Data processing terms

Abide.Rent is operated by the company named under “Who we are” on this page (“we”, “us”, “our”). These data processing terms form part of our terms of use. They apply when you — an agency or a landlord with an account — use the product to process personal data about other people, such as tenants, landlords, guarantors and your staff. They are the contract UK GDPR Article 28 requires. If they conflict with the terms of use on data protection, these terms apply.

1. Who does what

For the tenancy records you put into the product, you are the controller and we are your processor. You decide why those records are processed; we process them to provide the product to you.

We are a controller, not your processor, for: the accounts people use to sign in; security and service logs; billing; support; and the copies of issued documents each party keeps after the notice is sent. The privacy notice covers that processing.

2. The processing

• Subject matter and purpose: providing the product — storing tenancy records, generating documents, recording service, sending the emails you ask the product to send, and keeping legal holds.
• Duration: while your account is open, then as section 10 sets out.
• Types of personal data: names, contact details, addresses, tenancy and rent details, documents, messages, service records, and email delivery, open and click events.
• Data subjects: tenants and other occupiers, landlords, guarantors, your staff and anyone else you add to a record.
• Special-category and criminal-offence data: not required by the product. Do not enter it unless you have a lawful basis and have told us.

3. Your instructions

We process the personal data only on your documented instructions. These terms, the terms of use and your use of the product’s settings are your instructions. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process the data in another way, we will tell you first unless the law forbids it.

4. Confidentiality

Everyone we allow to process the personal data is bound by a duty of confidentiality and sees only what they need to do their job.

5. Security

We keep measures appropriate to the risk, as UK GDPR Article 32 requires. They include:

• encryption of data in transit (HTTPS);
• passwords stored only as salted hashes, and optional sign-in with Google;
• access limited by role and by account, so one customer cannot see another’s records;
• backups of the database, and logs of access to it;
• a legal hold that stops held records being deleted.

6. Sub-processors

You give us general authorisation to use the sub-processors in the table on this page. We will give you at least 30 days’ notice, by email to the account owner and on this page, before adding or replacing one. If you object on reasonable data-protection grounds and we cannot resolve it, you may cancel under the billing terms. Each sub-processor is bound by data-protection terms that give the same protection as these. We remain responsible to you for what they do.

7. Transfers outside the UK

Some sub-processors, and some of our own people, process personal data outside the UK. Each transfer is covered as section 7 of the privacy notice describes.

8. Helping you

If someone asks us to exercise a data-protection right over a record you control, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to. The product lets you find, correct and export records. We will give you reasonable help with data protection impact assessments and with any consultation with the Information Commissioner’s Office.

9. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the records you control. We will tell you what we know — what happened, what data and how many people are affected, what we are doing about it — and keep you updated, so that you can meet your own duties.

10. When the account closes

Export your records before you close the account; export works on every plan. Within 90 days of closure we delete the personal data we process for you, except: records under a legal hold, which we keep until the hold ends; copies of issued documents that another party keeps as their own record; and anything the law requires us to keep.

11. Information and audits

We will give you the information you reasonably need to show that we meet Article 28. You may audit that, or appoint an independent auditor bound by confidentiality, once a year on 30 days’ notice, at your cost, in a way that does not expose other customers’ data. We may answer first with documents, and you agree to rely on them where they are enough.

12. Email tracking

When the product sends an email for you, it records whether the email was delivered and whether it was reported as opened or a link was clicked. You decide whether to send notices by email, and you are responsible for telling the people you write to, as your privacy notice requires.

13. Liability

Each party’s liability under these terms is subject to the limits in the terms of use, except where the law does not allow a limit.

Email us at the address under “Who we are” on this page. The privacy notice explains the processing we do as a controller.