Data Processing Agreement
Version 1.1 · November 2026. This agreement forms part of the Terms of Service between Wildstone Enterprises Ltd (company number 17090475, registered office 78 Glasshouse Lane, Exeter, EX2 7BZ), trading as Deal Foundry by Wild Stone (the Processor), and each Subscriber (the Controller). It meets the requirements of Article 28 of UK GDPR.
1. Roles
1.1 When a Controller puts personal data about other people on Deal Foundry, such as investors, vendors, agents or contractors, the Controller decides why and how that data is used. Deal Foundry processes it only to provide the platform.
1.2 Deal Foundry is a separate controller for account, billing and security data, as described in its Privacy Policy.
1.3 When a Marketplace Investor enquires about a Controller's deal or messages them, Deal Foundry passes that investor's details to the Controller at the investor's request. From then on, the Controller holds them as its own controller data under this agreement.
2. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Hosting and processing Controller data to provide the Deal Foundry platform |
| Duration | The length of the subscription, plus the export and deletion period in section 9 |
| Nature and purpose | Storing, organising, displaying, matching, sharing with people the Controller chooses, sending emails the Controller asks for (such as deal emails and progress updates), backing up and deleting |
| People whose data is processed | Investors, prospective investors, vendors, agents, contractors and other contacts of the Controller |
| Types of data | Names, contact details, investment criteria and budgets, deal history, agreement and fee records, AML status and review dates, leads (agent and property owner names, contact details, reasons for selling and notes), viewing notes, messages with investors, progress updates sent to investors, and notes and documents the Controller uploads |
| Special category or criminal data | Not intended. Controllers must not upload it unless they have a lawful basis and it is necessary |
3. Controller responsibilities
The Controller confirms that:
- it has a lawful basis for every piece of personal data it puts on the platform,
- it has told the people concerned, for example through its own privacy notice,
- its instructions to Deal Foundry comply with data protection law,
- it will store identity documents in the platform only where necessary, and preferably keep only the result of an AML check.
4. Processor obligations
Deal Foundry will:
4.1 process the data only on the Controller's documented instructions, which are these terms and the Controller's use of the platform, unless the law requires otherwise, in which case it will tell the Controller unless the law forbids that;
4.2 make sure everyone authorised to process the data is bound by confidentiality;
4.3 keep the data secure with appropriate technical and organisational measures, as set out in section 6;
4.4 help the Controller respond to people exercising their data rights, including by providing export and deletion tools;
4.5 help the Controller with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the information available to Deal Foundry;
4.6 give the Controller the information needed to show compliance with this agreement, and allow reasonable audits, normally by providing written answers, certifications or test summaries, no more than once a year unless there has been a breach.
5. Sub-processors
5.1 The Controller gives general permission for Deal Foundry to use sub-processors. The current list is: Supabase (hosting, database, logins, file storage and encrypted backups, London region), IONOS (email delivery and website hosting), Credas (identity and AML checks, where a Subscriber uses them). E-signing is built into Deal Foundry and uses no third-party provider.
5.2 Deal Foundry will give at least 30 days' notice of a new sub-processor. If the Controller has a reasonable data protection objection, it may cancel its subscription before the change.
5.3 Deal Foundry will put contracts in place that give the same protection as this agreement and stays responsible for its sub-processors.
6. Security measures
- Encryption of data in transit and at rest
- Strict separation so each Controller can reach only its own data, enforced in the database
- Passwords of at least 10 characters, stored only in hashed form
- Access to production systems limited to named people, with logging
- Daily backups, encrypted, kept for at least 7 days
- Regular security reviews and testing
- A written incident response plan
7. Personal data breaches
Deal Foundry will tell the Controller without undue delay, and within 48 hours where possible, after becoming aware of a breach affecting the Controller's data. It will give the information the Controller needs to meet its own duty to report to the ICO within 72 hours where required.
8. International transfers
Deal Foundry stores data in the UK or the European Economic Area. It will not transfer data elsewhere unless it is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
9. End of the agreement
When the subscription ends, the Controller can export its data for 30 days. Deal Foundry will then delete it, including from backups within a further 30 days, unless the law requires it to be kept.
10. Liability and law
Liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow it. This agreement is governed by the law of England and Wales.