Data Processing Agreement

1. Scope, parties and processing schedule

This DPA forms part of the Terms between REMI SOFTWARE LTD (processor) and the Customer (controller), to the extent Remi processes personal data on the Customer's behalf under Article 28 UK GDPR. It does not convert Remi's separate controller activities into processor activities.

Subject matter: instructed property/tenancy maintenance, migration and related record management. Nature: collection, storage, organisation, matching, conversion, retrieval, display, AI text triage, communication, authorised coordination, export, restriction and approved deletion. Purpose: providing the instructed service and necessary support/security.

Data subjects: tenants, landlords/property owners, agency staff, contractors, prospects where imported on the agency's behalf, and other persons in submitted material. Data includes identity/contact and property details, tenancy dates/terms, rent/deposit records, maintenance history, notes, quotes, invoices, inspections, certificates, communications, audit/provenance/source records and documents/media. Sensitive data is not requested as a default; where present the Customer must establish the required conditions and safeguards.

Duration: the instructed service followed by the agreed return/deletion and justified legal-retention arrangements. The Privacy Policy retention schedule explicitly identifies unverified periods; it does not supply a fixed backup or deletion deadline. Agree those operational details before paid activation.

2. Instructions and confidentiality

Remi will process Customer-controlled data only on documented Customer instructions, including this agreement and authorised use, including instructions regarding international transfers, unless required by applicable law. Where legally permitted, Remi will inform the Customer of that requirement before processing.

Remi will immediately inform the Customer if, in its opinion, an instruction infringes UK GDPR or other applicable data-protection provisions, and seek clarification rather than knowingly carry out an unlawful instruction. The Customer is responsible for lawful collection, accuracy, minimisation and its instructions.

Persons authorised to process the data must be bound by confidentiality obligations or an appropriate statutory obligation, receive appropriate guidance, and access only what their role requires.

3. Security measures and verification

Taking account of risk and Article 32, Remi will maintain appropriate technical and organisational measures. The implemented design includes authenticated role/agency-scoped access, private-file authorisation, transport security, restricted historical conversion, provenance/audit records and controlled notification handling. These descriptions are not certification that every production dependency has been activated or tested.

The security schedule must be supplemented with verified hosting/access configuration, incident handling, file scanning, supplier assurances, backup/restore procedures, retention and periodic testing. No recovery-time, recovery-point, malware-free or uninterrupted-service guarantee is invented by this DPA.

4. Subprocessors and transfers

The Customer gives general written authorisation for the subprocessors identified for the relevant processing in /sub-processors, subject to resolving the register's verification gaps before activating that processing. Independent-controller supplier activities must be separately identified.

Remi will give at least 30 days' email notice of an intended addition or replacement and an opportunity to object on reasonable data-protection grounds before the change. Send an objection with reasons to hello@remi.properties within the notice period. We will discuss safeguards or an alternative; if unresolved, we will agree suspension of the affected processing or termination of the affected service before using the proposed provider for that Customer. Silence does not cure an unlawful transfer.

Remi will engage subprocessors under written obligations providing the same applicable data-protection obligations, in particular sufficient security guarantees, and remains responsible to the Customer for the subprocessor's performance of those obligations as required by Article 28.

Restricted international transfers require a verified lawful mechanism and necessary supplementary measures. Supplier legal entities, regions, contractual instruments and transfer assessments remain verification items; this DPA does not assert execution of an IDTA/Addendum or applicability of adequacy merely because a supplier is listed.

5. Assistance and personal-data breaches

Taking account of the processing and information available, Remi will assist with data-subject rights through appropriate technical and organisational measures and assist compliance with Articles 32–36, including security, breach assessment/notification, DPIAs and prior consultation. We will route requests concerning Customer-controlled data to the Customer rather than independently erase shared records.

Remi will notify the Customer without undue delay after awareness of a personal-data breach affecting its data, provide available information about nature, affected categories/approximate numbers, contact, likely consequences and mitigation, and supplement information as it becomes available. Remi will cooperate with investigation and remediation. No arbitrary supplier notification deadline is substituted for the statutory duty.

6. Return, deletion, copies and backups

At the Customer's choice, Remi will return or delete Customer-controlled personal data after the end of processing services and delete existing copies unless applicable law requires storage. Agree identity/authority, export formats, attachments, delivery security, timing and confirmation in a documented exit instruction. Return does not authorise indefinite retention of duplicate originals.

Do not equate archiving, conversion undo, account cancellation or a queued review with completed deletion. Mixed-person originals, shared documents and financial/legal holds require lawful redaction, segregation or justified restricted retention, not silent destruction of other persons' records.

Backup deletion/expiry must follow a verified, agreed schedule. Pending expiry, retained backup data must be protected and not used for ordinary processing; approved erasures must be reapplied after restoration. Exact periods and technical feasibility remain to be verified, not promised as an unimplemented SLA. Inform the Customer of legal retention requirements and restrict processing accordingly.

7. Information, audits and contact

Remi will make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, by the Customer or its mandated auditor. Reasonable notice, confidentiality and protection of other customers may apply without defeating mandatory audit rights or urgent regulatory needs.

Unverified company particulars, supplier/transfer arrangements, retention periods, restore capability and unresolved commercial terms require human review. The Terms' liability provisions apply only to the extent legally permitted and do not remove statutory data-subject rights or processor obligations. Contact hello@remi.properties.