Tenant Answers Data Processing Agreement

1. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2. Instructions

The Processor will process personal data only on the Controller's documented instructions, including about transfers to a third country, unless required to do otherwise by law. In that case the Processor will tell the Controller of the legal requirement before processing, unless the law prohibits this. The Terms, this DPA and the Controller's use and configuration of the Service are the Controller's documented instructions. The Processor will tell the Controller immediately if, in its opinion, an instruction infringes Data Protection Law.

3. Confidentiality

The Processor will ensure that everyone it authorises to process the personal data is bound by a duty of confidentiality.

4. Security

The Processor will put in place the technical and organisational measures required by Article 32 of the UK GDPR, including those in Annex 2. The Processor may update those measures, provided the overall level of security is not reduced.

5. Sub-processors

The Controller gives general written authorisation for the Processor to engage the sub-processors listed in Annex 3. The Processor will give at least 30 days' notice of any intended addition or replacement by updating the list at tenantanswers.co.uk/Legal/Subprocessors and emailing the Controller's administrators. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected subscription and receive a refund of any fees paid for the period after termination. The Processor will impose on each sub-processor, by contract, data protection obligations no less protective than those in this DPA, and remains liable to the Controller for each sub-processor's performance of those obligations.

6. Data subject rights

Taking into account the nature of the processing, the Processor will help the Controller, by appropriate technical and organisational measures and as far as possible, to respond to requests from data subjects to exercise their rights. The Service gives the Controller tools to find, export, correct and delete personal data. If the Processor receives such a request directly, it will pass it to the Controller without undue delay and will not respond itself except on the Controller's instructions.

7. Assistance with the Controller's obligations

Taking into account the nature of the processing and the information available to it, the Processor will help the Controller meet its obligations under Articles 32 to 36 of the UK GDPR, covering security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner.

8. Personal data breaches

The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's personal data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor will provide further information as it becomes available and will take reasonable steps to contain and remedy the breach.

9. Deletion or return at the end of the service

At the Controller's choice, the Processor will delete or return all personal data after the end of the provision of the Service, and delete existing copies, unless the law requires storage. The Controller can export its data through the Service at any time during the subscription and for at least 30 days after it ends. After a verified deletion request, the Processor deletes the personal data from live systems within 30 days; backups expire in the ordinary course of backup rotation, within 35 days, and are not restored except for disaster recovery.

10. Information and audits

The Processor will make available to the Controller the information necessary to demonstrate compliance with Article 28 of the UK GDPR and this DPA, and will allow for and contribute to audits, including inspections, by the Controller or an auditor it appoints. The Processor will first meet audit requests by providing written answers and documentation. An on-site inspection may take place no more than once a year, on at least 30 days' notice, during business hours, at the Controller's cost, and subject to reasonable confidentiality and security conditions, unless a supervisory authority requires otherwise or a personal data breach makes it necessary.

11. International transfers

The Service is hosted in Microsoft Azure's UK West region. The Processor is established in the United States and accesses personal data from there to run and support the Service. To the extent that this is a restricted transfer under Data Protection Law, the parties enter into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 ("UK Addendum"), which is incorporated into this DPA as follows:

Table 1 (Parties): the exporter is the Controller and the importer is the Processor, with the contact details given in the Terms and in the Service. The start date is the date the Controller accepts the Terms.

Table 2 (Selected SCCs, Modules and Selected Clauses): the version of the Approved EU SCCs that the UK Addendum is appended to is Module Two (controller to processor) of the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914, with Clause 7 (docking clause) not included; Clause 9 option 2 (general written authorisation, with the notice period in Section 5 of this DPA); the optional wording in Clause 11 not included; and Clause 13 and Annex I.C applied as required by the UK Addendum.

Table 3 (Appendix Information): Annex 1A (list of parties) is the information in Table 1; Annex 1B (description of transfer) is Annex 1 of this DPA; Annex II (technical and organisational measures) is Annex 2 of this DPA; Annex III (list of sub-processors) is Annex 3 of this DPA.

Table 4 (Ending this Addendum when the Approved Addendum changes): neither party.

Where a sub-processor in Annex 3 processes personal data outside the United Kingdom, the Processor ensures the transfer is covered by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the sub-processor is certified to it, or by appropriate safeguards under Article 46 of the UK GDPR.

12. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow liability to be limited.

13. Duration

This DPA lasts for as long as the Processor processes personal data on the Controller's behalf.

Annex 1: Details of the processing

Subject matter and purpose: providing the Tenant Answers service, which lets the Controller receive, track and answer information requests under the Social Housing Tenant Access to Information Requirements, subject access requests under the UK GDPR, and complaints under the Housing Ombudsman's Complaint Handling Code; redact and release documents; publish a publication scheme and released information; and keep an audit trail.

Duration: the term of the Controller's trial and subscription, and the export and deletion periods in Section 9.

Nature of the processing: collection through the tenant portal and staff entry, storage, organisation, retrieval, text recognition and pattern matching to suggest redactions, redaction, transmission by email and secure download links, publication where the Controller chooses, export and deletion.

Categories of data subjects: tenants, residents and other people who make requests or complaints to the Controller; people named or identifiable in documents and correspondence the Controller uploads, including household members, neighbours, contractors and staff; and the Controller's staff and board members who use the Service.

Types of personal data: names, contact details and addresses; tenancy and property references; the content of requests, complaints and correspondence; information in uploaded documents, which can include identification numbers, financial details and, where the Controller chooses to upload it, special category data such as health information and information about children; and staff account and sign-in data.

Special category data: the Service does not require special category data, but the Controller may upload documents that contain it. The measures in Annex 2 apply to all data.

Frequency: continuous, for the duration of the subscription.

Annex 2: Technical and organisational measures

Hosting and encryption: the Service runs in Microsoft Azure's UK West region. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.

Separation: each customer's data is held in a separate tenant within the application and every query is filtered by that tenant, so one customer cannot see another's data.

Access control: staff of the Controller sign in with individual accounts, roles limit what each person can see and do, and two-step sign-in is available and can be required. The Processor's access to production systems is limited to named personnel, uses Microsoft Entra ID accounts with multi-factor authentication, and relies on managed identities rather than stored passwords or keys between Azure services.

Audit: the Service records an audit trail of actions on requests and documents, which the Controller can view and export.

Release safety: redacted release copies are flattened so that redacted content is removed from the file the tenant receives.

Resilience: the database and file storage are backed up automatically, and backups expire on a rolling basis.

Secure development: changes are reviewed and tested before release, dependencies are monitored for known vulnerabilities, and user-supplied rich text is sanitised.

People: personnel with access to personal data are bound by confidentiality obligations.

Annex 3: Sub-processors

Microsoft Corporation and Microsoft Ireland Operations Limited: cloud hosting, database and file storage. Processing location: United Kingdom (Azure UK West).

Twilio Inc. (SendGrid): delivery of emails sent by the Service to tenants and staff, which include names, email addresses and message content. Processing location: United States. Transfer basis: Twilio Inc. is certified to the UK Extension to the EU-US Data Privacy Framework.