Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between REMI SOFTWARE LTD ("Remi", "we", "us") and the agency or organisation that creates an Account ("Customer", "you"). It applies where Remi processes personal data for the Customer as processor under Article 28(3) of the UK GDPR.

Company number: 17336425
Registered office: 17a Impact Brixton, Electric Lane, London, United Kingdom, SW9 8LA
Contact: hello@remi.properties
Website: remiproperties.co.uk

1. Subject matter and duration

The subject matter is the provision of Remi's property-maintenance management platform. Processing continues for the Customer's active subscription and for the applicable export, deletion, and backup periods described in the Privacy Policy, unless a longer period is required by law.

2. Nature and purpose of processing

Remi processes personal data to receive, store, organise, display, triage, communicate about, assign, track, and report on maintenance requests, and to provide related account support and security.

3. Data and data subjects

The processing may include names, contact details, property addresses and details, maintenance descriptions, tenant photographs, contractor details, job history, audit logs, and other data the Customer submits through the service. Data subjects may include tenants, property owners, agency staff, contractors, and other contacts added by the Customer.

4. Customer instructions

Remi will process Customer-controlled personal data only on the Customer's documented instructions, including the Customer's use of the service and this DPA, unless required to do otherwise by applicable law. Where permitted, Remi will inform the Customer before carrying out such legally required processing.

5. Confidentiality and security

Remi will ensure that people authorised to process Customer-controlled personal data are subject to confidentiality obligations. Remi will implement appropriate technical and organisational measures under Article 32 of the UK GDPR, including access controls, account isolation, encrypted connections, password protection, and measures appropriate to the risks presented by processing.

6. Sub-processors and international transfers

The Customer authorises Remi to use the sub-processors listed in the Sub-processors register. Remi will impose written terms on each sub-processor that provide materially equivalent data-protection obligations. Remi will provide at least 30 days' email notice before adding or replacing a sub-processor. Processing-location information is available during customer due diligence where it has not been verified for publication.

7. Assistance

Taking into account the nature of processing, Remi will provide reasonable assistance to help the Customer respond to data-subject rights requests. Remi will also provide reasonable information and assistance to support the Customer's obligations relating to security, personal-data breaches, data protection impact assessments, and consultation with supervisory authorities.

8. Personal-data breaches

Remi will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer-controlled personal data, and will provide available information reasonably needed for the Customer to assess and respond to the breach.

9. Deletion and return

On termination, Remi will delete or return Customer-controlled personal data in accordance with the Customer's instructions and the retention arrangements in the Privacy Policy, unless retention is required by law.

10. Information and audits

Remi will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to reasonable audits and inspections by the Customer or its appointed auditor, subject to reasonable notice, confidentiality obligations, and measures to protect the security and confidentiality of other customers.

11. Contact

Questions about this DPA can be sent to hello@remi.properties.