Licence Applications Data Sharing Agreement
Last Updated 20th October 2026
Background
(A) Kamma provides licence application services to the Customer under Section 24 of the Kamma Subscriber Terms and Conditions (the “Subscriber Terms”). Kamma also provides property licensing compliance services, for which it acts as the Customer’s processor under clause 28 of the Subscriber Terms; that processing is not covered by this Agreement.
(B) In providing the licence application services the parties share personal data with one another, each acting as an independent controller.
(C) Clause 11.6 of the Subscriber Terms incorporates this Agreement into the Contract, and clause 22.1 of the Subscriber Terms governs its variation.
(D) This Agreement has been prepared having regard to the Information Commissioner’s statutory Data Sharing Code of Practice.
1. Parties, roles and status
- 1.1. This Agreement is between Kamma and the Customer, each as defined in the Subscriber Terms.
- 1.2. The parties are independent controllers in respect of the Shared Data. They are not joint controllers. Each determines its own purposes and means of processing, and each is separately responsible for its own compliance with Data Protection Laws.
- 1.3. Where Kamma provides the licence application services under Section 24 of the Subscriber Terms, the parties acknowledge that Kamma, the Agent (where instructed) and the Landlord each act as independent controllers, and that the relevant local housing authority acts as a separate controller in its own right.
- 1.4. Nothing in this Agreement makes either party a processor for the other. Neither party processes Shared Data on the other’s documented instructions. Where Kamma processes personal data on the Customer’s behalf for the Subscription Services, clause 28 of the Subscriber Terms applies instead of this Agreement. Personal data becomes Shared Data at the point the Customer instructs an Application in respect of it, and Kamma will record that point. Erasure of the Customer's platform copy does not require erasure of the Application record retained under clause 9.3.
- 1.5. Words and expressions defined in the Subscriber Terms have the same meaning in this Agreement unless otherwise stated. References in this Agreement to “this Agreement” are to this Data Sharing Agreement, as varied from time to time in accordance with clause 22.1 of the Subscriber Terms, and not to the Contract as a whole. “Shared Data” means the personal data shared between the parties as described in clause 3 and Annex A.
- 1.6. This Agreement does not replace the Subscriber Terms. In the event of conflict, this Agreement prevails on matters of data protection, and the Subscriber Terms prevail on all other matters, including the variation of this Agreement.
- 1.7. This Agreement forms part of the Contract under clause 11.6 of the Subscriber Terms and continues for so long as the Subscriber Terms remain in force, subject to clause 18.
2. Purpose of the sharing
- 2.1. The parties share personal data for the following purposes, and for no others:
- (a) Licence Application Services. Where instructed under Section 24, to enable Kamma to prepare and submit licence applications to the relevant local housing authority on behalf of a Landlord, and to correspond with that authority in connection with those applications.
- 2.2. The sharing is necessary for those purposes because an application to a local housing authority cannot be made without identifying the proposed licence holder.
- 2.3. The benefit to individuals is that landlords and managing agents are able to identify and discharge their statutory licensing obligations, and tenants occupy properties that are correctly licensed. Failure to license carries criminal liability and rent repayment orders for the landlord, and removes tenant protections.
- 2.4. Neither party will use Shared Data for any purpose incompatible with those set out above. In particular, neither party will use Shared Data for direct marketing to data subjects of the other party without a separate lawful basis and its own transparency provision.
3. What is shared
- 3.1. The categories of personal data shared are set out in Annex A. The parties will not share personal data outside those categories without first amending this Agreement.
- 3.2. Each party will share only the minimum personal data necessary for the relevant purpose. The Customer will not upload or disclose to Kamma personal data that is not required for an Application.
- 3.3. No authority currently requires special category data as defined in Article 9 of the UK GDPR as part of an Application. Kamma will not require, and the Customer will not supply, special category data. If an authority introduces such a requirement, the parties will amend this Agreement before any such data is shared, and an Article 9 condition and appropriate policy document will be required in addition to the conditions in clause 5.
4. Lawful bases
- 4.1. Each party is responsible for identifying and documenting its own lawful basis. The parties record their respective positions as follows.
- 4.2. Kamma maintains a documented legitimate interests assessment for the processing under this Agreement for which it relies on Article 6(1)(f) UK GDPR.
- 4.3. Kamma relies on legitimate interests under Article 6(1)(f) for the Licence Application Services, those interests being the provision of an administrative service enabling landlords to discharge statutory obligations. Where a Landlord instructs Kamma directly, Kamma may alternatively rely on Article 6(1)(b), performance of a contract.
- 4.4. The Customer is responsible for identifying its own lawful basis for disclosing personal data to Kamma, and confirms that it has one. Where the Customer is a managing agent disclosing a Landlord’s personal data, the Customer confirms it is authorised to do so and that its lawful basis extends to that disclosure.
- 4.5. Neither party relies on consent as its Article 6 lawful basis for the sharing described in this Agreement. Consent is relied on separately as the Schedule 1 condition for criminal offence data under clause 5, which is a distinct requirement. The model consent wording is at Annex D.
5. Criminal offence data
- 5.1. Certain local housing authorities require, as part of a licence application, a declaration as to the suitability of the proposed licence holder and manager, and in some cases documentary evidence of criminal record checks. Both constitute criminal offence data under Article 10 of the UK GDPR. A criminal record check falls within Article 10 even where it reveals no convictions.
- 5.2. Kamma does not verify, assess or carry out any independent check of that information. Kamma receives it from the Customer or the Landlord, transmits it to the relevant authority, and deletes it in accordance with clause 9.2. The assessment of suitability is a matter for the authority alone.
- 5.3. Kamma does not process criminal offence data under the control of official authority. The statutory functions under Parts 2 and 3 of the Housing Act 2004 are conferred on the local housing authority, not on Kamma. Kamma therefore requires a condition in Schedule 1 to the Data Protection Act 2018.
- 5.4. Kamma relies on the condition in paragraph 29 of Schedule 1 (consent). The Landlord consents to Kamma processing criminal offence data for the sole purpose of preparing and submitting the Application to the relevant authority.
- 5.5. The parties record the basis on which that condition is considered available:
- (a) the Licence Application Service is genuinely optional for the Landlord, who may apply directly to the authority or instruct another provider;
- (b) the processing of criminal offence data is objectively necessary to perform that service, because the authority will not determine an application without it;
- (c) Kamma is not in a position of power over the Landlord, is not the Landlord’s employer, and is not a public authority; and
- (d) the consent is specific to the Application, is informed by the Kamma Landlord Privacy Notice, and may be withdrawn at any time.
- 5.6. Consent must be given by the Landlord personally. An Agent cannot give consent on a Landlord’s behalf, and a letter of authority signed by an Agent does not constitute the Landlord’s consent for the purposes of paragraph 29.
- 5.7. Accordingly, before any criminal offence data is uploaded to Kamma’s upload portal for an Application, the person uploading it must tick the consent statement at Annex D. Where the Landlord or a proposed manager uploads the documents, they give consent directly. Where an Agent uploads them, the Agent confirms that the Landlord, and any proposed manager in respect of their own information, has personally given consent on the terms at Annex D, and the Agent will keep a record of that consent and provide it to Kamma on request. The portal records who ticked the statement, in what capacity, when and which version of the wording was shown, and does not accept criminal offence data until it has been ticked.
- 5.8. Withdrawal. If a Landlord withdraws consent, Kamma will immediately cease processing that Landlord’s criminal offence data and will delete it in accordance with clause 9.2. Kamma cannot retrieve material already submitted to an authority, and withdrawal after submission does not oblige the authority to delete it. Withdrawal will ordinarily mean the Application cannot proceed, and clause 24.10 of the Subscriber Terms applies.
- 5.9. Because Kamma relies on paragraph 29, no appropriate policy document is required under section 42 of the Data Protection Act 2018 in respect of this processing, and Kamma is not required to justify why it has not sought consent.
- 5.10. Paragraph 36 of Schedule 1 disapplies the substantial public interest requirement in respect of criminal offence data, so no substantial public interest assessment is required for this processing.
- 5.11. Criminal offence data will not be retained beyond the period in clause 9.2, will not be used for any purpose other than transmission to the relevant authority, and will not be shared with any third party other than that authority.
- 5.12. The six-year Application record retained under clause 9.3 records which categories of supporting documentation were supplied to the authority. To the extent that record constitutes criminal offence data, Kamma relies on the condition in paragraph 33 of Schedule 1 (legal claims), the processing being necessary for the establishment, exercise or defence of legal claims under clauses 24.6 and 24.7 of the Subscriber Terms. No appropriate policy document is required for that condition. The record states which documents were supplied to the local authority. It does not record their contents, and no conviction information is retained.
- 5.13. Kamma does not maintain a register of criminal convictions. Article 10 permits a comprehensive register only under the control of official authority.
- 5.14. Where an Agent confirms the consent of a Landlord or proposed manager under clause 5.7, the Agent warrants that each such consent was given personally, freely, specifically and on an informed basis on the terms at Annex D, and that it holds a record of it. The Agent shall provide that record to Kamma within five working days of request. The Agent indemnifies Kamma against all claims, fines, penalties and costs arising from any confirmation which was inaccurate. Kamma may audit a sample of consent records not more than twice in any twelve-month period.
6. Transparency and information to data subjects
- 6.1. The parties recognise that where Kamma receives personal data about a data subject from the Customer rather than from the data subject, Article 14 of the UK GDPR applies to Kamma directly, and that obligation cannot be transferred to the Customer by agreement.
- 6.2. Accordingly, the parties will each do the following.
- The Customer will, at the point it collects personal data which it intends to disclose to Kamma, inform the relevant data subjects that their personal data will be disclosed to Kamma, and will provide or link to the Kamma Landlord Privacy Notice.
- Kamma will publish and maintain a privacy notice addressed to landlords, tenants and other individuals whose personal data it receives indirectly, setting out the Article 14 information, and will make it available at www.kammadata.com/support/privacy-notice/.
- 6.3. Where Kamma relies on the exemption in Article 14(5)(a) on the basis that the data subject already has the information, it will do so only where the Customer has confirmed it has complied with clause 6.2.
- 6.4. Neither party will make any statement to a data subject about the other party’s processing which is inaccurate or which the other party has not approved.
7. Individual rights
- 7.1. Each party remains responsible for responding to requests made to it in exercise of data subject rights, notwithstanding any allocation of tasks in this Agreement.
- 7.2. A data subject may contact either party. Where a party receives a request which relates wholly or partly to personal data held by the other, it will notify the other party within five working days and provide such information and assistance as is reasonably necessary for that party to respond within its own statutory deadline.
- 7.3. Kamma’s contact point for individual rights requests is set out in Annex B. Kamma will take overall responsibility for ensuring that a data subject who approaches Kamma can readily obtain the personal data Kamma holds about them, and will direct the data subject to the Customer where the Customer holds further data.
- 7.4. The parties acknowledge the statutory deadlines applying to each of them, including one calendar month for a subject access request (extendable by two further months where complex), and, since 19 June 2026, the duty to acknowledge a data protection complaint within 30 days and respond without undue delay.
- 7.5. Where a data subject exercises the right to erasure or to object, the receiving party will notify the other party so that each may assess the request against its own lawful basis and retention obligations. Erasure by one party does not automatically require erasure by the other.
8. Accuracy and data quality
- 8.1. The Customer is responsible for the accuracy of personal data it discloses to Kamma, and will correct and notify Kamma of any inaccuracy of which it becomes aware without undue delay.
- 8.2. Kamma is responsible for the accuracy of personal data it generates, and will investigate and where appropriate correct any inaccuracy notified to it within a reasonable period.
- 8.3. The parties will record shared personal data in consistent formats, and will use the Unique Property Reference Number as the common property identifier where available.
- 8.4. The parties will review data quality at the review meeting described in clause 15.
9. Retention and deletion
- 9.1. Platform data. Personal data processed for the Subscription Services is processed by Kamma as the Customer’s processor, and is retained and deleted in accordance with clauses 20.1.4 and 28 of the Subscriber Terms. Deletion at the end of the Term is performed by an automated process. Customer Property Data, which contains no personal data, may be retained indefinitely under clause 10.2 of the Subscriber Terms.
- 9.2. Application documents. Documents containing personal information supplied for an Application, including identity documents and criminal record information, are permanently deleted within 30 days of the earlier of notification of the authority’s final decision, withdrawal of the Application, or closure of the file under clause 24.10 of the Subscriber Terms. Personal data contained in routine encrypted backups is isolated from active processing and is deleted in accordance with Kamma's backup cycle, and in any event within 90 days of the relevant deletion date; until deletion Kamma will continue to apply clause 10 to it and will not restore it to active use.
- 9.3. Application records. Kamma retains a record of the Application itself for six years from completion, being the period necessary to respond to queries, defend claims and comply with its own legal obligations, and will then securely delete or anonymise that record, and will instruct its providers to delete any remaining copies, copies in providers’ revision history or snapshots expiring within a further 12 months.
- 9.4. Where the parties are subject to different retention obligations in respect of the same personal data, each will apply its own, and neither is required to delete personal data it is obliged to retain.
- 9.5. On termination of the sharing arrangement, clause 18 applies.
10. Security
- 10.1. Each party will implement appropriate technical and organisational measures under Article 32 of the UK GDPR, having regard to the nature of the personal data shared and in particular to the presence of criminal offence data in the Licence Application Services.
- 10.2. Kamma protects Shared Data using encryption in transit and at rest, restricts access on a least-privilege basis to personnel who require it, and maintains multi-factor authentication on the services through which Shared Data is accessed.
- 10.3. Personal data will be transmitted between the parties only through the Kamma Platform, Kamma’s secure upload portal, the Kamma API, or another channel agreed in writing. Neither party will transmit Shared Data by unencrypted email.
- 10.4. Each party will ensure that personnel with access to Shared Data are subject to obligations of confidentiality and have received appropriate data protection training.
11. Personal data breaches
- 11.1. Each party is separately responsible for assessing whether a personal data breach affecting Shared Data is notifiable to the Information Commissioner, and for making that notification within 72 hours of becoming aware where the threshold is met.
- 11.2. A party which becomes aware of a personal data breach affecting Shared Data will notify the other party without undue delay and in any event within 24 hours of becoming aware, so that the other party can make its own assessment within its own 72-hour period.
- 11.3. The notification will include, so far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.
- 11.4. The parties will cooperate in investigating and mitigating any such breach, and will consult one another before making any communication to affected data subjects which describes the other party’s role.
- 11.5. Each party will maintain a record of personal data breaches affecting Shared Data, including those it assesses as not notifiable and the reasons for that assessment.
12. Onward sharing and processors
- 12.1. Kamma discloses Shared Data only to the recipients identified in Annex A, being the relevant local housing authority, the processors listed in Annex B, and where necessary Kamma’s professional advisers and insurers.
- 12.2. Kamma engages the processors listed in Annex B to process Shared Data on its behalf. Kamma has in place with each of them a written contract meeting the requirements of Article 28 of the UK GDPR.
- 12.3. Kamma will maintain the list at Annex B, will provide an updated list to the Customer on request, and will not disclose Shared Data to a new processor before an Article 28 contract is in place with it. Addition or replacement of a processor is a variation of this Agreement, which Kamma will make in accordance with clause 22.1 of the Subscriber Terms.
- 12.4. Neither party will disclose Shared Data to any other third party without the other party’s prior written agreement, except where required by law, in which case it will notify the other party unless legally prohibited from doing so.
13. International transfers
- 13.1. Shared Data is hosted predominantly in the Netherlands, with some hosting in the United Kingdom. All backups, logs and replicas of Shared Data are held within those same two territories, save for Licence Application records stored in Airtable in the United States and contract signatory data processed by Qwilr in Australia. Further detail is at Annex B.
- 13.2. The Netherlands is covered by UK adequacy regulations. All European Economic Area states have full adequacy for the purposes of transfers from the United Kingdom. Accordingly a transfer of Shared Data from the United Kingdom to Kamma’s Netherlands hosting is not a restricted transfer requiring appropriate safeguards, and no International Data Transfer Agreement, UK Addendum or data protection test is required.
- 13.3. Neither party will transfer Shared Data to any country not covered by UK adequacy regulations except where the transfer is subject to appropriate safeguards recognised under Data Protection Laws, and where the exporting party has completed the assessment required under Article 46 of the UK GDPR.
- 13.4. Kamma will notify the Customer before making any material change to its hosting locations which would introduce a restricted transfer.
- 13.5. Some Shared Data is stored in Airtable in the United States, as recorded in Annex B. That transfer is a restricted transfer, and is subject to Airtable’s Data Processing Addendum, which incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and to the transfer risk assessment listed in Annex C. Contract signatory data is processed by Qwilr in Australia, as recorded in Annex B. That transfer is a restricted transfer, and is subject to Qwilr’s Data Processing Addendum, which incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and to the transfer risk assessment listed in Annex C. Kamma does not otherwise transfer Shared Data to the United States, Australia or to any other territory outside the United Kingdom and the European Economic Area.
14. Complaints and queries
- 14.1. Each party will maintain a route by which a data subject may raise a complaint about the sharing, accessible through the contact details in Annex B.
- 14.2. Where a party receives a complaint which concerns the other party’s processing, it will notify the other party within five working days.
- 14.3. Neither party will settle or concede a complaint in terms which impose an obligation on the other party without that party’s agreement.
15. Review
- 15.1. The parties will review this Agreement and the sharing it governs at least annually, and in any event promptly following any significant complaint, any personal data breach affecting Shared Data, any material change to the Subscription Services, or any material change to Data Protection Laws.
- 15.2. Kamma will initiate the review and will notify the Customer of any proposed amendment.
16. Data protection impact assessment
- 16.1. Kamma maintains a data protection impact assessment covering the Licence Application Services.
- 16.2. Scale. Kamma processes criminal offence data in connection with approximately 1,200 licence applications each year, involving in the region of 1,200 to 2,400 individuals where a separate manager is proposed. The parties consider that this does not presently constitute processing “on a large scale” for the purposes of Article 35(3)(b), having regard to the number of data subjects, the transient nature of the processing, and the deletion period in clause 9.2. That assessment is to be kept under review, as the figure is a target rather than a ceiling.
- 16.3. Other triggers. The processing engages at least two of the criteria in the European guidelines on high-risk processing, namely data of a highly personal nature and data obtained other than directly from the data subject. The ICO recommends a DPIA where there is doubt. Kamma will therefore carry out a DPIA notwithstanding the conclusion at 16.2.
- 16.4. The parties record that Kamma does not use criminal offence data to determine access to any product, service, opportunity or benefit. The determination of suitability is made by the authority.
- 16.5. Publication and provision of the Kamma Landlord Privacy Notice under clause 6.2 means the processing is not “invisible processing” within the meaning of the ICO’s guidance, which applies only where the controller does not provide the Article 14 information.
17. Records and accountability
- 17.1. Each party will maintain records of processing under Article 30 of the UK GDPR covering the Shared Data.
- 17.2. Each party will, on reasonable request and not more than once in any twelve-month period, provide the other with sufficient information to demonstrate compliance with this Agreement. This does not entitle either party to access the other’s systems, premises or records beyond what is necessary for that purpose.
18. Termination
- 18.1. This Agreement terminates automatically on termination or expiry of the Subscriber Terms, save that clauses 5, 7, 9, 10, 11, 12, 13, 17, 18 and 19 survive termination for so long as either party continues to hold Shared Data.
- 18.2. On termination, each party will cease sharing personal data, and will delete or return Shared Data in accordance with clause 9 and with clause 20.1.4 of the Subscriber Terms.
- 18.3. Termination does not affect either party’s obligation to retain personal data where required by law, or to respond to an outstanding data subject request or regulatory enquiry.
19. General
- 19.1. This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
- 19.2. No third party may enforce any term of this Agreement under the Contracts (Rights of Third Parties) Act 1999.
- 19.3. Compliance with this Agreement does not relieve either party of its own obligations under Data Protection Laws.
- 19.4. This Agreement may be varied only in accordance with clause 22.1 of the Subscriber Terms. Any notice of variation will set out the variation and the reason for it.
- 19.5. Notices under this Agreement are given to the contacts in Annex B, and clause 22.4 of the Subscriber Terms applies to any formal notice.
- 19.6. Liability. Nothing in this Agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability which cannot lawfully be limited or excluded.
- 19.7. Subject to the preceding clause, the exclusions and limitations of liability in clauses 18 and 24.7 of the Subscriber Terms apply to any claim arising under or in connection with this Agreement, and to any claim relating to the processing of Shared Data, as if set out in full in this Agreement. The parties agree that liability is a matter governed by the Subscriber Terms for the purposes of clause 1.6.
- 19.8. Where a data subject brings a claim under Article 82 of the UK GDPR against one party in respect of damage caused wholly or partly by the other party's breach of this Agreement or of Data Protection Laws, the party in breach shall indemnify the other against that proportion of the liability, costs and expenses attributable to its breach. This clause is subject to the preceding clause.
Annex A - Data specification
1. Platform Services
Personal data processed for the Subscription Services is processed by Kamma as the Customer’s processor under clause 28 of the Subscriber Terms, and is not Shared Data under this Agreement.
2. Licence Application Services
| Category | Data items | Disclosed by | Recipients beyond the parties |
|---|---|---|---|
| Landlord details | Name, address, contact details, date of birth where required | Customer or Landlord | Local housing authority |
| Managing agent details | Name, address, contact details | Customer | Local housing authority |
| Property details | Address, UPRN, tenure, occupancy | Customer | Local housing authority |
| Proof of identity | Passport, driving licence or equivalent | Customer or Landlord | Local housing authority |
| Criminal offence data | Suitability declaration; criminal record check documentation where the authority requires it | Customer or Landlord | Local housing authority |
Annex B - Contacts, locations and processors engaged by Kamma
Kamma data protection contact: Gary Gale, Chief Technology Officer, hello@kammadata.com
Customer data protection contact: as notified by the Customer to Kamma in writing before it first instructs an Application, and as updated by the Customer from time to time by notice to Kamma
Kamma breach notification address: hello@kammadata.com
Hosting locations: Google Cloud zones europe-west4-a and europe-west4-b (Netherlands), and europe-west2-a (London, United Kingdom). All backups, logs and replicas of Shared Data are held within those zones. Licence Application records are also stored in Airtable in the United States, as recorded in the table below, and that transfer is subject to the UK International Data Transfer Addendum incorporated in Airtable’s Data Processing Addendum. Contract signatory data is processed by Qwilr in Australia, as recorded in the table below, and that transfer is subject to the UK International Data Transfer Addendum incorporated in Qwilr’s Data Processing Addendum. No other Shared Data is stored outside the United Kingdom and the European Economic Area.
Processors of Shared Data:
| Processor | Purpose | Location of processing |
|---|---|---|
| Google Cloud | Hosting and storage of Shared Data, including backups and logs, and storage of identity and supporting documents collected through Kamma’s own secure upload portal (encrypted, with automated deletion) | europe-west4-a and europe-west4-b (Netherlands); europe-west2-a (London) |
| Google Workspace | Email and document handling in correspondence with the Customer, the Landlord and the local housing authority | United Kingdom and European Economic Area only |
| DocuSign | Electronic signature of contracts for Kamma’s products and services | United Kingdom |
| Qwilr | Preparation and electronic signature of proposals and contracts for Kamma’s products and services | Australia. Restricted transfer covered by the UK International Data Transfer Addendum in Qwilr’s Data Processing Addendum |
| Airtable | Intake, tracking and management of Licence Application records (Licence Application Services only) | United States. Restricted transfer covered by the UK International Data Transfer Addendum in Airtable’s Data Processing Addendum |
Annex C - Related Kamma documents
| Document | Purpose | Status |
|---|---|---|
| Kamma Subscriber Terms and Conditions | The Contract. This Agreement forms part of it under clause 11.6. Clause 28 governs Kamma’s processing for the Subscription Services. | FINAL, October 2026 |
| Kamma Legitimate Interests Assessment | Records the Article 6(1)(f) three-part test relied on at clause 4.2 and 4.3 | FINAL, October 2026 |
| Kamma DPIA - Licence Application Services | Assesses the criminal offence data processing under clause 5 | FINAL, October 2026 |
| Kamma Landlord Privacy Notice | Discharges Article 14 for personal data received indirectly, per clause 6.2 | FINAL, October 2026 |
| Kamma Platform User Privacy Notice | Addressed to users of the Kamma Platform. Does not cover landlord or tenant data | FINAL, October 2026 |
| Processor list | Required by clause 12.2 only if a processor is engaged | Google Cloud, Google Workspace, Airtable, DocuSign and Qwilr engaged; list maintained at Annex B |
| Airtable transfer risk assessment | Required by clause 13.3 for the restricted transfer of Licence Application records to the United States | FINAL, October 2026 (Kamma Transfer Risk Assessment: Airtable). Airtable Data Processing Addendum (including the UK International Data Transfer Addendum) accepted by Kamma by email; copy held by Kamma |
| Qwilr transfer risk assessment | Required by clause 13.3 for the restricted transfer of contract signatory data to Australia | FINAL, October 2026 (Kamma Transfer Risk Assessment: Qwilr). Qwilr Data Processing Addendum (including the UK International Data Transfer Addendum) accepted by Kamma by email; copy held by Kamma |
Annex D - Model consent wording
The ICO Data Sharing Code requires that where consent is the basis for sharing, the agreement provides a model consent form. The following is shown in Kamma’s upload portal, and must be ticked before any criminal offence data is uploaded for an Application. Where an Agent ticks it, it records the Agent’s confirmation that the Landlord, and any proposed manager, has personally given consent on these terms.
Consent to processing of criminal record information
To apply for a property licence, the local authority requires information about whether you (and any proposed manager) have any relevant criminal convictions. This is called a suitability or “fit and proper person” declaration, and some local authorities also ask for a criminal record check.
Kamma will pass this information to the local authority on your behalf. Kamma does not check, verify or assess it. The local authority decides whether you are a fit and proper person.
Kamma will delete this information within 30 days of us being notified of the local authority’s decision, or of your application being withdrawn or closed.
You do not have to use Kamma. You can apply to the local authority yourself or use another provider. You can withdraw this consent at any time by contacting us at hello@kammadata.com, although we cannot recover anything already sent to the local authority, and withdrawing consent will usually mean we cannot continue with your application.
How we handle your information is explained in our Landlord Privacy Notice at www.kammadata.com/support/privacy-notice/.
☐ I confirm that, for this application, either:
(a) I am the landlord or proposed manager, and I consent to Kamma processing information about criminal convictions and offences relating to me, for the sole purpose of preparing and submitting this licence application; or
(b) I am acting for the landlord, and the landlord, and any proposed manager in respect of their own information, has personally given that consent on the terms shown here. I hold a record of their consent and will provide it to Kamma on request.
The portal records who ticks this statement, in what capacity, when, and which version of the wording was shown.
Applicable Schedule 1 condition for criminal offence data: paragraph 29 (consent). See clause 5.4. No appropriate policy document is required for this condition. Paragraph 36 disapplies the substantial public interest requirement.
Conditions considered and not relied on: paragraph 6 (statutory and government purposes) - the Housing Act functions are conferred on the authority, not on Kamma; paragraph 10 (preventing or detecting unlawful acts) - Kamma does not assess or investigate; paragraph 33 (legal claims) - retained as a possible fallback for any criminal offence data within the six-year Application record.
Annex E - Legal references
UK GDPR Articles 5, 6, 9, 10, 13, 14, 15 to 22, 26, 28, 30, 32, 33, 34, 44 to 49.
Data Protection Act 2018 sections 10, 42, 121; Schedule 1 (conditions for processing special category and criminal offence data).
Data (Use and Access) Act 2025, including the complaints provisions in force from 19 June 2026.
Housing Act 2004 Parts 2 and 3 (HMO and selective licensing), section 238 (false or misleading information).
ICO Data Sharing Code of Practice, statutory code made under section 121 of the Data Protection Act 2018.
ICO guidance on criminal offence data, conditions for processing, and appropriate policy documents.
CONTACT US
Get in touch
Contact us using this form and we will get back to you right away!
In partnership with
Supported by
An OS initiative
In partnership with
