Atrium standard app data processing agreement

This agreement, effective from 8th October 2026, applies when you install a third-party app from Atrium, the COHO app store. It’s between you, the COHO account holder who installs the app (“you”), and the developer of that app (“the developer”). It’s how the developer agrees to look after the personal data their app processes for you.

Every developer in Atrium has agreed to this agreement in advance, through their Atrium developer agreement with COHO. You accept it when you install their app. You don’t need to sign anything.

COHO is not a party to this agreement, but it can enforce it on your behalf. See “COHO’s role” below.

When this agreement applies

This agreement applies whenever the developer, or anyone working for them, processes personal data on your behalf through their app.

If the app is hosted by COHO and the developer has no access to your data, the developer won’t usually process any personal data for you. This agreement still applies if that ever changes.

If the developer’s own terms say something different about personal data, this agreement wins.

Who does what

You are the controller. You decide why and how your data is used, for example your tenants’ data.
The developer is your processor. They process personal data only to provide their app to you.

Each of you must follow UK data protection law, including the UK GDPR and the Data Protection Act 2018.

The processing

What and why: Providing the app’s features to you, as described on its Atrium listing
How long: While the app is installed, plus the time needed to delete the data after you uninstall it
Types of personal data: The data covered by the permissions you approve when you install the app, plus any data you or your users enter into the app
Whose personal data: Your tenants, residents, applicants, contractors, staff and anyone else whose data is covered by those permissions

Your instructions

The developer only processes personal data on your documented instructions. Your instructions are:

using the app as described on its listing;
the permissions you approve when you install the app;
the settings and choices you make in the app;
anything else you tell the developer in writing.

If the law requires the developer to process data in another way, they must tell you first, unless the law prevents them.

If the developer thinks one of your instructions breaks data protection law, they must tell you straight away.

What the developer must not do

The developer must not:

use your data for their own purposes;
sell your data, or share it with anyone except as this agreement allows;
use your data to build profiles, datasets or products for anyone else;
use your data to train artificial intelligence models, unless you agree in writing;
combine your data with data from other customers, except where that’s needed to run the app and the data stays separated by customer.

Confidentiality

The developer must make sure everyone who can access your data is bound by a duty of confidentiality, and only has the access they need to do their job.

Security

The developer must keep your data secure, with technical and organisational measures that are appropriate to the risk. As a minimum, these include:

encryption of data in transit and at rest;
multi-factor authentication on all admin and production access;
access limited to the people who need it, with access logs kept;
storing COHO access tokens securely, never in code that runs in a browser or on a device;
keeping their systems patched and up to date;
regular testing of these measures.

Sub-processors

You give the developer general permission to use sub-processors (other companies that process your data for them, such as hosting providers).

The developer must:

keep an up-to-date list of their sub-processors, including where they’re based, and make it available to you, for example on their website or the app’s listing;
tell you about any new sub-processor at least 14 days before it starts processing your data. If you object for a genuine data protection reason, you can uninstall
the app before the change takes effect;
put a written contract in place with each sub-processor, with data protection terms at least as strong as this agreement;
stay fully responsible to you for anything their sub-processors do.

Data outside the UK

The developer must not process your data outside the UK, or let a sub-processor do so, unless there’s a safeguard recognised under UK law. That could be UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

The app’s listing must say where your data is processed.

Helping you

The developer must help you, taking into account what they can reasonably do, to:

respond to people exercising their data protection rights, such as access or deletion requests. If someone contacts the developer directly about your data, they must pass the request to you promptly and not respond themselves unless you ask them to;
keep personal data secure;
carry out data protection impact assessments, and consult the Information Commissioner’s Office where needed.

Personal data breaches

If the developer becomes aware of a personal data breach affecting your data, they must tell you, and tell COHO, without undue delay and in any case within 48 hours.

They must give you the information you need to meet your own obligations, including:

what happened;
what data and how many people are affected;
the likely consequences;
what they’ve done, and will do, about it.

They must keep you updated as they find out more.

When you uninstall the app

When you uninstall the app, or the app is removed from Atrium, the developer must:

if you ask within 14 days, return your data to you in a commonly used format; then
delete your data, including copies held by their sub-processors, within 30 days of the uninstall, and confirm to you in writing that they’ve done so.
The developer can keep data only where the law requires them to, and only for as long as it requires. That data stays protected by this agreement.

Records and audits

The developer must:

keep records of the processing they carry out for you, as the UK GDPR requires;
give you the information you reasonably need to show that they’re meeting this agreement;
allow, and contribute to, reasonable audits and inspections by you or an auditor you appoint. Unless there’s been a breach, or a regulator requires it, audits are limited to once a year, with at least 30 days’ notice.

Your responsibilities

You must:

make sure you have a lawful basis to share personal data with the app;
tell your tenants and anyone else affected how their data is used, as you already do for your use of COHO;
only give lawful instructions.

COHO’s role

COHO runs Atrium, but it isn’t a party to this agreement and isn’t responsible for how the developer handles your data.

COHO may enforce this agreement against the developer, under the Contracts (Rights of Third Parties) Act 1999, to protect you and the integrity of Atrium. If the developer breaks this agreement, COHO may also suspend or remove their app.

Liability

Each of you is responsible for your own breaches of this agreement and of data protection law. Nothing in the developer’s licence terms limits the developer’s responsibility for breaching this agreement or data protection law.

How long this agreement lasts

This agreement lasts for as long as the developer processes personal data for you. The sections on deletion, confidentiality, security and records continue until all your data has been deleted.

Changes to this agreement

COHO may update this agreement from time to time, for example to reflect changes in the law. The effective date at the top shows when it was last changed. Any change applies to both you and the developer from the date it takes effect.

Law

This agreement is governed by the law of England and Wales. The courts of England and Wales deal with any dispute.