Data Processing Addendum

This Addendum ("DPA") forms part of the agreement between EstateVera Ltd ("Processor") and the customer ("Controller") where the Processor processes personal data on the Controller's behalf in connection with the EstateVera service.

1. Scope & roles

The Controller determines the purposes and means of processing personal data uploaded to EstateVera (e.g. tenant and contractor records). The Processor processes such data only on documented Controller instructions, which include using EstateVera in accordance with the Terms.

2. Subject matter & duration

Subject matter: provision of the EstateVera service. Duration: the term of your subscription, plus the 90-day post-termination retention window.

3. Nature & purpose

• Hosting and storage of portfolio, tenant, contractor and document data.
• Generating reminders, reports and audit packs.
• AI extraction of fields from uploaded documents (optional).
• Customer support.

4. Types of personal data

• Tenant names, contact details, deposit and tenancy information.
• Contractor names, contact details and accreditations.
• Property addresses and inspection records.
• Document contents you upload.

5. Processor obligations

• Process personal data only on Controller's documented instructions.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organisational measures (Article 32).
• Assist the Controller with data subject requests and DPIAs where required.
• Notify the Controller of personal data breaches without undue delay.
• Delete or return personal data at the end of the agreement.

6. Subprocessors

The Controller authorises the Processor to engage subprocessors (e.g. hosting, email, AI extraction). A current list is available on request. The Processor remains liable for subprocessor performance and will give 30 days' notice of material changes.

7. International transfers

Transfers outside the UK/EEA are governed by the UK Addendum to the EU Standard Contractual Clauses or another approved transfer mechanism.

8. Audit

The Processor will make available information reasonably necessary to demonstrate compliance, including third-party reports. On-site audits may be arranged on reasonable notice and during business hours.

9. Contact

DPA / privacy contact: privacy@EstateVera.app.