This Data Processing Agreement (“DPA”) between [Legal entity name] and each customer forms part of the Terms of Serviceand applies whenever we process personal data on the customer's behalf. Customers who need a countersigned copy can request one at [privacy email].
1. Roles and instructions
The customer is the controller and we are the processor. We process customer personal data only on the customer's documented instructions (the Terms, this DPA and the customer's use of the Service), never sell it, and never use it for our own purposes or to train AI models. Everyone with access is bound by confidentiality.
2. Details of processing
| Data subjects | Customer staff; prospective and actual buyers, tenants or members; enquirers from public pages |
| Data categories | Identity and contact details; ID numbers entered by the customer; transaction data (units, offers, prices, sale contracts, installment schedules, payments received); appointments, notes, messages, files |
| Special categories | None intended — customers must not upload them |
| Purpose / duration | Providing the Service, for the term plus the deletion period below |
3. Security
We maintain the technical and organisational measures described on the Security page.
4. Sub-processors
The customer authorises the providers on the Sub-processorspage. We give 30 days' notice of new ones; if the customer objects on reasonable data-protection grounds and we can't resolve it, the customer may terminate the affected service with a pro-rata refund. We remain responsible for our sub-processors.
5. Assistance and data-subject requests
Self-service tools cover access, export, correction and erasure. We forward requests we receive directly to the customer within 5 business days and help with impact assessments where reasonable.
6. Breach notification
We notify the customer without undue delay and within 48 hours of becoming aware of a personal-data breach affecting its data, with the information available, so the customer can meet its 72-hour duty.
7. International transfers
Transfers outside the EEA, UK or Switzerland are covered by the EU Standard Contractual Clauses (Module 2 or 3), the UK Addendum and Swiss adaptations, which are incorporated by reference.
8. Audits
We provide our security documentation and answer a security questionnaire once a year. Where that is not enough or a regulator requires it, the customer may audit on 30 days' notice through an independent, confidentiality-bound auditor, at its cost, once a year.
9. Return and deletion
Customers can export their data at any time. On termination or workspace deletion we delete customer personal data from production within 30 days and from backups on their rolling expiry, unless law requires retention, and confirm deletion in writing on request.
10. US state privacy laws
Under the CCPA/CPRA and similar laws we act as a service provider/processor: we process personal information only for the business purpose of providing the Service; don't sell or share it or combine it with other data except as the law permits; provide the same level of protection the law requires; notify the customer if we can no longer comply; and pass these obligations to our sub-processors.