Data Processing Addendum
How TenantLoop processes personal data on behalf of customers.
Version: draft, not yet effective
1. Roles
This Data Processing Addendum ("DPA") forms part of the Terms of Service. For personal data that customers put into TenantLoop ("Customer Personal Data"), the customer is the business or controller and TenantLoop is the service provider or processor.
2. Instructions
We process Customer Personal Data only to provide the Service, on the customer's documented instructions (including configuration in the app), and as the law requires. We will not sell it or use it for our own advertising.
3. Confidentiality and security
Staff with access are bound by confidentiality. We maintain technical and organizational measures including encryption in transit and at rest, role-based access, logging, backups, vulnerability management and incident response. [Attach a security measures annex.]
4. Subprocessors
Customers authorize the subprocessors listed on our Subprocessors page. We will give notice of new subprocessors at least [30] days in advance so customers can object on reasonable grounds. We remain responsible for our subprocessors.
5. Data subject requests
We will help customers respond to requests from tenants, owners and others to access, correct or delete their data, mainly through in-app tools.
6. Security incidents
We will notify affected customers without undue delay after confirming a security incident involving Customer Personal Data, and share the information they need to meet their obligations.
7. International transfers
Data is hosted in [United States]. Where data protection law requires transfer safeguards, we use approved mechanisms such as standard contractual clauses.
8. Deletion and audits
At the end of the agreement we delete or return Customer Personal Data, except where the law requires us to keep it. We will provide reasonable information to show compliance, such as security reports or questionnaires.