Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening
Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Leon Serfaty
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
969d5d4c8a
commit
c9968531e4
@@ -0,0 +1,247 @@
|
||||
import Link from "next/link"
|
||||
import { LegalPage, Section, Callout, LegalContact } from "@/components/marketing/legal"
|
||||
import { LEGAL } from "@/lib/legal"
|
||||
|
||||
export const metadata = {
|
||||
title: "Data Processing Addendum",
|
||||
description: `The Data Processing Addendum governing how ${LEGAL.entity} processes personal data on behalf of Customers using ${LEGAL.service}.`,
|
||||
alternates: { canonical: "/dpa" },
|
||||
}
|
||||
|
||||
export default function DpaPage() {
|
||||
return (
|
||||
<LegalPage
|
||||
title="Data Processing Addendum"
|
||||
subtitle={`This Data Processing Addendum sets out the terms on which ${LEGAL.entity} processes personal data on behalf of Customers of ${LEGAL.service}.`}
|
||||
>
|
||||
<Callout>
|
||||
This DPA forms part of the{" "}
|
||||
<Link href="/terms">Terms of Service</Link> between you and {LEGAL.entity} and
|
||||
applies wherever we process personal data on the Customer’s behalf (for
|
||||
example, Tenant personal data managed through the Service). Where there is a
|
||||
conflict between this DPA and the Terms in respect of the processing of personal
|
||||
data, this DPA prevails.
|
||||
</Callout>
|
||||
|
||||
<Section id="roles" heading="1. Introduction and roles">
|
||||
<p>
|
||||
In this DPA, <strong>Customer</strong> (also <strong>you</strong>) means the
|
||||
account holder using {LEGAL.service}. <strong>We</strong>, <strong>us</strong>,
|
||||
and <strong>our</strong> mean {LEGAL.entity}. A <strong>Tenant</strong> means a
|
||||
data subject whose personal data the Customer manages through the Service.
|
||||
</p>
|
||||
<p>
|
||||
With respect to Tenant personal data and other personal data that the Customer
|
||||
submits to the Service, the Customer acts as the data{" "}
|
||||
<strong>controller</strong> and we act as the data{" "}
|
||||
<strong>processor</strong>, processing that personal data solely on the
|
||||
Customer’s behalf. With respect to the Customer’s own account data
|
||||
(for example, the name and contact details of the account holder and billing
|
||||
information), we act as a <strong>controller</strong> in our own right, as
|
||||
described in our{" "}
|
||||
<Link href="/privacy">Privacy Policy</Link>.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="definitions" heading="2. Definitions">
|
||||
<p>Unless otherwise defined here, the following terms have the meanings given below:</p>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Controller</strong> means the entity that determines the purposes and
|
||||
means of the processing of personal data.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Processor</strong> means the entity that processes personal data on
|
||||
behalf of the controller.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Personal Data</strong> means any information relating to an identified
|
||||
or identifiable natural person that is processed under this DPA.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Data Subject</strong> means the identified or identifiable natural
|
||||
person to whom Personal Data relates.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Processing</strong> means any operation performed on Personal Data,
|
||||
whether or not by automated means, including collection, storage, use, and
|
||||
deletion.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Sub-processor</strong> means any third party engaged by us to process
|
||||
Personal Data on behalf of the Customer.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Applicable Data Protection Law</strong> means all laws and regulations
|
||||
applicable to the processing of Personal Data under this DPA, including the EU
|
||||
General Data Protection Regulation (Regulation (EU) 2016/679) (the{" "}
|
||||
<strong>GDPR</strong>) and the United Kingdom General Data Protection
|
||||
Regulation (the <strong>UK GDPR</strong>).
|
||||
</li>
|
||||
<li>
|
||||
<strong>Standard Contractual Clauses</strong> means the standard data
|
||||
protection clauses approved by the European Commission (or the equivalent UK
|
||||
transfer mechanism) for the transfer of Personal Data to processors
|
||||
established in third countries.
|
||||
</li>
|
||||
</ul>
|
||||
</Section>
|
||||
|
||||
<Section id="details" heading="3. Details of the processing">
|
||||
<p>
|
||||
The subject matter, duration, nature, and purpose of the processing, and the
|
||||
types of Personal Data and categories of Data Subjects, are as follows:
|
||||
</p>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Subject matter:</strong> the provision of the Service to the Customer.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Duration:</strong> the term of the agreement between the Customer and
|
||||
us, plus the deletion window described in Section 11.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Nature and purpose:</strong> hosting, storage, and processing of
|
||||
Personal Data as necessary to operate the property-management features of the
|
||||
Service.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Types of Personal Data:</strong> names, contact details, tenancy
|
||||
information, lease information, and payment-status data.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Categories of Data Subjects:</strong> the Customer’s Tenants and
|
||||
contacts.
|
||||
</li>
|
||||
</ul>
|
||||
</Section>
|
||||
|
||||
<Section id="obligations" heading="4. Our obligations as processor">
|
||||
<p>When acting as a processor on the Customer’s behalf, we shall:</p>
|
||||
<ul>
|
||||
<li>
|
||||
process Personal Data only on the Customer’s documented instructions,
|
||||
including with regard to international transfers, unless required to do
|
||||
otherwise by law (in which case we shall inform the Customer of that legal
|
||||
requirement before processing, unless prohibited from doing so);
|
||||
</li>
|
||||
<li>
|
||||
ensure that persons authorized to process Personal Data have committed
|
||||
themselves to confidentiality or are under an appropriate statutory obligation
|
||||
of confidentiality;
|
||||
</li>
|
||||
<li>
|
||||
implement appropriate technical and organizational measures to ensure a level
|
||||
of security appropriate to the risk, in accordance with Article 32 of the
|
||||
GDPR;
|
||||
</li>
|
||||
<li>
|
||||
taking into account the nature of the processing, assist the Customer by
|
||||
appropriate technical and organizational measures in responding to requests
|
||||
from Data Subjects seeking to exercise their rights;
|
||||
</li>
|
||||
<li>
|
||||
assist the Customer in ensuring compliance with its obligations relating to
|
||||
the security of processing, personal-data breach notification, data-protection
|
||||
impact assessments (DPIAs), and prior consultations with supervisory
|
||||
authorities;
|
||||
</li>
|
||||
<li>
|
||||
make available to the Customer the information necessary to demonstrate
|
||||
compliance with the obligations set out in this DPA.
|
||||
</li>
|
||||
</ul>
|
||||
</Section>
|
||||
|
||||
<Section id="subprocessors" heading="5. Sub-processors">
|
||||
<p>
|
||||
The Customer provides a general authorization for us to engage Sub-processors to
|
||||
process Personal Data in connection with the Service. Our current Sub-processors
|
||||
are listed on our{" "}
|
||||
<Link href="/subprocessors">Sub-processors</Link> page.
|
||||
</p>
|
||||
<p>
|
||||
Where we engage a Sub-processor, we impose data-protection obligations that are
|
||||
substantially equivalent to those set out in this DPA. We give the Customer prior
|
||||
notice of any intended addition or replacement of a Sub-processor, and the
|
||||
Customer may object to the change on legitimate data-protection grounds. We remain
|
||||
responsible for the performance of each Sub-processor’s obligations.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="transfers" heading="6. International transfers">
|
||||
<p>
|
||||
Where processing of Personal Data involves a transfer to a country outside the
|
||||
European Economic Area or the United Kingdom that has not been recognized as
|
||||
providing an adequate level of protection, we implement an appropriate transfer
|
||||
mechanism, such as the Standard Contractual Clauses or another lawful mechanism
|
||||
recognized under Applicable Data Protection Law.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="rights" heading="7. Data-subject rights">
|
||||
<p>
|
||||
Taking into account the nature of the processing, we assist the Customer, as
|
||||
controller, by appropriate technical and organizational measures, insofar as
|
||||
this is possible, in fulfilling the Customer’s obligation to respond to
|
||||
requests from Data Subjects exercising their rights under Applicable Data
|
||||
Protection Law. Where we receive a request directly from a Data Subject in
|
||||
respect of Personal Data processed on the Customer’s behalf, we shall,
|
||||
unless legally required to respond, forward that request to the Customer without
|
||||
undue delay.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="breach" heading="8. Personal-data breach">
|
||||
<p>
|
||||
We shall notify the Customer without undue delay after becoming aware of a
|
||||
personal-data breach affecting Personal Data processed on the Customer’s
|
||||
behalf. That notification shall, to the extent available, describe the nature of
|
||||
the breach, its likely consequences, and the measures taken or proposed to
|
||||
address it, so that the Customer can meet its own notification obligations.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="audit" heading="9. Audit">
|
||||
<p>
|
||||
We make available to the Customer the information necessary to demonstrate
|
||||
compliance with this DPA and allow for and contribute to audits, including
|
||||
inspections, conducted by the Customer or an auditor mandated by the Customer.
|
||||
Audits are subject to reasonable prior written notice, are conducted during
|
||||
normal business hours in a manner that does not disrupt our operations, and are
|
||||
subject to appropriate confidentiality obligations.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="deletion" heading="10. Return and deletion">
|
||||
<p>
|
||||
Upon termination or expiry of the agreement, we shall, at the Customer’s
|
||||
choice, delete or return all Personal Data processed on the Customer’s
|
||||
behalf, and delete existing copies, within {LEGAL.dataDeletionDays} days, save
|
||||
where retention of the Personal Data is required by Applicable Data Protection
|
||||
Law or other law, in which case we shall protect that Personal Data and process
|
||||
it only as necessary for the purpose that requires its retention.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="liability" heading="11. Liability">
|
||||
<p>
|
||||
Each party’s liability under or in connection with this DPA is subject to
|
||||
the exclusions and limitations of liability set out in the{" "}
|
||||
<Link href="/terms">Terms of Service</Link>.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<Section id="execution" heading="12. Execution">
|
||||
<p>
|
||||
This DPA is incorporated into, and forms part of, the Terms of Service and takes
|
||||
effect upon the Customer’s acceptance of the Terms and use of the Service.
|
||||
A countersigned copy of this DPA is available on request by contacting{" "}
|
||||
<a href={`mailto:${LEGAL.dpoEmail}`}>{LEGAL.dpoEmail}</a>.
|
||||
</p>
|
||||
</Section>
|
||||
|
||||
<LegalContact email={LEGAL.dpoEmail} />
|
||||
</LegalPage>
|
||||
)
|
||||
}
|
||||
Reference in New Issue
Block a user