Data Processing Addendum

Last updated: August 2022

Capitalised terms used in this Addendum shall have the meaning given to them in: (1) the Terms of Service and Terms of Use (together, the “Agreement”); and (2) for any terms not defined in the Agreement, the UK General Data Protection Regulation.

Our roles

You acknowledge that:

1. You are the Controller and TouchRight Software Ltd. (hereinafter, “TouchRight”) is the Processor for any Personal Data you enter into the TouchRight Web and Mobile App (which, for the avoidance of doubt includes all of our current or future websites or mobile applications), or you instruct us to Process on your behalf;
2. You retain control of the Personal Data and remain responsible for your compliance obligations under any applicable legislation relating to the Personal Data, and you warrant that you have obtained all rights and consents and provided all notices necessary for TouchRight to Process the Personal Data in accordance with the Agreement;
3. Where TouchRight Processes Personal Data relating to the relationship between different customers, it is possible that each customer is a Controller in relation to aspects of that Personal Data and that TouchRight will be under an obligation to retain and Process such Personal Data in accordance with the instructions of a continuing customer; and
4. TouchRight may anonymise the Personal Data so that it is no longer capable of identifying a living individual and therefore no longer constitutes Personal Data. TouchRight may then use such anonymised data for its own purposes.

TouchRight’s obligations

In respect of all Personal Data we process as a Processor under the Agreement, we shall:

1. Only process that Personal Data on your documented instructions (which shall include the terms of the Agreement) unless otherwise required to do so under applicable law, in which case, we shall, where lawfully able to do so, provide prior notice;
2. Ensure that persons authorised to process the personal data are subject to requirements of confidentiality;
3. Inform you if, in our opinion, your instructions would be in breach of applicable law;
4. Provide reasonable assistance to you to conduct a privacy impact assessment where required under applicable law;
5. Provide reasonable assistance to you in relation to communications with and notifications to supervisory authorities and data subjects;
6. Implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, or accidental loss, alteration, unauthorised disclosure or access;
7. Notify you promptly in the event of a security breach leading to the accidental or unauthorised loss, alteration or disclosure of Personal Data;
8. Only transfer Personal Data abroad by taking such measures as are reasonably required for the transfer to comply with applicable law.

On request, we will provide you with details of any subcontractors who are processing Personal Data in accordance with this Agreement (“Sub-processor”). You grant us a general authorisation to appoint Sub-processors. We shall give prior notice of any intended addition or replacement to the
Sub-processors. If you reasonably object to the change, we shall take reasonable steps to address those concerns and the parties shall work together to reach a resolution. We will have in place a contract with any Sub-processors, which imposes obligations that are equivalent to those set out in this Addendum.

At your reasonable request, we will provide evidence of our compliance with this Addendum.

On termination of the Agreement, subject to any rights of any other Controllers in relation to the Personal Data, we will delete the Personal Data and only retain a copy of it if required by applicable law.

The scope of the Processing carried out under this Agreement is as follows: as required in our performance of the Agreement, for the term of this Agreement.

The types of Personal Data Processed under this Agreement are:

a. Name and job title,
b. Contact information, including email address and phone number,
c. Demographic information, such as postcode,
d. Other information relevant to customer surveys and/or offers,
e. In respect of the Lone Worker feature, location data whilst using the App; and
f. When you subscribe to TouchRight, you agree to supply and add information relating to your property portfolio including: landlord name, property address, landlord email address, landlord telephone number, tenant name, tenant email address, tenant telephone number and property photographs.

The categories of Data Subject Processed under this Agreement are:
a. landlords
b. your personnel (including without limitation your employees, consultants and contractors)
c. your tenants
d. your customers and the occupants of any property in your property portfolio (if other than tenants).

It is not anticipated that special category Personal Data will be processed.