Data processing agreement

This agreement is part of the terms of service between the customer using RealtyKeep — the controller — and [company name] (organisation number [organisation number], [address]) — the processor. It fulfils Article 28 of the General Data Protection Regulation (GDPR). Version 2026-11-12. The customer accepts it when registering a company in RealtyKeep or when asked to accept a new version.

1. Subject, nature and purpose

The processor provides RealtyKeep, a web service for managing property, and processes personal data only to provide the service: storing, organising, displaying, sending notifications and emails, backing up and deleting the data the controller and its users add.

2. Categories of data subjects and data

• Data subjects: the controller's tenants, people applying for or looking for a home, staff and managers, contractors, and other users the controller invites.
• Data: names, email addresses, phone numbers, leases and rent, which spaces and keys a person has, service requests and comments, applications and search requests, account and log data (including IP addresses).
• The service is not intended for special categories of personal data (such as health data). The controller should not enter such data in free-text fields.

3. Duration

This agreement applies as long as the processor processes personal data for the controller.

4. The processor's obligations

The processor shall:

1. process personal data only on documented instructions from the controller — these terms and the controller's use of the service count as such instructions — unless required otherwise by law, in which case the processor informs the controller first where allowed;
2. ensure that people authorised to process the data are bound by confidentiality;
3. take the technical and organisational security measures described in section 8;
4. only use sub-processors as described in section 5;
5. help the controller, as far as possible, to respond to requests from data subjects exercising their rights — for example through the export and deletion functions in the service;
6. help the controller with security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing;
7. at the end of the agreement, delete the controller's personal data within 30 days after the export period in the terms of service (backups are deleted within a further 30 days), unless the law requires it to be kept;
8. make available the information needed to show that these obligations are met, and allow and contribute to audits by the controller or an auditor it appoints, with reasonable notice and at the controller's cost;
9. inform the controller immediately if it believes an instruction infringes data protection law.

5. Sub-processors

The controller gives general authorisation for the processor to use sub-processors. The current sub-processors are:

• [list your hosting and email providers]

The processor informs the controller of intended changes at least 30 days in advance, giving the controller the opportunity to object. The processor imposes the same data protection obligations on each sub-processor by contract and remains responsible for their work.

6. Transfers outside the EU/EEA

Personal data is stored within the EU/EEA. If a sub-processor processes data outside the EU/EEA, the processor ensures that a legal transfer mechanism, such as the EU standard contractual clauses or an adequacy decision, is in place.

7. Personal data breaches

The processor notifies the controller without undue delay, and at the latest within 48 hours of becoming aware of a personal data breach, with the information the controller needs to assess it and, where required, notify the supervisory authority within 72 hours.

8. Security measures

• Encrypted connections (HTTPS) and strict security headers.
• Passwords stored with salted hashing; optional or required two-step sign-in; single-use, expiring email links.
• Access control on every request: users only see what their role allows.
• Secrets (two-step sign-in keys, email and payment credentials) encrypted at rest.
• Activity log of every change; IP addresses removed after 90 days.
• Daily backups kept 30 days; restore tested.
• Software kept up to date; dependencies pinned and monitored for vulnerabilities.
• Servers within the EU/EEA, with access limited to authorised personnel.

9. Liability and order of precedence

Liability follows the terms of service and Article 82 of the GDPR. If this agreement and the terms of service conflict regarding personal data, this agreement applies.

Contact

[company name] · [address] · [email]