Data processing agreement

The lender is the controller; Lendlogix Ltd is the processor. Processing covers applicants, borrowers, guarantors and lender staff, for the purpose of operating the lender's workspace, for the duration of the subscription.

We process personal data only on the lender's documented instructions, which include the configuration made in the workspace, unless required otherwise by law — in which case we notify the lender where permitted.

• Tenant isolation enforced by row-level security on every table, for staff and borrower access alike.
• Encryption in transit, and at rest for stored data and lender payment credentials.
• Role-based access: admin, underwriter, collections, viewer and borrower scopes.
• Audit logging of staff actions on applications, loans and arrears cases.
• Least-privilege access for our personnel, under confidentiality obligations.

We may appoint sub-processors under equivalent written terms, and remain responsible for their performance. Lenders are notified before a new sub-processor is added and may object on reasonable data-protection grounds.

We assist the lender with data subject requests, data protection impact assessments and regulator engagement, taking into account the nature of processing and the information available to us.

We notify the lender without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting their workspace, with the information needed for the lender's own reporting duties.

Data is stored in the UK/EU. Any transfer outside that area relies on an adequacy decision or the UK International Data Transfer Addendum to the EU standard contractual clauses.

On termination the lender may export its data for 30 days, after which we delete it from active systems and from backups on the normal backup rotation.

On reasonable notice, and no more than once a year unless required by a regulator, we provide the information needed to demonstrate compliance with these terms.

dpo@lendlogix.app — Lendlogix Ltd, company number 17323677, registered office 128 City Road, London, United Kingdom, EC1V 2NX.