Data processing agreement

This Data Processing Agreement forms part of the Terms of Service between Web and Cloud Innovation Ltd ("the Processor", "we") and the Customer ("the Controller", "you") and governs the processing of personal data through the Service.

It is written to satisfy Article 28 of the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), which applies to us because we are established in Malta; Article 28 of the GDPR as it forms part of the law of the United Kingdom (the "UK GDPR"); the Swiss Federal Act on Data Protection (the "FADP"); and the United States state consumer privacy laws that require a contract with a service provider or processor, such as the California Consumer Privacy Act as amended (the "CCPA"). Together, and with any other data protection law that applies to the processing, these are "Data Protection Law". Where two of them differ, we perform the stricter obligation.

1Roles

You are the controller of the personal data you put into the Service — the "business" for the purposes of the CCPA. You decide what is collected, why, and for how long it is kept.

We are the processor — the "service provider" or "processor" for the purposes of the CCPA and the other US state laws. We process personal data only to provide the Service to you.

Where you are yourself a processor acting for another controller, you warrant that your instructions to us are authorised by that controller, and we act as your sub-processor.

Where we decide something for ourselves — our own billing records, our own security logs, our own staff — we are a controller of that data, and our Website and customer privacy notice covers it.

2Instructions

We process personal data only on your documented instructions, which are: this agreement, the Terms of Service, the configuration and settings of your own installation, and anything else you ask us in writing.

We will tell you promptly if we believe an instruction breaches Data Protection Law. We are not obliged to carry out an instruction that would.

Where the law requires us to process personal data for another reason, we will tell you before doing so unless that law forbids it on important grounds of public interest.

3What We Will Not Do With It

We will not sell or share the personal data, as the CCPA uses those words, and we will not use it for targeted or cross-context behavioural advertising.

We will not retain, use or disclose it for any purpose other than the business purposes set out in Annex 1, or outside the direct business relationship between us.

We will not combine it with personal data we receive from anyone else, or collect ourselves, except as Data Protection Law permits a service provider to.

We will not use it, or anything derived from it, to train an artificial intelligence model.

We will tell you if we can no longer meet our obligations under the CCPA or this clause. You may then take reasonable and appropriate steps to stop and remedy any unauthorised use. We certify that we understand these restrictions and will comply with them.

4Confidentiality

Every person who is authorised by us to process your personal data is bound by a duty of confidence that survives the end of their engagement, and is given access only to what their work requires.

5Security

We apply the technical and organisational measures set out in Annex 2, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to the people concerned.

We may change a measure for one that is at least as protective. We will not weaken the overall level of protection.

6Sub-Processors

You give us general authorisation to engage the sub-processors named in the Sub-processor list, which forms part of this agreement.

We impose on each sub-processor, by written contract, data protection obligations that are no less protective than these, and we remain fully liable to you for their performance.

We will tell you at least thirty (30) days before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, we will work with you to find a solution, and if none can be found you may terminate the affected part of the Service without penalty and receive a refund of fees paid for the period after termination.

7The Rights Of The People Concerned

The Service is built so that you can answer a request yourself: every record can be read, corrected, exported and deleted from within it, and the audit log shows who has seen a document.

Where a person contacts us directly about data we hold for you, we will not answer for you. We will pass the request to you without undue delay and help you to answer it.

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures with requests to exercise rights of access, rectification, erasure, restriction, portability and objection, and with the equivalent rights under the UK GDPR, the FADP and the US state laws — including a request to know, to delete or to correct.

8Breach

We will notify you without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting your personal data.

The notification will describe, as far as we know it at the time: what happened, when, the categories and approximate number of people and records concerned, the likely consequences, the contact point from whom more can be learned, and the measures taken or proposed. We will keep you updated as we learn more.

You remain responsible for notifying your supervisory authority and the people concerned where the law requires it. Under the GDPR and the UK GDPR the authority is told within seventy-two (72) hours of your becoming aware; the FADP asks for notice as soon as possible; the US state breach laws each set their own period and their own threshold. We will give you what you need to do it in time.

We will also assist you, so far as is reasonable, with data protection impact assessments and prior consultations with a supervisory authority.

9Deletion And Return

On the end of the Service, and at your choice, we will return your personal data to you or delete it, in the way and within the periods set out in the Terms of Service.

Backups already taken are deleted as they age out of the rotation, and are not restored except to recover the Service. Where the law requires us to keep something, we keep only that, and only for as long as required.

10Audit

We will make available to you the information reasonably necessary to demonstrate compliance with this agreement and with Article 28 of the GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint.

An audit may be requested once in any twelve (12) month period, after a breach affecting your data, or when a supervisory authority requires it, on thirty (30) days' notice, at a reasonable time, without unreasonable disruption, subject to confidentiality, and at your cost unless the audit finds a material breach by us.

11International Transfers

The Service is operated from Malta, in the European Union, and installations are hosted in Germany. Your data may be processed there and by the sub-processors named in the Sub-processor list. We will not transfer it to another country except as this clause allows.

From the European Economic Area — where personal data protected by the GDPR is transferred to a country without an adequacy decision, the transfer is made under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs"), together with any supplementary measures the transfer requires. Where we transfer to a sub-processor, Module Three applies between us and the sub-processor. Where you are established outside the European Economic Area and we return or make available your data to you, Module Four applies between us, and this agreement is incorporated into it.

For the EU SCCs, the following choices apply: the docking clause in Clause 7 applies; under Clause 9, Option 2 (general written authorisation) applies, with the notice period in clause 6 of this agreement; the optional wording in Clause 11 does not apply; under every module, Clause 17 chooses the law of Malta and Clause 18 the courts of Malta. Annexes 1, 2 and 3 of this agreement are the annexes the EU SCCs require. The competent supervisory authority is the Information and Data Protection Commissioner of Malta.

From the United Kingdom — the International Data Transfer Addendum to the EU SCCs, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, applies to a restricted transfer under the UK GDPR, with the tables completed from this clause and the annexes, and neither party may end the Addendum when it changes.

From Switzerland — the EU SCCs apply with the adaptations the Federal Data Protection and Information Commissioner requires: the FADP is read in place of the GDPR, the Commissioner is the competent supervisory authority for transfers governed by the FADP, and a person in Switzerland may bring a claim in Switzerland.

If a public authority asks us for your personal data, we will tell you before we disclose it unless the law forbids us to, we will disclose only what is legally required, and we will challenge a request we reasonably consider unlawful.

12Liability And Precedence

The limitations of liability in the Terms of Service apply to this agreement, except where the law, or the Standard Contractual Clauses, do not permit them to.

If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails. If it conflicts with the EU SCCs or the UK Addendum, those prevail.

This agreement is governed by the law that governs the Terms of Service, except where Data Protection Law or the Standard Contractual Clauses require another.

Annex 1 — What Is Processed

The parties — the data exporter is the Controller and the data importer is the Processor, each as named above, with the contact details held in the Service. Their signatures are the acceptance record below.

Subject matter — the provision of the Service described in the Terms of Service.

Duration — for as long as the subscription lasts, plus the deletion periods in the Terms of Service.

Frequency — continuous, for as long as the Service is used.

Nature and purpose, which are also the business purposes under the CCPA — hosting, storage, display, transmission, backup, encryption, and automated reading of uploaded documents to copy their printed details into a record, all to provide the Service to you.

Categories of data subjects — your tenants and guests and the people living with them; your staff, applicants and former staff; your contractors and suppliers; your visitors and callers recorded at the gate; the people you name as emergency or reference contacts; your own administrators and users.

Types of personal data — names and contact details; addresses and unit occupancy; identification documents and the numbers on them; dates of birth; nationality where a form asks; bank and payment details; employment terms, wages, attendance, performance and disciplinary records; tenancy terms, charges, payments and arrears; photographs of property, receipts and incidents; vehicle plates; signatures, and the time, network address, device and — where the person allows it — the location at which a document was signed; sign-in records.

Special categories and sensitive data — the Service is not intended for the special categories of personal data in Article 9 of the GDPR, nor for data about criminal convictions and offences, and you should not put them there. National identification numbers, a precise location reading and account credentials are "sensitive personal information" under the CCPA and are subject to national rules under Article 87 of the GDPR; they are handled as Annex 2 describes, and are not used to infer anything about anybody.

Annex 2 — Technical And Organisational Measures

Separation — each business is served from its own database file. There is no shared table from which one customer's rows could be returned to another.

Encryption in transit — the Service is served over HTTPS, with strict transport security requested by every page.

Encryption at rest — uploaded identification documents, receipts and signed papers are encrypted with a symmetric key held on the server, outside the folders that are mirrored offsite, so that a copy of a backup does not carry the means to read them.

Access control — named accounts, roles and per-function capabilities; an authenticator-app second factor available on every account and enforceable for administrators; sign-in throttling that defends both an address and an account after repeated failures; sessions that are regenerated at sign-in, expire, and carry cookies that script cannot read.

Accountability — an append-only audit log of sign-ins, document views, record changes and administrative actions, readable by you.

Application hardening — a content security policy that refuses foreign scripts and framing, output escaping, prepared statements throughout, tokens on every state-changing form, and internal directories refused by the web server.

Resilience — nightly database snapshots, an offsite copy under separate access, and error logs retained so that an incident can be reconstructed.

Organisational — a documented incident procedure, confidentiality obligations on everyone with access, and a policy of least privilege for administrative access to the servers.

Annex 3 — Sub-Processors

As set out in the Sub-processor list, which is published with these documents and forms part of this agreement.

13Acceptance Record

Accepted by: —
Business: the Customer
Document version: (shown in the margin)
Document fingerprint: (shown in the margin)
Accepted at: —
Network address: —
Device: —
Acceptance record: —