Data Processing Agreement

LevyBoard (Crocker Digital Ltd) — the customer-facing Data Processing Agreement for leaseholder personal data.

Last updated: 3 November 2026

This Data Processing Agreement (the "DPA") is entered into between:

Crocker Digital Ltd, company number 17008789, registered in England and Wales, trading as LevyBoard (the "Processor", "we", "us"); and
the customer — the residents management company, right to manage company or other landlord entity that holds a LevyBoard subscription (the "Customer", "you").

It forms part of, and is incorporated into, the Terms of Service. Where this DPA and the Terms of Service conflict on a matter of personal data, this DPA prevails.

Why this DPA exists, and who is the controller of what

This is worth stating plainly, because the answer is not the same for all the data in the product.

Your company's own account data — the names and email addresses of the directors who sign in, and your billing details. For this, Crocker Digital Ltd is the controller. It is covered by the Privacy Policy, not by this DPA.
Leaseholder data — the names, correspondence addresses, apportionment percentages, demand amounts, payments and arrears balances of the leaseholders at your development. For this, your company is the controller and we are the processor. You decide whose data goes in, what it is used for, and what the leases require. We process it on your instructions and for no other purpose. This DPA governs that relationship.

Your company is the controller of leaseholder data whether or not it has ever thought of itself that way. An RMC or RTM company that issues service charge demands is processing personal data for its own purposes under the leases and the Landlord and Tenant Act 1985 and 1987, and it holds those obligations independently of us.

1. Interpretation

1.1 In this DPA:

"Data Protection Laws" — the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case as amended or replaced.

"controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR.

"Customer Personal Data" — personal data contained in or accessible through the LevyBoard service which we process on your behalf, described in Schedule 1.

"Restricted Transfer" — a transfer of Customer Personal Data to a recipient established outside the UK to which Chapter V of the UK GDPR applies. Whether a transfer is a Restricted Transfer depends on where the recipient is established, not where its servers are.

"Schedule 3" — the list of approved sub-processors referred to in clause 5.

"Standard Contractual Clauses" — the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018 on 2 February 2022, or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued on the same date, in each case as updated from time to time.

1.2 References to "writing" include email.

2. Subject matter, nature, purpose and duration

2.1 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Schedule 1.

2.2 The processing lasts for the term of your subscription, and afterwards only for the periods set out in clause 9 and in the Retention and Deletion Statement.

3. Roles of the parties

3.1 In respect of Customer Personal Data, you are the controller and we are the processor.

3.2 You warrant that you have a lawful basis for the processing you instruct, that the leases or your statutory obligations support it, and that any information you are required to give leaseholders about it has been given.

3.3 We warrant that we will process Customer Personal Data only on your documented instructions, unless required to do otherwise by law — in which case we will tell you before processing, unless the law forbids us from telling you.

3.4 Your use of the LevyBoard service in accordance with the Terms of Service is a documented instruction for the purposes of clause 3.3.

4. Processor obligations (UK GDPR Article 28(3))

We shall:

(a) process Customer Personal Data only on your documented instructions (Art 28(3)(a));

(b) ensure that people authorised to process Customer Personal Data are under an appropriate duty of confidence (Art 28(3)(b));

(d) engage sub-processors only in accordance with clause 5 (Art 28(3)(d));

(e) taking into account the nature of the processing, assist you by appropriate technical and organisational measures in responding to data subject requests (Art 28(3)(e)) — see clause 8;

(f) assist you in complying with Articles 32 to 36, taking into account the nature of processing and the information available to us (Art 28(3)(f));

(g) at your choice delete or return Customer Personal Data at the end of the service, subject to clause 9 (Art 28(3)(g));

(h) make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits under clause 10 (Art 28(3)(h)).

5. Sub-processors

5.1 You grant us a general authorisation to engage the sub-processors listed in Schedule 3, and those currently listed at https://levyboard.co.uk/legal/subprocessors/, which forms part of Schedule 3 by reference.

5.2 We shall:

(a) impose on each sub-processor, by written contract, data-protection obligations substantially equivalent to those in this DPA;

(b) remain liable to you for the performance of each sub-processor's obligations;

(c) give at least 30 days' prior notice of the addition or replacement of a sub-processor, by email to your registered billing contact and by updating the public sub-processor list.

5.3 If you have a reasonable, data-protection-based objection to a new sub-processor, tell us within 14 days of the notice. We will work with you in good faith to resolve it. If it is not resolved within a further 30 days, you may terminate without penalty and we will refund any pre-paid but unused part of your subscription.

6. International transfers

6.1 Customer Personal Data is stored in the United Kingdom — the Supabase project backing LevyBoard is in the eu-west-2 (London) region.

6.2 Where we rely on the Standard Contractual Clauses for a Restricted Transfer in support of the service, you authorise us to enter into them on your behalf as exporter. The current Restricted Transfers are identified in Schedule 3.

6.3 Schedule 3 states, for each sub-processor, the entity we contract with and the transfer mechanism we rely on. Where the mechanism is UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for a US sub-processor whose certification is active and covers the data transferred), no transfer risk assessment is required; we check at least annually that the certification remains active. Where we rely on appropriate safeguards under Article 46 UK GDPR — currently only for Supabase Pte. Ltd., under the UK Addendum (one of the Standard Contractual Clauses defined in clause 1.1) — we will complete a transfer risk assessment (the data protection test in Article 46(6) UK GDPR) by 30 November 2026 and review it at least annually. A summary of any such assessment is available to you on reasonable request.

7. Personal data breach

7.1 We will notify you without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting Customer Personal Data.

7.2 The notification will describe, so far as we know it: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

7.3 We will not make any public statement identifying you in connection with a breach without your prior written agreement, unless required by law.

7.4 Reporting to the ICO is yours, not ours. As controller, your company decides whether the breach must be reported to the Information Commissioner under Article 33 and whether affected leaseholders must be told under Article 34. We will give you what you need to make that decision within the 72-hour window.

Report a suspected breach or a security issue to security@levyboard.co.uk. See the Security Statement.

8. Data subject requests

8.1 If a leaseholder contacts us directly with a request under Articles 15 to 22, we will not respond substantively. We will tell them to contact your company and, where we can identify the account, tell you.

8.2 The product gives you the tools to answer most requests yourself without asking us: every record is visible in the application, and a full export of your organisation's data is available from your account settings.

8.3 ⛔ One request cannot be satisfied in full, and you should know this before you receive one. An issued service charge demand, Section 20 notice or section 48 notice contains the leaseholder's name and correspondence address, where you have recorded them, because each is by its nature addressed to the leaseholder concerned — and the document is the evidence of what you sent. ⚠️ To be precise about the statute, because an earlier version of this clause was not: section 47 of the Landlord and Tenant Act 1987 requires the landlord's name and address on a written demand and, where that address is outside England and Wales, an England-and-Wales address at which notices may be served on the landlord; section 48 separately requires the landlord to give each tenant, by notice, an England-and-Wales address for service. Neither imposes any requirement about the tenant's name or address, and they are not the basis on which we retain leaseholder detail. Those issued documents are retained and later anonymised, never deleted on request. The lawful basis is Article 6(1)(f), for the establishment and defence of legal claims. The limitation period on a contractual claim under a lease runs to six years, or twelve years where the lease is executed as a deed; the seven-year window is the six-year period plus a year's margin, and we have deliberately chosen not to hold leaseholder-identifying detail for the full twelve, because doing so would not be proportionate. In a deed case that means the anonymised record outlasts the identifying detail. Everything else about that leaseholder is erasable. The full position is in the Retention and Deletion Statement.

9. Return and deletion

9.1 You can export your organisation's data at any time from your account settings, in a machine-readable format.

9.2 On termination, you may ask us to delete your organisation's data. Deletion removes developments, units, apportionments, budgets, ledger entries, demands, payments and consultations.

9.3 The exception in clause 8.3 applies: issued documents survive, with every identifier removed. Deleting the organisation anonymises them at that point rather than at the seven-year mark — the identifying columns are stripped in the same transaction as the deletion and the rendered files are destroyed on the next scheduled sweep; documents belonging to a live organisation are anonymised seven years after issue. What survives either way is the record, its hash, the statutory-text version and the elements asserted. This is a deliberate design choice and it is enforced by the database rather than by policy — those records cannot be updated or deleted by us either.

9.4 Backups age out on our hosting provider's own cycle. A deletion is effected immediately in the live database and in backups as they roll.

10. Audit

10.1 We will make available the information reasonably necessary to demonstrate compliance with Article 28, including this DPA, the Security Statement, and the sub-processor list.

10.2 You may audit our compliance no more than once in any 12-month period, on 30 days' written notice, during business hours, subject to confidentiality, and at your own cost — save where the audit reveals a material breach, in which case we bear the reasonable cost.

10.3 We may satisfy an audit request by providing a recent third-party report or completed security questionnaire where that reasonably answers the request.

11. Liability

11.1 Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, save that nothing limits any liability that cannot lawfully be limited, including under Article 82 of the UK GDPR.

12. General

12.1 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

12.2 If a provision is held invalid, the rest continues in force.

12.3 We may update this DPA to reflect changes in law or in the service. Material changes are notified by email to your registered billing contact at least 30 days before they take effect.

Schedule 1 — Processing description (UK GDPR Art 28(3))


Subject matter	Provision of the LevyBoard service — service charge budgeting, apportionment, demand generation, payment and arrears tracking, Section 20 consultation workflow, and the fund ledger.
Duration	The term of the subscription, plus the retention periods in the Retention and Deletion Statement.
Nature and purpose	Storage, calculation, document generation, transmission of documents to you, and retention as evidence of issue.
Types of personal data	Leaseholder name; correspondence address; unit reference; apportionment percentage; demand amounts; payment and arrears balances; any free-text notes you record. Director name and email address for the users you invite to your account.
Categories of data subject	Leaseholders and tenants at your development; directors and officers of your company; any third party you name in a record.
Special category data	None is requested and none is required. The product has no field for health, ethnicity, religion or any other Article 9 category. Free-text fields should not be used to record them.
Children's data	Not knowingly processed.

Schedule 2 — Technical and organisational measures (UK GDPR Art 32)

Measure	What is in place
Tenant isolation	Row-level security in the database on every table holding customer data, keyed to organisation membership. One block's records are not reachable from another account, and this is enforced by the database rather than by application code.
Encryption	TLS in transit. Encryption at rest for the database and for stored document files.
Access control	Role-based access within your organisation — owner, director, viewer. (An accountant is given access as a viewer: read and export only. There is no separate accountant role.) Administrative access on our side is limited to the founder, over authenticated channels, and is recorded in the audit log.
Append-only evidence	Issued documents and the audit log cannot be modified or deleted by anyone, including us. This is enforced by database privileges, not by policy.
Document integrity	Every issued document is stored with a SHA-256 hash, the version of the statutory text it was built from, and the storage object version. The hash is recorded when the document is issued and the record is immutable thereafter, enforced by database privilege rather than by policy, so a stored document can be checked against it at any time.
Audit logging	Every write to money, apportionment or an issued document records who, what, when and the prior value. Visible to you in the application.
Rate limiting	Applied to authentication and to mutating endpoints.
Error monitoring	Errors are reported to our monitoring provider. Before an error report is sent, our code removes the values of a fixed list of fields that hold personal data (such as leaseholder names, correspondence addresses and email addresses) and keeps no details of the signed-in user except an internal ID. It does not search free text, such as the wording of an error message, for personal data: there it removes only sign-in codes and tokens carried in web addresses, so a name or email address written into an error message could still be sent. The provider removes IP addresses and location data on receipt and does not store them.
Backups	Daily managed backups of the database.
Pseudonymisation on erasure	On an erasure request the actor identity in the audit log is anonymised, including inside recorded prior and new values, rather than the record being destroyed.
Segregation of duties	Payment card data never reaches our systems. Stripe handles it, and we store only a customer and subscription reference.

Schedule 3 — Approved sub-processors

The current sub-processor list is maintained at https://levyboard.co.uk/legal/subprocessors/ — that page is the single source of truth. Our commitment to 30 days' notice of a change is in clause 5.2(c).

As at the date of this DPA the sub-processors are:

Sub-processor	Legal entity	Purpose	Region	Transfer mechanism
Supabase	Supabase Pte. Ltd. (Singapore)	Database, authentication, and storage of issued demand and notice files	United Kingdom — `eu-west-2` (London)	UK Addendum to the EU SCCs (Supabase DPA Schedule 2 §2). The transfer risk assessment it requires (Art 46(1A) UK GDPR) will be completed by 30 November 2026 (see clause 6.3).
Stripe	Stripe Payments Europe, Limited (Dublin — EU contracting entity)	Payments and subscription billing	EU (Ireland) primary; US for group support operations	UK adequacy regulations (EEA) for Stripe Payments Europe, Limited; UK Extension to the EU-US Data Privacy Framework for Stripe, LLC (Stripe Data Transfers Addendum §2–3).
Resend	Plus Five Five, Inc. (US)	Transactional and lifecycle email sent from `mail.levyboard.co.uk`	United States (account data, email content and metadata, delivery logs); sending region Ireland (`eu-west-1`)	UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Plus Five Five, Inc.'s certification is active and covers non-HR data. Resend DPA §11 (Data Privacy Framework), with the UK Addendum for any transfer it does not cover (§6.4).
Microsoft 365	Microsoft Ireland Operations Limited	Inbound support and data-subject-request mailbox at `support@levyboard.co.uk`	United Kingdom	UK adequacy regulations (EEA).
Sentry	Functional Software, Inc. (US)	Error monitoring. Before an error report is sent, our code removes the values of a fixed list of fields that hold personal data (such as leaseholder names, correspondence addresses and email addresses) and keeps no details of the signed-in user except an internal ID. It does not search free text, such as the wording of an error message, for personal data: there it removes only sign-in codes and tokens carried in web addresses, so a name or email address written into an error message could still be sent. Sentry removes IP addresses and location data on receipt and does not store them.	EU (de.sentry.io)	UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Functional Software, Inc.'s certification is active and covers non-HR data. The Sentry DPA (Schedule 3, Cross-Border Transfer Mechanisms) applies the Data Privacy Framework first, with the UK Addendum for any transfer it does not cover.
Upstash	Upstash, Inc. (US)	Rate limiting on most of the product's API routes, counted per organisation. Holds the organisation's internal account ID and a request counter — no customer records.	EU	UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Upstash, Inc.'s certification is active and covers HR and non-HR data. Upstash DPA §3.2(B)(1) applies the Data Privacy Framework first, with the UK Addendum for any transfer it does not cover (§3.2(B)(2)).
Netlify	Netlify, Inc. (US)	Hosting, edge functions, CDN, and DNS	US, with global edge	UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations, SI 2023/1028). Netlify, Inc.'s certification is active and covers non-HR data. Netlify DPA §14.2 applies the Data Privacy Framework first, with the UK Addendum for any transfer it does not cover (§14.4).

GoatCounter is used for website analytics and is deliberately not in this table: it sets no cookies, collects no personal data and holds no Customer Personal Data, so it is not a sub-processor of it. It is disclosed on the sub-processors page and in the Cookie Policy so that the absence is stated rather than assumed.