INAGRO

Data processing agreement

Part of the INAGRO terms of service. Last updated 12 October 2026.

This agreement applies when TRG Limited (“processor”) processes personal data on behalf of a business using INAGRO (“controller”), as required by Article 28 of the UK GDPR.

1. Details of the processing

Subject matter and durationProviding INAGRO to the controller, for as long as the controller has an account.
Nature and purposeStoring and organising records; scheduling; sending and receiving messages with clients (including by AI); invoicing and payment collection; bookkeeping and pay calculations.
Data subjectsThe controller’s clients and prospective clients, and its staff.
Types of personal dataNames, phone numbers, email addresses, property addresses and access notes (including key-safe codes, encrypted), booking and visit history, messages, invoices and payments, photos taken at properties, staff pay rates and hours.
Special category dataNone intended. The controller should not enter health or other special category data.

2. The processor’s obligations

  1. Process personal data only on the controller’s documented instructions (these terms and the controller’s use of INAGRO), unless the law requires otherwise, in which case the processor will tell the controller unless the law forbids it.
  2. Ensure people authorised to process the data are bound by confidentiality.
  3. Take appropriate technical and organisational security measures, including tenant isolation at database level, encryption of access codes, hashed passwords, access controls and activity logging.
  4. Only use sub-processors under a written contract with equivalent data protection obligations. The controller authorises the categories of sub-processor listed below. The processor will give notice of new sub-processors, and the controller may object on reasonable grounds.
  5. Help the controller respond to requests from data subjects exercising their rights, including through the export and deletion tools in INAGRO.
  6. Help the controller with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the nature of the processing.
  7. Notify the controller without undue delay after becoming aware of a personal data breach affecting the controller’s data.
  8. At the end of the service, delete the controller’s personal data (the controller can export it first), unless the law requires it to be kept.
  9. Make available information needed to demonstrate compliance with this agreement, and allow for reasonable audits.
  10. Only transfer personal data outside the UK with appropriate safeguards under UK data protection law.

3. The controller’s obligations

The controller is responsible for having a lawful basis for the personal data it enters, for giving its clients and staff the information required by law (for example in its own privacy notice), and for obtaining consent where required, including for marketing messages.

4. Sub-processor categories

CategoryPurpose
Cloud hosting and databaseRunning the service and storing data
Text message and WhatsApp providersSending and receiving client messages
AI model providerUnderstanding and replying to client messages (the AI receptionist)
Card and Direct Debit payment providersCollecting payments from the controller’s clients
Email providerSending account and service emails

The current list of named sub-processors is available on request from [email protected].