import Link from "next/link"
import { LegalPage, Section, Callout, LegalContact } from "@/components/marketing/legal"
import { LEGAL } from "@/lib/legal"

export const metadata = {
  title: "Data Processing Addendum",
  description: `The Data Processing Addendum governing how ${LEGAL.entity} processes personal data on behalf of Customers using ${LEGAL.service}.`,
  alternates: { canonical: "/dpa" },
}

export default function DpaPage() {
  return (
    <LegalPage
      title="Data Processing Addendum"
      subtitle={`This Data Processing Addendum sets out the terms on which ${LEGAL.entity} processes personal data on behalf of Customers of ${LEGAL.service}.`}
    >
      <Callout>
        This DPA forms part of the{" "}
        <Link href="/terms">Terms of Service</Link> between you and {LEGAL.entity} and
        applies wherever we process personal data on the Customer&rsquo;s behalf (for
        example, Tenant personal data managed through the Service). Where there is a
        conflict between this DPA and the Terms in respect of the processing of personal
        data, this DPA prevails.
      </Callout>

      <Section id="roles" heading="1. Introduction and roles">
        <p>
          In this DPA, <strong>Customer</strong> (also <strong>you</strong>) means the
          account holder using {LEGAL.service}. <strong>We</strong>, <strong>us</strong>,
          and <strong>our</strong> mean {LEGAL.entity}. A <strong>Tenant</strong> means a
          data subject whose personal data the Customer manages through the Service.
        </p>
        <p>
          With respect to Tenant personal data and other personal data that the Customer
          submits to the Service, the Customer acts as the data{" "}
          <strong>controller</strong> and we act as the data{" "}
          <strong>processor</strong>, processing that personal data solely on the
          Customer&rsquo;s behalf. With respect to the Customer&rsquo;s own account data
          (for example, the name and contact details of the account holder and billing
          information), we act as a <strong>controller</strong> in our own right, as
          described in our{" "}
          <Link href="/privacy">Privacy Policy</Link>.
        </p>
      </Section>

      <Section id="definitions" heading="2. Definitions">
        <p>Unless otherwise defined here, the following terms have the meanings given below:</p>
        <ul>
          <li>
            <strong>Controller</strong> means the entity that determines the purposes and
            means of the processing of personal data.
          </li>
          <li>
            <strong>Processor</strong> means the entity that processes personal data on
            behalf of the controller.
          </li>
          <li>
            <strong>Personal Data</strong> means any information relating to an identified
            or identifiable natural person that is processed under this DPA.
          </li>
          <li>
            <strong>Data Subject</strong> means the identified or identifiable natural
            person to whom Personal Data relates.
          </li>
          <li>
            <strong>Processing</strong> means any operation performed on Personal Data,
            whether or not by automated means, including collection, storage, use, and
            deletion.
          </li>
          <li>
            <strong>Sub-processor</strong> means any third party engaged by us to process
            Personal Data on behalf of the Customer.
          </li>
          <li>
            <strong>Applicable Data Protection Law</strong> means all laws and regulations
            applicable to the processing of Personal Data under this DPA, including the EU
            General Data Protection Regulation (Regulation (EU) 2016/679) (the{" "}
            <strong>GDPR</strong>) and the United Kingdom General Data Protection
            Regulation (the <strong>UK GDPR</strong>).
          </li>
          <li>
            <strong>Standard Contractual Clauses</strong> means the standard data
            protection clauses approved by the European Commission (or the equivalent UK
            transfer mechanism) for the transfer of Personal Data to processors
            established in third countries.
          </li>
        </ul>
      </Section>

      <Section id="details" heading="3. Details of the processing">
        <p>
          The subject matter, duration, nature, and purpose of the processing, and the
          types of Personal Data and categories of Data Subjects, are as follows:
        </p>
        <ul>
          <li>
            <strong>Subject matter:</strong> the provision of the Service to the Customer.
          </li>
          <li>
            <strong>Duration:</strong> the term of the agreement between the Customer and
            us, plus the deletion window described in Section 11.
          </li>
          <li>
            <strong>Nature and purpose:</strong> hosting, storage, and processing of
            Personal Data as necessary to operate the property-management features of the
            Service.
          </li>
          <li>
            <strong>Types of Personal Data:</strong> names, contact details, tenancy
            information, lease information, and payment-status data.
          </li>
          <li>
            <strong>Categories of Data Subjects:</strong> the Customer&rsquo;s Tenants and
            contacts.
          </li>
        </ul>
      </Section>

      <Section id="obligations" heading="4. Our obligations as processor">
        <p>When acting as a processor on the Customer&rsquo;s behalf, we shall:</p>
        <ul>
          <li>
            process Personal Data only on the Customer&rsquo;s documented instructions,
            including with regard to international transfers, unless required to do
            otherwise by law (in which case we shall inform the Customer of that legal
            requirement before processing, unless prohibited from doing so);
          </li>
          <li>
            ensure that persons authorized to process Personal Data have committed
            themselves to confidentiality or are under an appropriate statutory obligation
            of confidentiality;
          </li>
          <li>
            implement appropriate technical and organizational measures to ensure a level
            of security appropriate to the risk, in accordance with Article 32 of the
            GDPR;
          </li>
          <li>
            taking into account the nature of the processing, assist the Customer by
            appropriate technical and organizational measures in responding to requests
            from Data Subjects seeking to exercise their rights;
          </li>
          <li>
            assist the Customer in ensuring compliance with its obligations relating to
            the security of processing, personal-data breach notification, data-protection
            impact assessments (DPIAs), and prior consultations with supervisory
            authorities;
          </li>
          <li>
            make available to the Customer the information necessary to demonstrate
            compliance with the obligations set out in this DPA.
          </li>
        </ul>
      </Section>

      <Section id="subprocessors" heading="5. Sub-processors">
        <p>
          The Customer provides a general authorization for us to engage Sub-processors to
          process Personal Data in connection with the Service. Our current Sub-processors
          are listed on our{" "}
          <Link href="/subprocessors">Sub-processors</Link> page.
        </p>
        <p>
          Where we engage a Sub-processor, we impose data-protection obligations that are
          substantially equivalent to those set out in this DPA. We give the Customer prior
          notice of any intended addition or replacement of a Sub-processor, and the
          Customer may object to the change on legitimate data-protection grounds. We remain
          responsible for the performance of each Sub-processor&rsquo;s obligations.
        </p>
      </Section>

      <Section id="transfers" heading="6. International transfers">
        <p>
          Where processing of Personal Data involves a transfer to a country outside the
          European Economic Area or the United Kingdom that has not been recognized as
          providing an adequate level of protection, we implement an appropriate transfer
          mechanism, such as the Standard Contractual Clauses or another lawful mechanism
          recognized under Applicable Data Protection Law.
        </p>
      </Section>

      <Section id="rights" heading="7. Data-subject rights">
        <p>
          Taking into account the nature of the processing, we assist the Customer, as
          controller, by appropriate technical and organizational measures, insofar as
          this is possible, in fulfilling the Customer&rsquo;s obligation to respond to
          requests from Data Subjects exercising their rights under Applicable Data
          Protection Law. Where we receive a request directly from a Data Subject in
          respect of Personal Data processed on the Customer&rsquo;s behalf, we shall,
          unless legally required to respond, forward that request to the Customer without
          undue delay.
        </p>
      </Section>

      <Section id="breach" heading="8. Personal-data breach">
        <p>
          We shall notify the Customer without undue delay after becoming aware of a
          personal-data breach affecting Personal Data processed on the Customer&rsquo;s
          behalf. That notification shall, to the extent available, describe the nature of
          the breach, its likely consequences, and the measures taken or proposed to
          address it, so that the Customer can meet its own notification obligations.
        </p>
      </Section>

      <Section id="audit" heading="9. Audit">
        <p>
          We make available to the Customer the information necessary to demonstrate
          compliance with this DPA and allow for and contribute to audits, including
          inspections, conducted by the Customer or an auditor mandated by the Customer.
          Audits are subject to reasonable prior written notice, are conducted during
          normal business hours in a manner that does not disrupt our operations, and are
          subject to appropriate confidentiality obligations.
        </p>
      </Section>

      <Section id="deletion" heading="10. Return and deletion">
        <p>
          Upon termination or expiry of the agreement, we shall, at the Customer&rsquo;s
          choice, delete or return all Personal Data processed on the Customer&rsquo;s
          behalf, and delete existing copies, within {LEGAL.dataDeletionDays} days, save
          where retention of the Personal Data is required by Applicable Data Protection
          Law or other law, in which case we shall protect that Personal Data and process
          it only as necessary for the purpose that requires its retention.
        </p>
      </Section>

      <Section id="liability" heading="11. Liability">
        <p>
          Each party&rsquo;s liability under or in connection with this DPA is subject to
          the exclusions and limitations of liability set out in the{" "}
          <Link href="/terms">Terms of Service</Link>.
        </p>
      </Section>

      <Section id="execution" heading="12. Execution">
        <p>
          This DPA is incorporated into, and forms part of, the Terms of Service and takes
          effect upon the Customer&rsquo;s acceptance of the Terms and use of the Service.
          A countersigned copy of this DPA is available on request by contacting{" "}
          <a href={`mailto:${LEGAL.dpoEmail}`}>{LEGAL.dpoEmail}</a>.
        </p>
      </Section>

      <LegalContact email={LEGAL.dpoEmail} />
    </LegalPage>
  )
}
