Data processing terms

1. What these terms cover

These terms form part of our Terms of Service between you and Eris Technology Solutions Ltd ("Traddie"). They apply whenever you put personal data about other people into Traddie: your customers, tenants, landlords, contractors, staff and anyone else. For that data you are the controller and Traddie is your processor, and these terms are the contract UK GDPR Article 28 requires between us.

They do not cover the data we hold about you as our own customer (your account, billing and use of the Service). Our Privacy Policy covers that, and there Traddie is the controller.

2. The processing

• Subject matter and purpose: providing the Service to you: storing records, sending the emails, texts and links you ask it to send, producing documents, and showing the right information to the right person (for example a contractor's job page or a tenant's repair status page).
• Duration: for as long as you use the Service, then as set out in section 8.
• People the data is about: your customers and their contacts; for letting agents and landlords, tenants and other occupiers, landlords, and contractors; your team members.
• Kinds of data: names, addresses, phone numbers, email addresses, access details for properties, descriptions of work and faults, photos and videos, messages, quotes, invoices, certificates and payment records. We do not ask for special category data; if you or a tenant choose to include it (for example a health condition that makes a repair urgent), it is processed on the same terms.

3. Your instructions

We process the data only on your documented instructions, which are these terms and the way you use and set up the Service, unless UK law requires otherwise (in which case we tell you first, unless the law forbids that). If we think an instruction breaks data protection law, we will tell you.

You are responsible for having a lawful basis for the data you put in, for telling the people it is about how it is used (for letting agents, tenants see a short notice on the repair form that links to our explanation), and for the accuracy of what you enter.

4. Our people and our security

Everyone at Traddie who can reach your data is bound by confidentiality. We keep appropriate technical and organisational measures in place under Article 32, including encryption in transit, encrypted storage, access controls that keep each business's data to that business, unguessable single-purpose links for people outside your account, and logging of access to sensitive records.

5. Sub-processors

You give general authorisation for us to use the sub-processors listed in section 11 of our Privacy Policy (hosting and database, email and text delivery, payments, error monitoring and the like). We will update that list and give you at least 14 days' notice by email before adding or replacing one, so you can object. If you object on reasonable data protection grounds and we cannot resolve it, you may end your subscription and we will refund any prepaid, unused period. Each sub-processor is bound by data protection terms no weaker than these, and we remain responsible to you for what they do.

6. Helping you

We will help you, taking into account what we can reasonably do, to answer requests from people exercising their rights (access, correction, deletion and the rest), and with your obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner. If someone contacts us directly about data you control, we will pass the request to you and not answer it ourselves, unless the law requires us to.

7. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 48 hours, with what we know about what happened, the data and people affected, the likely consequences and what we are doing about it, and keep you updated as we learn more.

8. When you leave

When your subscription ends you can export your data first. We then delete it, or return it if you ask, within 90 days, except where UK law requires us to keep it (for example tax records, as described in our Privacy Policy), in which case we keep only what is required, only for as long as required, and process it for no other purpose.

For letting agents and landlords, tenants' contact details on a repair are removed automatically six years after the repair is closed, while your subscription continues. The repair record itself stays with you.

9. Transfers outside the UK

Where a sub-processor handles data outside the UK, we make sure the transfer is covered by UK adequacy regulations or appropriate safeguards such as the International Data Transfer Addendum.

10. Checking we keep to these terms

We will give you the information you reasonably need to show that these terms are being kept, and answer reasonable written questions about our security. Where that is not enough, we will allow an audit by you or an auditor you appoint, on reasonable notice, no more than once a year, under confidentiality, and at your cost.

11. Contact

Questions about these terms: [email protected]. If these terms and the Terms of Service conflict on how personal data is processed, these terms win.