Data Processing Agreement

1. Purpose of this Agreement

Sourcefolio provides software tools that allow users to manage property deal information, investor relationships, enquiries, workflows, investor portals and CRM records.

This DPA explains how personal data is processed when customers use Sourcefolio.

Sourcefolio provides technology infrastructure only.

Sourcefolio does not:

• determine why customers collect personal data;
• verify customer compliance;
• verify investment opportunities;
• verify deal information;
• provide financial, legal or investment advice;
• act as an investment intermediary.

2. Definitions

For the purposes of this DPA:

• Controller — means the person or organisation that determines why and how personal data is processed.
• Processor — means the organisation that processes personal data on behalf of the Controller.
• Personal Data — has the meaning given under UK GDPR.
• Customer Data — means information uploaded, submitted, stored or managed by the Customer through Sourcefolio.

3. Roles of the Parties

The Customer is the Data Controller of personal data uploaded into their Sourcefolio account.

Sourcefolio acts as the Data Processor.

The Customer decides:

• what information is collected;
• who information relates to;
• why information is collected;
• how information is used.

Sourcefolio processes Customer Data only to provide the Sourcefolio platform and related services.

4. Categories of Personal Data

Customer Data may include:

• names;
• email addresses;
• telephone numbers;
• investor preferences;
• enquiry information;
• CRM notes;
• communication records;
• business contact information;
• property-related information;
• documents uploaded by users.

Customers may also upload business documents such as:

• investor agreements;
• refurbishment agreements;
• property documents;
• commercial records.

5. Prohibited Information

Sourcefolio is not designed for storing highly sensitive personal information.

Customers must not upload or store:

• passport information;
• driving licences;
• identity documents;
• bank account information;
• payment card information;
• passwords;
• government identification numbers;
• medical information;
• special category personal data under UK GDPR.

If a Customer uploads prohibited information, they do so in breach of this DPA and accept responsibility for the consequences.

6. Customer Responsibilities

The Customer is responsible for ensuring that all personal data uploaded to Sourcefolio is processed lawfully.

The Customer must ensure:

• they have a lawful basis for processing personal data;
• they provide appropriate privacy notices where required;
• they have permission to contact investors, customers or other individuals;
• uploaded information is accurate where required;
• uploaded documents and images are used lawfully;
• they comply with applicable property, financial promotion, investment and business regulations.

Sourcefolio is not responsible for determining whether Customer Data has been collected lawfully.

7. CRM Responsibilities

Sourcefolio allows Customers to maintain their own CRM records.

Customers acknowledge that they are responsible for:

• information entered into their CRM;
• decisions made using CRM information;
• communications sent to contacts;
• managing their relationships with investors, suppliers, builders, solicitors and other contacts.

Sourcefolio does not review, approve or verify CRM information.

8. Investor Portals and Shared Information

Sourcefolio may allow Customers to create investor portals and share information through links.

The Customer is solely responsible for:

• deciding what information is shared;
• selecting recipients;
• controlling access;
• ensuring recipients are authorised;
• removing access where appropriate.

Sourcefolio is not responsible for:

• incorrect sharing by Customers;
• Customers sharing links with unauthorised persons;
• recipients misusing information;
• information being redistributed after lawful sharing.

9. Processing Instructions

The Customer instructs Sourcefolio to process personal data only for:

• providing platform functionality;
• storing CRM records;
• managing uploaded content;
• providing investor portal functionality;
• maintaining security;
• providing customer support;
• improving platform reliability.

Sourcefolio will not use Customer Data for unrelated purposes unless legally permitted or instructed by the Customer.

10. Security Measures

Sourcefolio implements reasonable technical and organisational measures designed to protect personal data.

These may include:

• account authentication controls;
• access restrictions;
• secure infrastructure providers;
• monitoring and maintenance procedures.

However, no online platform can guarantee absolute security.

The Customer acknowledges that:

• cyber attacks are an unavoidable risk of online services;
• third-party infrastructure may experience failures;
• no system is completely immune from vulnerabilities;
• internet transmission carries risks.

Sourcefolio does not guarantee that Customer Data will never be lost, unavailable, altered or accessed unlawfully.

To the maximum extent permitted by law, Sourcefolio shall not be responsible for security incidents caused by third-party providers, cyber attacks, malicious actors, Customer negligence, compromised Customer accounts, incorrect Customer configuration, or misuse of the platform.

11. Sub-processors

The Customer authorises Sourcefolio to use trusted third-party service providers required to operate the platform.

These may include:

• Lovable / Lovable Cloud;
• Stripe;
• Google Analytics;
• hosting providers;
• database providers;
• infrastructure providers.

Sourcefolio may update its list of sub-processors where required to maintain the Service.

Third-party providers may process information according to their own terms and privacy policies.

12. Data Breaches

If Sourcefolio becomes aware of a personal data breach affecting Customer Data, Sourcefolio will take reasonable steps required under applicable law.

The Customer remains responsible for determining:

• whether the breach affects their own customers or contacts;
• whether notifications are required;
• whether regulators or individuals must be informed.

13. Data Retention and Deletion

Sourcefolio retains Customer Data only for as long as reasonably necessary to provide the Service or meet legal obligations.

Upon account termination:

• Customers may request deletion of their data;
• Sourcefolio may remove or anonymise information where technically possible;
• backups may remain temporarily for operational and security purposes.

Backup deletion timelines may depend on third-party infrastructure providers.

14. International Transfers

Some service providers used by Sourcefolio may process data outside the United Kingdom. Where required, appropriate safeguards will be used in accordance with UK GDPR.

15. Audit and Compliance Information

Upon reasonable request, Sourcefolio may provide information regarding its data processing practices.

Customers are responsible for ensuring their own regulatory compliance, including any obligations relating to property sourcing, investment activities, financial promotions, and customer communications.

16. Liability and Responsibility

The Customer acknowledges that Sourcefolio provides software tools only.

Sourcefolio is not responsible for:

• Customer compliance failures;
• unlawful data collection by Customers;
• inaccurate Customer information;
• investment decisions made by Customers or their investors;
• misuse of CRM information;
• incorrect sharing of investor portal links.

Nothing in this DPA excludes liability that cannot legally be excluded.

17. Governing Law

This DPA is governed by the laws of England and Wales.

The courts of England and Wales shall have jurisdiction over disputes arising from this agreement.

18. Contact

For data protection enquiries:

Email: Chris@sourcefolio.uk

Support: Support@sourcefolio.uk