Data processing agreement

1. What this agreement is

This data processing agreement is between your company (the controller) and Servanda Ltd, a company registered in England and Wales (the processor). It forms part of the terms of service and applies to personal data Servanda processes for you. It is written to meet Article 28 of the UK GDPR and the Data Protection Act 2018.

2. What is processed, and why

• Subject matter and purpose: providing Servanda to you, to run your building: its safety records, works, consultations and service charge books.
• Duration: while you use Servanda, and for up to 90 days after, as set out in the terms.
• People: leaseholders and residents, your directors and other users, contractors and their staff, and anyone else whose details you put in.
• Information: names, postal and email addresses, phone numbers, the flat a person owns, service charge shares, amounts demanded, paid and owed, bank statement lines you upload, correspondence and reports, photographs and documents, and records of who did what in the app. Servanda is not designed for special category data; please only enter it where you need to, for example a note that a leaseholder is vulnerable.

3. What Servanda will do

• process the personal data only on your documented instructions, which are these terms, this agreement and what you do in the app, unless the law requires otherwise (and then tell you, unless the law forbids it);
• make sure everyone at Servanda who can reach the data is bound to keep it confidential;
• keep appropriate technical and organisational security: encryption in transit and at rest, each customer's data kept apart by row level security, individual logins, an audit trail of changes, and tested backups;
• use only the sub-processors listed below, on written terms that protect the data at least as well, and tell you by email at least 30 days before adding or replacing one, so you can object;
• help you answer requests from people exercising their rights, and with security, breach notification, impact assessments and consultation with the Information Commissioner, taking account of what Servanda can reasonably do;
• tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with what is known and what is being done;
• at the end, delete or return the personal data as you choose, and delete existing copies unless the law requires them to be kept;
• make available the information needed to show it meets these obligations, and allow for and contribute to reasonable audits, on reasonable notice and no more than once a year unless there has been a breach.

4. What you will do

You confirm you have a lawful basis for the personal data you put into Servanda (usually the leases and your company's legal duties to manage the building), that you have told the people concerned how their information is used, and that your instructions comply with data protection law.

5. Transfers outside the UK

Some sub-processors are in the United States. Where personal data goes outside the UK, Servanda relies on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified) or the International Data Transfer Addendum to the EU standard contractual clauses.

6. Sub-processors

You give general authorisation for these sub-processors:

7. Liability and order of precedence

Liability under this agreement is subject to the limits in the terms of service, except where the law does not allow it. If this agreement and the terms disagree about personal data, this agreement wins.