Data processing terms

Where Hammock processes personal data on your behalf it does so on the following terms.

1. Definitions
   1. In these terms:
      1. applicable law means applicable law of the United Kingdom (or of a part of the United Kingdom);
      2. Controller, Data Subject, International Organisation, Personal Data, Personal Data Breach, Processor and processing shall have the respective meanings given to them in applicable Data Protection Laws from time to time (and related expressions, including process, processed and processes shall be construed accordingly);
      3. Data Protection Laws means, as binding on either party or the Services:
         1. the UK GDPR;
         2. the Data Protection Act 2018; and
         3. any laws that supplement, replace, extend, re-enact, consolidate or amend any of the foregoing;
      4. UK GDPR means the General Data Protection Regulation, Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or of a part of the United Kingdom from time to time);
      5. Protected Data means Personal Data received from or on your behalf in connection with the performance of Hammock’s obligations under its agreement with you; and
      6. Sub-Processor means any processor engaged by Hammock (or by any other Sub-Processor) for carrying out any processing activities in respect of the Protected Data on your behalf.
2. Compliance with Data Protection Laws
   1. The parties agree that you are a Controller and Hammock is a Processor for the purposes of processing Protected Data pursuant to these terms. You will at all times comply with all Data Protection Laws in connection with the processing of Protected Data and ensure that all instructions given by you to Hammock in respect of Protected Data (including under these terms) shall at all times be in accordance with all Data Protection Laws.
   2. Hammock shall process Protected Data in compliance with the obligations placed on it under Data Protection Laws and these terms.
   3. Hammock’s platform does not specifically request or require special-category or criminal-offence data. However, you may choose to include such data in documents or free-text fields submitted to the platform. You are responsible for ensuring that its submission and processing are lawful including satisfying any applicable additional requirements for these categories of data
3. Instructions
   1. The parties agree:
      1. Hammock shall only process (and shall ensure that its personnel only process) the Protected Data in accordance these terms, except to the extent: 
         1. that alternative processing instructions are agreed between the parties in writing; or
         2. otherwise required by applicable law (and shall inform you of that legal requirement before processing, unless applicable law prevents it doing so on important grounds of public interest); and
      2. if Hammock believes that any instruction received by it from you is likely to infringe the Data Protection Laws it shall promptly inform you and be entitled to cease to provide the relevant Services until the parties have agreed appropriate amended instructions which are not infringing.
4. Security
   1. Hammock shall implement and maintain the technical and organisational measures set out in Part B of the schedule to protect the Protected Data against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure or access.
5. Sub-processing and personnel
   1. Hammock shall be entitled to permit processing of Protected Data by any Sub-Processor provided that it:
      1. ensures that such Sub-Processor is appointed under a binding written contract containing materially the same obligations as under these terms (including those relating to sufficient guarantees to implement appropriate technical and organisational measures) and ensure such Sub-Processor complies with all such obligations;
      2. remains fully liable to you for all the acts and omissions of each Sub-Processor as if they were its own; and
      3. ensures that all persons authorised by Hammock or any Sub-Processor to process Protected Data are subject to a binding written contractual obligation to keep the Protected Data confidential.
6. Assistance
   1. Hammock shall (at your cost and expense):
      1. assist you in ensuring compliance with your obligations pursuant to Articles 32 to 36 of the UK GDPR taking into account the nature of the processing and the information available to Hammock; and
      2. taking into account the nature of the processing, assist you (by appropriate technical and organisational measures), insofar as this is possible, for the fulfilment of your obligations to respond to requests for exercising the Data Subjects’ rights under Chapter III of the UK GDPR in respect of any Protected Data.
   2. Hammock shall promptly refer to you all requests it receives for exercising any Data Subjects’ rights under Chapter III of the UK GDPR which relate to any Protected Data. It shall be your responsibility to reply to all such requests as required by applicable law.
7. International transfers
   1. Hammock shall not process and/or transfer, or otherwise directly or indirectly disclose, any Protected Data in or to any country or territory outside the United Kingdom/European Union without ensuring that the protections required by law are in place.
8. Audits and processing
   1. Hammock shall, in accordance with Data Protection Laws, make available to you on request such information that is in its possession or control as is necessary to demonstrate Hammock’s compliance with the obligations placed on it under these terms and to demonstrate compliance with the obligations on each party imposed by Article 28 of the UK GDPR including, where reasonably required, an audit. To the extent consistent with the forgoing, Hammock shall be entitled to withhold information where it is commercially sensitive or confidential to it or its other customers.
9. Breach
   1. Hammock shall notify you without undue delay and in writing on becoming aware of any Personal Data Breach in respect of any Protected Data.
10. Deletion/return and survival
    1. On the end of the provision of the Services relating to the processing of Protected Data (Processing End Date), at your cost and expense and your option, Hammock shall either return all of the Protected Data to you or securely dispose of the Protected Data (and thereafter promptly delete all existing copies of it) except to the extent that any applicable law requires Hammock to store such Protected Data. If you have not notified Hammock within [thirty days] of the Processing End Date that you require the return of any Protected Data, Hammock is irrevocably authorised to securely dispose of the Protected Data.

 

The Schedule

DATA PROTECTION

Part A

Data processing details

Processing of the Protected Data by Hammock under these terms shall be for the subject-matter, duration, nature and purposes and involve the types of Personal Data and categories of Data Subjects set out in this Part A.

1. Subject-matter of processing:

Processing of Protected Data to provide Hammock’s property-finance, bookkeeping, reporting and tax-management Services to landlords and to accountants, partners and advisers acting for their landlord clients.

This includes accounts registered directly by landlords, accounts linked to an accountant, partner or adviser through authorisation or invitation, and accounts provisioned and operated by an accountant, partner or adviser on a landlord’s behalf, whether or not the landlord subsequently registers.

2. Duration of the processing:

For the duration of the Services and thereafter only as provided in the deletion/return provisions of these terms or as required by applicable law.

3. Nature and purpose of the processing:

Receiving and importing, recording, storing, organising, retrieving and updating Protected Data to provide the Services. Processing includes matching, categorising and reconciling financial transactions; maintaining property, ownership, tenancy, rent and accounting records; processing supporting documents; producing financial and tax reports; and enabling authorised access, sharing, export and deletion.

Where the relevant features are enabled and authorised, processing also includes bank-feed connections, document data extraction, service notifications, accounting integrations and submissions to HMRC, including Making Tax Digital.

4. Type of Personal Data:

Depending on the Services used: names, contact details and dates of birth where supplied; property addresses and ownership interests; tenancy details, rent, deposits and arrears; bank-account identifiers, balances and transaction details, including payment references, descriptions and counterparty information; income, expenditure, accounting and tax records, including National Insurance numbers and other tax identifiers where relevant; personal information contained in supporting documents, receipts, statements and notes supplied for the Services; and user permissions and activity records associated with the processing of those records.  

5. Categories of Data Subjects:

Landlords and property owners, including joint and beneficial owners; tenants and occupiers; accountants, letting agents and other authorised users; and individual suppliers, contractors, payers, payees and business representatives whose personal information is included in the records processed on your behalf.

6. Specific processing instructions:

You instruct Hammock to process Protected Data to provide the Services described in this Part A, including authorised imports, calculations, reports, document processing, notifications, shared access, integrations and HMRC submissions, and to maintain the security, availability and recoverability of that data.

Instructions may be given by you or persons authorised to act on your behalf, including an appointed accountant, partner or adviser and their authorised team members, within the permissions and authorisations applicable to the account and relevant service. Protected Data shall be returned or deleted in accordance with these terms. Additional or alternative processing instructions must be agreed in writing.

Part B

Technical and organisational security measures

Hammock shall implement and maintain the following technical and organisational security measures to protect the Protected Data:

1. Access control: Named user accounts, role-based permissions and application controls restricting access to the relevant landlord, client and property records. Accountant, partner and adviser access is governed by the account’s authorised relationships and user permissions. Privileged access is approved, restricted to operational need, reviewed and revoked when no longer required.

2. Authentication: Passwords are stored using one-way hashing, with account lockout following repeated unsuccessful sign-in attempts. Multi-factor authentication is required for Hammock production administration. Customer accounts support app-based or SMS two-factor authentication, with team-level enforcement controls.

3. Encryption: TLS 1.2 or TLS 1.3 protects data in transit. Production database, object and block storage use AES-256 encryption. Backups are encrypted, with keys managed through AWS service-managed encryption and key-management controls.

4. Infrastructure and endpoint protection: AWS access controls and network restrictions, Cloudflare web-application firewall and DDoS protection, and controlled remote administration through Zero Trust access. Production administration uses managed, disk-encrypted devices. Development, testing and production environments are separated.

5. Logging and monitoring: Security and application logs record authentication events, authorised shared access and relevant administrative and data-change events, with attributable user identities. Security events are monitored and investigated under documented procedures.

6. Backup and recovery: Automated encrypted backups, geographically separate recovery copies, restricted access to recovery data and monitoring of backup jobs. Documented recovery procedures are supported by quarterly representative restore tests and an annual end-to-end recovery exercise.

7. Development and technical assurance: Peer review, testing and controlled production releases; monthly vulnerability assessments and assessments following significant changes; and annual independent penetration testing of the internet-facing application and external service boundary. Remediation is prioritised and tracked according to risk.

8. Organisational controls: Documented information-security policies, personnel confidentiality obligations, security and data-protection training on joining and at least annually, risk-based supplier assurance and contractual security requirements, and documented incident-response procedures. Security measures and supporting policies are reviewed regularly, including through external review, and updated to reflect changes to the service and relevant risks.

9. Data handling: Authorised procedures for retrieving, correcting, exporting and deleting Protected Data in accordance with these terms.

 

Last updated: 9th November 2026