1. Status, parties and scope
This is a proposed data processing agreement structure for legal review, not an executed agreement. It covers the proposed processing of tenant information by GidaVault on behalf of a landlord or other lawful controller using the software.
Before signature or valid electronic acceptance, identify the controller and the provider’s legal entity, incorporate the governing service agreement and complete the processing and security schedules. Processing undertaken by the provider for its own controller purposes must be addressed separately.
2. Processing instructions and details
The proposed subject matter is software-based property and tenancy administration. Operations may include collecting, storing, displaying, correcting, exporting and deleting information under documented lawful instructions for the duration of the service and any justified exit period.
Data subjects may include landlords, prospective tenants, current and former tenants, household contacts and authorised users. Data categories may include identity and contact details, property or tenancy references, application details, uploaded records and dated activity information. Actual fields, processing locations, duration and permitted purposes must be listed in the final schedule.
3. Controller responsibilities
The controller must establish lawful grounds, provide required notices, limit collection to necessary information, set lawful retention periods and issue clear instructions. The controller must not instruct unlawful tenant profiling, publication or discrimination.
The processor must notify the controller if it considers an instruction unlawful and handle that situation under the agreed procedure rather than treating every instruction as automatically valid.
4. Confidentiality and security
The final agreement must require confidentiality for authorised personnel and appropriate technical and organisational safeguards. A security schedule must describe verified access controls, file handling, export controls, backup practices, monitoring, recovery and incident response.
These are requirements to establish and verify, not a representation that every listed control is already implemented or certified.
5. Subprocessors and international transfers
List each relevant hosting, storage, communications and support provider, the processing service and location. The final agreement must establish subprocessor authorisation, change notifications and equivalent contractual protections.
Determine and document the lawful mechanism and safeguards for any cross-border transfer. Do not assume that a cloud provider’s terms alone resolve the controller’s or processor’s legal obligations.
6. Individual rights, incidents and assessments
Define how the processor assists with verified access, correction, erasure, restriction, objection and portability requests, without disclosing another person’s records. The landlord generally decides requests for the processing it controls, subject to applicable law.
Set an incident-notification process that enables the controller to meet applicable deadlines, including prompt escalation, facts known, containment and updates. Also define assistance with impact assessments, regulator enquiries and evidence of compliance. Actual contacts and escalation arrangements must be completed before use.
7. End of tenancy, return and deletion
A tenant leaving a property must trigger a review of access and retention. It is not an instruction to erase every record immediately or to retain a full tenant profile forever. The final schedule must specify what is removed, what may be retained for a documented lawful purpose, and who authorises that decision.
At the end of the processing service, define the controller’s choice of return or deletion, any legally required retention, restricted legal holds and a verified backup-deletion cycle. Historical activity entries may themselves contain personal information and must be included in this assessment.
Deletion, anonymisation and export procedures need implementation and verification separately; this draft does not run those procedures.
8. Audit and completed schedules
Agree proportionate access to evidence of compliance, appropriate audit arrangements, incident contacts, dispute handling and allocation of responsibilities. No independent audit or regulator approval is claimed.
Outstanding schedules: legal parties; processing inventory; lawful instructions; categories of people and data; provider and location list; international-transfer safeguards; verified security measures; retention and backup periods; rights and incident contacts; and effective date and acceptance.