You are the controller. We are the processor.

The roles

The agency is the data controller for its contacts, applicants, tenants and landlords. Vitae AI Ltd is the processor. That split determines who answers a subject access request and who is accountable to the ICO.

What is agreed before implementation

Scope and purpose of processing, categories of data and data subjects, retention periods, hosting region, sub-processors, security measures, breach notification, audit rights, and what happens to the data on exit.

The controls behind it

Permissions, hosting, audit logging and data retention are agreed during discovery and documented before implementation. These are the platform capabilities that make those terms enforceable rather than aspirational.

Role based permissions

Who can see and act on what, per branch and per role. A negotiator does not inherit an owner view because nobody got round to restricting it.

Audit history

Every action attributed and time stamped: who approved a repair, when, and against which evidence. This is what answers a dispute a year later.

Data retention controls

How long each category of record is kept and what happens when that period ends, set for your agency rather than left on a platform default.

Hosting and DPA reviewed

Hosting region and the processing agreement itself are reviewed with you and signed before implementation begins, not filed afterwards.

Sub-processors

Hosting, email delivery and any AI model provider are named in the agreement, with notice given before any addition so the agency can object.

Getting the DPA

The data processing agreement is issued as part of the implementation pack and reviewed with you before signature. It is a contract rather than a web page, so it is not published here.

Getting in touch

Write to privacy@agents-hq.com for any question about data, or to make a request under the UK GDPR. Requests are answered within one month.