248 lines
12 KiB
TypeScript
248 lines
12 KiB
TypeScript
|
import Link from "next/link"
|
||
|
|
import { LegalPage, Section, Callout, LegalContact } from "@/components/marketing/legal"
|
||
|
|
import { LEGAL } from "@/lib/legal"
|
||
|
|
|
||
|
|
export const metadata = {
|
||
|
|
title: "Data Processing Addendum",
|
||
|
|
description: `The Data Processing Addendum governing how ${LEGAL.entity} processes personal data on behalf of Customers using ${LEGAL.service}.`,
|
||
|
|
alternates: { canonical: "/dpa" },
|
||
|
|
}
|
||
|
|
|
||
|
|
export default function DpaPage() {
|
||
|
|
return (
|
||
|
|
<LegalPage
|
||
|
|
title="Data Processing Addendum"
|
||
|
|
subtitle={`This Data Processing Addendum sets out the terms on which ${LEGAL.entity} processes personal data on behalf of Customers of ${LEGAL.service}.`}
|
||
|
|
>
|
||
|
|
<Callout>
|
||
|
|
This DPA forms part of the{" "}
|
||
|
|
<Link href="/terms">Terms of Service</Link> between you and {LEGAL.entity} and
|
||
|
|
applies wherever we process personal data on the Customer’s behalf (for
|
||
|
|
example, Tenant personal data managed through the Service). Where there is a
|
||
|
|
conflict between this DPA and the Terms in respect of the processing of personal
|
||
|
|
data, this DPA prevails.
|
||
|
|
</Callout>
|
||
|
|
|
||
|
|
<Section id="roles" heading="1. Introduction and roles">
|
||
|
|
<p>
|
||
|
|
In this DPA, <strong>Customer</strong> (also <strong>you</strong>) means the
|
||
|
|
account holder using {LEGAL.service}. <strong>We</strong>, <strong>us</strong>,
|
||
|
|
and <strong>our</strong> mean {LEGAL.entity}. A <strong>Tenant</strong> means a
|
||
|
|
data subject whose personal data the Customer manages through the Service.
|
||
|
|
</p>
|
||
|
|
<p>
|
||
|
|
With respect to Tenant personal data and other personal data that the Customer
|
||
|
|
submits to the Service, the Customer acts as the data{" "}
|
||
|
|
<strong>controller</strong> and we act as the data{" "}
|
||
|
|
<strong>processor</strong>, processing that personal data solely on the
|
||
|
|
Customer’s behalf. With respect to the Customer’s own account data
|
||
|
|
(for example, the name and contact details of the account holder and billing
|
||
|
|
information), we act as a <strong>controller</strong> in our own right, as
|
||
|
|
described in our{" "}
|
||
|
|
<Link href="/privacy">Privacy Policy</Link>.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="definitions" heading="2. Definitions">
|
||
|
|
<p>Unless otherwise defined here, the following terms have the meanings given below:</p>
|
||
|
|
<ul>
|
||
|
|
<li>
|
||
|
|
<strong>Controller</strong> means the entity that determines the purposes and
|
||
|
|
means of the processing of personal data.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Processor</strong> means the entity that processes personal data on
|
||
|
|
behalf of the controller.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Personal Data</strong> means any information relating to an identified
|
||
|
|
or identifiable natural person that is processed under this DPA.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Data Subject</strong> means the identified or identifiable natural
|
||
|
|
person to whom Personal Data relates.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Processing</strong> means any operation performed on Personal Data,
|
||
|
|
whether or not by automated means, including collection, storage, use, and
|
||
|
|
deletion.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Sub-processor</strong> means any third party engaged by us to process
|
||
|
|
Personal Data on behalf of the Customer.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Applicable Data Protection Law</strong> means all laws and regulations
|
||
|
|
applicable to the processing of Personal Data under this DPA, including the EU
|
||
|
|
General Data Protection Regulation (Regulation (EU) 2016/679) (the{" "}
|
||
|
|
<strong>GDPR</strong>) and the United Kingdom General Data Protection
|
||
|
|
Regulation (the <strong>UK GDPR</strong>).
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Standard Contractual Clauses</strong> means the standard data
|
||
|
|
protection clauses approved by the European Commission (or the equivalent UK
|
||
|
|
transfer mechanism) for the transfer of Personal Data to processors
|
||
|
|
established in third countries.
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="details" heading="3. Details of the processing">
|
||
|
|
<p>
|
||
|
|
The subject matter, duration, nature, and purpose of the processing, and the
|
||
|
|
types of Personal Data and categories of Data Subjects, are as follows:
|
||
|
|
</p>
|
||
|
|
<ul>
|
||
|
|
<li>
|
||
|
|
<strong>Subject matter:</strong> the provision of the Service to the Customer.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Duration:</strong> the term of the agreement between the Customer and
|
||
|
|
us, plus the deletion window described in Section 11.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Nature and purpose:</strong> hosting, storage, and processing of
|
||
|
|
Personal Data as necessary to operate the property-management features of the
|
||
|
|
Service.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Types of Personal Data:</strong> names, contact details, tenancy
|
||
|
|
information, lease information, and payment-status data.
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
<strong>Categories of Data Subjects:</strong> the Customer’s Tenants and
|
||
|
|
contacts.
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="obligations" heading="4. Our obligations as processor">
|
||
|
|
<p>When acting as a processor on the Customer’s behalf, we shall:</p>
|
||
|
|
<ul>
|
||
|
|
<li>
|
||
|
|
process Personal Data only on the Customer’s documented instructions,
|
||
|
|
including with regard to international transfers, unless required to do
|
||
|
|
otherwise by law (in which case we shall inform the Customer of that legal
|
||
|
|
requirement before processing, unless prohibited from doing so);
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
ensure that persons authorized to process Personal Data have committed
|
||
|
|
themselves to confidentiality or are under an appropriate statutory obligation
|
||
|
|
of confidentiality;
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
implement appropriate technical and organizational measures to ensure a level
|
||
|
|
of security appropriate to the risk, in accordance with Article 32 of the
|
||
|
|
GDPR;
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
taking into account the nature of the processing, assist the Customer by
|
||
|
|
appropriate technical and organizational measures in responding to requests
|
||
|
|
from Data Subjects seeking to exercise their rights;
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
assist the Customer in ensuring compliance with its obligations relating to
|
||
|
|
the security of processing, personal-data breach notification, data-protection
|
||
|
|
impact assessments (DPIAs), and prior consultations with supervisory
|
||
|
|
authorities;
|
||
|
|
</li>
|
||
|
|
<li>
|
||
|
|
make available to the Customer the information necessary to demonstrate
|
||
|
|
compliance with the obligations set out in this DPA.
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="subprocessors" heading="5. Sub-processors">
|
||
|
|
<p>
|
||
|
|
The Customer provides a general authorization for us to engage Sub-processors to
|
||
|
|
process Personal Data in connection with the Service. Our current Sub-processors
|
||
|
|
are listed on our{" "}
|
||
|
|
<Link href="/subprocessors">Sub-processors</Link> page.
|
||
|
|
</p>
|
||
|
|
<p>
|
||
|
|
Where we engage a Sub-processor, we impose data-protection obligations that are
|
||
|
|
substantially equivalent to those set out in this DPA. We give the Customer prior
|
||
|
|
notice of any intended addition or replacement of a Sub-processor, and the
|
||
|
|
Customer may object to the change on legitimate data-protection grounds. We remain
|
||
|
|
responsible for the performance of each Sub-processor’s obligations.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="transfers" heading="6. International transfers">
|
||
|
|
<p>
|
||
|
|
Where processing of Personal Data involves a transfer to a country outside the
|
||
|
|
European Economic Area or the United Kingdom that has not been recognized as
|
||
|
|
providing an adequate level of protection, we implement an appropriate transfer
|
||
|
|
mechanism, such as the Standard Contractual Clauses or another lawful mechanism
|
||
|
|
recognized under Applicable Data Protection Law.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="rights" heading="7. Data-subject rights">
|
||
|
|
<p>
|
||
|
|
Taking into account the nature of the processing, we assist the Customer, as
|
||
|
|
controller, by appropriate technical and organizational measures, insofar as
|
||
|
|
this is possible, in fulfilling the Customer’s obligation to respond to
|
||
|
|
requests from Data Subjects exercising their rights under Applicable Data
|
||
|
|
Protection Law. Where we receive a request directly from a Data Subject in
|
||
|
|
respect of Personal Data processed on the Customer’s behalf, we shall,
|
||
|
|
unless legally required to respond, forward that request to the Customer without
|
||
|
|
undue delay.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="breach" heading="8. Personal-data breach">
|
||
|
|
<p>
|
||
|
|
We shall notify the Customer without undue delay after becoming aware of a
|
||
|
|
personal-data breach affecting Personal Data processed on the Customer’s
|
||
|
|
behalf. That notification shall, to the extent available, describe the nature of
|
||
|
|
the breach, its likely consequences, and the measures taken or proposed to
|
||
|
|
address it, so that the Customer can meet its own notification obligations.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="audit" heading="9. Audit">
|
||
|
|
<p>
|
||
|
|
We make available to the Customer the information necessary to demonstrate
|
||
|
|
compliance with this DPA and allow for and contribute to audits, including
|
||
|
|
inspections, conducted by the Customer or an auditor mandated by the Customer.
|
||
|
|
Audits are subject to reasonable prior written notice, are conducted during
|
||
|
|
normal business hours in a manner that does not disrupt our operations, and are
|
||
|
|
subject to appropriate confidentiality obligations.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="deletion" heading="10. Return and deletion">
|
||
|
|
<p>
|
||
|
|
Upon termination or expiry of the agreement, we shall, at the Customer’s
|
||
|
|
choice, delete or return all Personal Data processed on the Customer’s
|
||
|
|
behalf, and delete existing copies, within {LEGAL.dataDeletionDays} days, save
|
||
|
|
where retention of the Personal Data is required by Applicable Data Protection
|
||
|
|
Law or other law, in which case we shall protect that Personal Data and process
|
||
|
|
it only as necessary for the purpose that requires its retention.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="liability" heading="11. Liability">
|
||
|
|
<p>
|
||
|
|
Each party’s liability under or in connection with this DPA is subject to
|
||
|
|
the exclusions and limitations of liability set out in the{" "}
|
||
|
|
<Link href="/terms">Terms of Service</Link>.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<Section id="execution" heading="12. Execution">
|
||
|
|
<p>
|
||
|
|
This DPA is incorporated into, and forms part of, the Terms of Service and takes
|
||
|
|
effect upon the Customer’s acceptance of the Terms and use of the Service.
|
||
|
|
A countersigned copy of this DPA is available on request by contacting{" "}
|
||
|
|
<a href={`mailto:${LEGAL.dpoEmail}`}>{LEGAL.dpoEmail}</a>.
|
||
|
|
</p>
|
||
|
|
</Section>
|
||
|
|
|
||
|
|
<LegalContact email={LEGAL.dpoEmail} />
|
||
|
|
</LegalPage>
|
||
|
|
)
|
||
|
|
}
|