Data Processing Agreement

Terms such as "controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given to them in the UK GDPR. "Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and any other data protection or privacy laws applicable to the processing. "Sub-processor" means any third party engaged by RegalNest to process Occupant Data.

The parties acknowledge that, for the purposes of Applicable Data Protection Law and in respect of Occupant Data:

• the Customer is the controller and determines the purposes and means of the processing;
• RegalNest is the processor and processes Occupant Data only on behalf of, and on the documented instructions of, the Customer; and
• each party is responsible for complying with its own obligations under Applicable Data Protection Law.

The Customer is responsible for establishing a lawful basis for the processing and for providing appropriate privacy information to data subjects.

RegalNest processes Occupant Data only to the extent necessary to provide, maintain, secure and support the Services, and as further described in Annex A. The subject matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects are set out in Annex A.

RegalNest will process Occupant Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case RegalNest will, where lawful, inform the Customer of that legal requirement before processing). The Customer's instructions are set out in this DPA, the Terms of Service, and the configuration and use of the Services. RegalNest will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

RegalNest ensures that persons authorised to process Occupant Data are bound by appropriate obligations of confidentiality and are made aware of the confidential nature of the data. Access to Occupant Data is limited to personnel who need it to provide the Services.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, RegalNest implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex B. These include measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Occupant Data.

The Customer provides general authorisation for RegalNest to engage Sub-processors to assist in providing the Services (for example, cloud hosting, payment processing and email delivery providers). RegalNest will:

• impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA;
• remain liable to the Customer for the performance of each Sub-processor's obligations; and
• make available a current list of Sub-processors on request and give the Customer reasonable notice of any intended addition or replacement, so that the Customer may object on reasonable data-protection grounds.

Taking into account the nature of the processing, RegalNest will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under Applicable Data Protection Law. If RegalNest receives a request directly from a data subject relating to Occupant Data, it will, where permitted, promptly forward the request to the Customer and will not respond directly except on the Customer's instructions.

RegalNest will notify the Customer without undue delay after becoming aware of a personal data breach affecting Occupant Data, and will provide the Customer with information reasonably required to meet the Customer's obligations to report to a supervisory authority and/or affected data subjects. RegalNest will take reasonable steps to mitigate and, where possible, remedy the breach.

RegalNest will provide reasonable assistance to the Customer with any data protection impact assessments and prior consultations with a supervisory authority that the Customer is required to carry out under Applicable Data Protection Law, taking into account the nature of the processing and the information available to RegalNest.

RegalNest will not transfer Occupant Data outside the United Kingdom without the Customer's authorisation and without ensuring that an appropriate transfer mechanism is in place (such as a UK adequacy decision or the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). The Customer authorises transfers necessary to provide the Services where such safeguards are in place.

On termination or expiry of the Services, RegalNest will, at the Customer's choice, delete or return all Occupant Data and delete existing copies, unless retention is required by law. For a limited period after termination, the Customer may export its data through the Services, after which RegalNest may delete it in accordance with its retention practices.

RegalNest will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice, confidentiality obligations, and no more than once per year unless required by a supervisory authority. RegalNest may satisfy audit requests by providing relevant third-party certifications or reports where available.

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

This DPA takes effect when the Customer accepts the Terms of Service and continues for as long as RegalNest processes Occupant Data on the Customer's behalf. Provisions that by their nature should survive termination (including confidentiality, deletion/return, and liability) will survive.

a. Subject matter and duration

• Provision of the RegalNest property management Services for the duration of the Customer's subscription and any applicable retention period.

b. Nature and purpose

• Hosting, storage, organisation, retrieval, use, transmission and deletion of Occupant Data to deliver property, tenancy, leasing, payment, maintenance and communication features.

c. Types of personal data

• Identity and contact details; tenancy, lease and occupancy records; payment and arrears information; maintenance requests and communications; and any other personal data the Customer chooses to upload.

d. Categories of data subjects

• The Customer's tenants, guarantors, occupants, applicants, contractors and other individuals whose data the Customer processes using the Services.

• Encryption of personal data in transit and, where appropriate, at rest.
• Role-based access controls and the principle of least privilege; authentication controls for personnel.
• Network and application security measures, logging and monitoring.
• Regular backups and resilience measures to restore availability after an incident.
• Secure software development and change-management practices.
• Policies and staff confidentiality obligations governing the handling of personal data.
• Processes for regularly testing and evaluating the effectiveness of these measures.