Data processing terms

These data processing terms form part of the Firm terms between Stamp Expert Limited ("Stamp") and each firm that uses Stamp ("the firm"). They set out how Stamp handles the firm's clients' personal data, both as the firm's processor and as a separate controller. Words defined in the firm terms have the same meaning here.

1. Our roles

1.1 Stamp as processor. When the firm sends Stamp a client's details to create and send a Stamp link (directly or through an integration), Stamp processes that data on the firm's behalf. The firm is the controller. Part A applies.

1.2 Stamp as controller. When the client accepts Stamp's client terms and starts the check, Stamp becomes an independent controller of the data needed to run the check, take payment, keep the record, handle any referral to the panel, and deal with complaints and claims. When Stamp sends the result and record to the firm, the firm receives them as an independent controller for its own file. Part B applies.

1.3 Panel advisers are independent controllers of the data they receive when a client instructs them.

1.4 Moving from processor to controller. The firm instructs Stamp that, once a client accepts Stamp's client terms and starts the check, Stamp may use the client's details received under Part A as an independent controller under Part B. The firm confirms it has a lawful basis to make that disclosure.

Part A: Stamp as the firm's processor

2. Details of the processing

• Subject matter: creating, sending and managing Stamp links for the firm's clients, and showing the firm the status of each check.
• Duration: while the firm terms apply, and then until the data is deleted or returned under section 9. If a client never starts the check, Stamp deletes the link data 12 months after the last activity on the link, in line with its privacy notice.
• Nature and purpose: receiving, storing, organising and sending data so the firm can send links and track checks.
• Types of personal data: client names, email addresses, mobile numbers, matter or case references and property addresses.
• Categories of data subject: the firm's clients (homebuyers). Stamp handles the firm's own users' details as a controller, under its privacy notice.
• Special category data: none expected. The firm must not send any.

3. Instructions

Stamp processes this data only on the firm's documented instructions, including these terms and the firm's use of the platform, unless the law requires otherwise. If so, Stamp will tell the firm first, unless the law prevents it. Stamp will tell the firm if it thinks an instruction breaks data protection law.

4. Confidentiality

Stamp makes sure that everyone who can access the data is bound to keep it confidential.

5. Security

Stamp takes appropriate technical and organisational measures to protect the data, as required by Article 32 of the UK GDPR. These include encryption in transit, access controls based on role, logging and backups.

6. Sub-processors

6.1 The firm gives Stamp general authorisation to use sub-processors in the categories set out in section 12, including those on the current list available on request.

6.2 Stamp will give at least 30 days' notice, by email to the firm's main contact, before adding or replacing a sub-processor, and will also update this page. The firm can object on reasonable data protection grounds within that time. If the objection can't be resolved, either party may end the firm terms.

6.3 Stamp puts data protection terms in place with each sub-processor that are at least as protective as these, and remains responsible to the firm for its sub-processors.

7. International transfers

Stamp transfers data outside the UK only with appropriate safeguards under UK data protection law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

8. Help for the firm

8.1 Stamp will help the firm, taking into account the nature of the processing, to:

• respond to requests from clients exercising their data protection rights
• deal with complaints from clients about the processing
• keep data secure, assess data protection impacts and consult the ICO, where relevant

8.2 Stamp will tell the firm without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the firm's data. It will give the firm the information it needs to meet its own duties.

9. End of processing

When the firm terms end, Stamp will delete the data it processes as the firm's processor within 90 days, or return it if the firm asks within 30 days, unless the law requires Stamp to keep it. This doesn't apply to data Stamp holds as a controller under Part B.

10. Audits and information

Stamp will give the firm the information reasonably needed to show compliance with these terms. It will allow audits (normally by written questionnaire, once a year at most) on reasonable notice. On-site audits happen only where a questionnaire isn't enough or the ICO requires one, and at the firm's cost.

Part B: Stamp as an independent controller

11. Each party's responsibilities

11.1 Each party is responsible for its own compliance with data protection law for the data it controls.

11.2 Stamp tells clients how it uses their data in its Privacy notice, and tells them their result and record will be shared with the firm that sent the link.

11.3 The firm will tell its clients that it uses Stamp, for example in its client care letter or privacy notice, and will keep results and records it receives secure and in line with its own retention policy.

11.4 If either party receives a request, complaint or regulator enquiry that concerns the other's processing, it will pass it on promptly and give reasonable help.

11.5 Each party will tell the other without undue delay about a personal data breach affecting shared data.

12. Sub-processors

Stamp uses sub-processors in these categories:

• Platform hosting and database: hosts the Stamp platform and the link data.
• Email and text-message services: send Stamp links and status messages.
• Error logging and monitoring, where used: finds and fixes faults.
• Google (Google Workspace): email and documents for support. Location: UK, EU and US. Safeguard: UK adequacy (Data Privacy Framework) or the ICO's Addendum.

The current list of named sub-processors, with their locations and transfer safeguards, is available to firms on request from privacy@stamp.expert. This section was last changed on 11 November 2026.