that relate to the Customer's use of the Platform.

## 12. Information and audits

12.1 Manage.Management shall make available all information reasonably needed to demonstrate compliance with Article 28 of the UK GDPR and this DPA. This includes the Trust Centre, its Cyber Essentials certificate, a summary of its most recent penetration test, and answers to one reasonable security questionnaire per year.

12.2 If that information is not enough to demonstrate compliance, or the ICO requires it, or following a Personal Data Breach, the Customer (or an independent auditor it appoints who is bound by confidentiality and is not a competitor of Manage.Management) may carry out an audit or inspection. The Customer must:

- (a) give at least 30 days' written notice (or shorter notice where reasonable after a Personal Data Breach);
- (b) agree the scope, timing and duration in advance, during Business Hours and without access to other customers' data; and
- (c) not audit more than once in any 12-month period, unless after a Personal Data Breach or at the request of the ICO.

12.3 Each party bears its own costs of an audit, except that the Customer shall pay Manage.Management's reasonable costs for time spent beyond 2 days in any 12-month period, unless the audit reveals a material breach of this DPA by Manage.Management.

## 13. Return and deletion

13.1 On termination of the Terms, the Customer may export Customer Personal Data for 90 days from the effective date of termination, in CSV for structured data and in PDF and original file formats for documents. Manage.Management shall provide up to 3 hours of transfer support at no charge.

13.2 After the export window ends, or earlier if the Customer instructs in writing, Manage.Management shall securely delete or irreversibly anonymise all Customer Personal Data within 60 days and shall confirm deletion in writing. Copies in routine backups expire automatically within 7 days of deletion.

13.3 Manage.Management may keep Customer Personal Data only where UK law requires it. In that case it shall keep the data confidential, process it only for the purpose required by law, and delete it when no longer required.

## 14. Liability

14.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in clause 16 of the Terms, which apply to this DPA as if set out in it.

14.2 Nothing in this DPA limits either party's liability to Data Subjects under Article 82 of the UK GDPR or any liability that cannot be limited by law.

14.3 Each party is responsible for any fine or penalty imposed on it by the ICO.

## 15. Term, changes and governing law

15.1 This DPA continues for as long as Manage.Management processes Customer Personal Data, including during the export window and until deletion under clause 13.

15.2 Manage.Management may update this DPA in accordance with clause 19 of the Terms. A change required by Data Protection Legislation or by the ICO takes effect on the date stated in the notice. Each version will be dated, kept available at a fixed address, and the version a Customer has accepted will be shown in its account settings.

15.3 This DPA and any non-contractual obligations arising out of or in connection with it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

## Execution

Each party signs this DPA electronically. Typing a name and selecting Sign in the Platform has the same legal effect as a handwritten signature. The signed copy generated by the Platform includes the details below and a signature certificate.

|  | Manage.Management Limited (16619867) | Customer |
| --- | --- | --- |
| Legal name and company number | Manage.Management Limited, 16619867 | Completed at signing |
| Registered address | The Square, 10 Exeter Road, Bournemouth, England, BH2 5AN | Completed at signing |
| Capacity | Processor or Sub-processor | Controller, processor for clients, or both |
| Signatory name and title | Completed at publication | Completed at signing |
| Electronic signature | Completed at publication | Completed at signing |
| Date | Date of publication | Date of signing |

## Annex 1 — Details of processing

| Item | Details |
| --- | --- |
| **Subject matter** | Providing the Manage.Management residential building management platform to the Customer under the Terms. |
| **Duration** | The subscription term, plus the 90-day export window and up to 60 days for deletion (clause 13), and any longer period required by UK law. |
| **Nature of processing** | Hosting, storage, organisation, retrieval, display, transmission (including email, SMS and in-app messages), synchronisation with integrations the Customer enables, AI-assisted analysis of documents the Customer uploads (such as leases), backup, anonymisation and deletion. |
| **Purpose** | To let the Customer manage residential buildings and estates: resident and unit records, communications, document storage, maintenance and repairs, service charge and financial records, meetings and voting, governance and statutory consultation (such as Section 20), and building safety records. |
| **Categories of Data Subjects** | Leaseholders and homeowners; tenants, residents and other occupiers; shareholders and members of RMCs, RTM companies and commonhold associations; directors and company secretaries; landlords and freeholders; the Customer's staff and authorised users; contractors and suppliers (individual contact persons); emergency contacts; meeting attendees and correspondents. |
| **Types of Personal Data** | Names and contact details (email, phone, postal address); unit, lease and ownership details; role in the building's governance; service charge, ground rent and arrears records, invoices and payment references; maintenance reports, photographs and correspondence; meeting attendance, minutes and voting records; documents and notices; data synchronised from integrations the Customer enables (such as tenancy and contact data from MRI Qube); account and authentication identifiers needed to provide access. |
| **Special category and criminal offence data** | Not intended. May be uploaded by the Customer (for example health or mobility information for evacuation planning, or reports of antisocial or criminal behaviour). See clause 3.2. |
| **Frequency** | Continuous for the duration of the subscription. |

## Annex 2 — Technical and organisational measures

### Hosting and data separation

- Platform database, uploaded files and backups hosted in the UK (London, AWS eu-west-2, via Supabase).
- Building-level and organisation-level data separation enforced in the database using row level security.

### Encryption

- Encryption in transit using TLS 1.2 or higher, HTTPS only.
- Encryption at rest for the database (AES-256).
- Third-party integration credentials stored encrypted (Supabase Vault).

### Access control

- Role-based access in the Platform, so users see only the buildings and records their role allows.
- Passwordless sign-in (passkeys, email codes, or Google or Microsoft accounts), with optional authenticator-app two-factor authentication.
- Staff access to production systems on a least-privilege, need-to-know basis, with audit logging of sensitive operations.

### Application and network security

- Continuous code, dependency and cloud security scanning, and independent penetration testing (Aikido Security).
- Security headers and DDoS protection.

### Corporate and endpoint security

- Cyber Essentials certified.
- Protected company devices with compliance checks; no administrator accounts for day-to-day work.
- Named responsibility for security and privacy; staff confidentiality and data protection training.

### Resilience

- Automatic daily database backups kept for 7 days.
- Restore starts within 4 Business Hours of notification and completes within 1 Business Day (Terms clause 11).

### Incident response

- Documented incident response and breach notification process, with customer notification within 48 hours (clause 10).

### Analytics and monitoring

- Session recordings (PostHog) and error replays (Sentry) mask text and block media, and passwords are never captured. Both services are Sub-processors for any Customer Personal Data they receive.

## Annex 3 — Sub-processors at the date of this version

The live list is at [trust.manage.management/subprocessors](https://trust.manage.management/subprocessors) and prevails over this Annex once updated under clause 7.

| Sub-processor | Service | Customer Personal Data processed | Location (per Trust Centre) | Transfer safeguard |
| --- | --- | --- | --- | --- |
| Supabase (AWS) | Database, file storage, authentication, edge functions | All Customer Personal Data | United Kingdom (London, eu-west-2) | Not a Restricted Transfer |
| Google Workspace | Support email and internal collaboration | Customer Personal Data in support correspondence | United Kingdom | Not a Restricted Transfer |
| 8x8 | Video meetings (Manage Meet) | Names, meeting audio and video, meeting metadata | United Kingdom (data centre nearest the first attendee, normally London) | Not a Restricted Transfer for UK meetings |
| PostHog | Product analytics, session recordings, in-app support chat | Account identifiers and any Customer Personal Data shown in masked recordings or chat | Germany | UK adequacy regulations (EEA) |
| Sentry | Error monitoring and masked error replays | Limited data in error reports | Germany | UK adequacy regulations (EEA) |
| Prelude | SMS and WhatsApp verification and notifications | Phone numbers, message content | France (EU hosting) | UK adequacy regulations (EEA) |
| Pingen | Printing and posting letters | Recipient names and addresses, letter content | Switzerland | UK adequacy regulations (Switzerland) |
| Netlify | Application hosting and delivery | Data passing through requests; request logs | United States | Provider DPA with a UK transfer mechanism |
| Resend | Transactional email delivery | Recipient names and emails, email content, email logs | United States | Provider DPA with a UK transfer mechanism |
| Mapbox | Maps and address lookup | Building addresses | United States | Provider DPA with a UK transfer mechanism |
| Google (Gemini API) | AI-assisted document analysis and drafting | Content of documents and transcripts submitted for analysis | Google global infrastructure | Google Data Processing Addendum with a UK transfer mechanism |
| Microsoft Azure | IT infrastructure | [Location to be added to the Trust Centre before publication] | [Per Trust Centre] | [Per Trust Centre] |

### On the Trust Centre but not Sub-processors of Customer Personal Data:

- **Connected at the Customer's choice** (clause 7.6): MRI Software, Xero, Microsoft 365 (Graph), Checkatrade, Mollie.
- **Used by Manage.Management as a Controller** (for its own sales, sign-in or operations): Attio, LinkedIn Sales Navigator, Microsoft Entra ID.
- **No access to Customer Personal Data:** Aikido Security (penetration tests use test accounts), GitHub, Sprinto, CyberSmart, Instatus, Netlify Status, Sanity.io, Mintlify, Arcade.

Made in Bournemouth with <3 for homeowners across the UK