This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, our Terms of Service. A landlord accepting the Terms of Service also accepts this DPA — no separate signature is required. It reflects our obligations to you under Article 28 of the UK GDPR wherever you (the landlord) act as a data controller of your tenants' personal data and we act as your data processor.

For personal data about your tenants that you enter into, or that is generated within, the Service (contact details, vetting/compliance records, tenancy and payment history, uploaded documents), you are the controller and Tenarize is the processor. For your own account data as a landlord, Tenarize is the controller — see our Privacy Policy.

We process tenant personal data for as long as your landlord account exists (or until you request deletion of the relevant property/tenancy, subject to the notice period described in our Privacy Policy), for the purpose of operating the Service on your instructions: tenant vetting and compliance tracking, tenancy agreement generation and e-signature, rent collection, document storage, and related notifications.

Data subjects: your tenants (and, where relevant, guarantors or referees named in vetting records).

Categories of personal data: name, contact details, right-to-rent/immigration status flags, financial and bank-mandate details (processed by Stripe as a sub-processor, not held by us directly), and documents uploaded as part of vetting, compliance, or the tenancy itself (e.g. ID, references, signed agreements, inventories, meter readings).

• Process tenant personal data only on your documented instructions (as given through your use of the Service), unless required to do otherwise by law;
• ensure staff with access to the data are subject to confidentiality obligations;
• implement appropriate technical and organisational security measures — see our Security page;
• only engage the sub-processors listed below, and give advance notice of any intended change so you can object;
• assist you, so far as reasonably possible, in responding to a data subject's request to exercise their rights, and in any data protection impact assessment concerning the Service;
• notify you without undue delay if we become aware of a personal data breach affecting your tenants' data;
• on request, delete or return tenant personal data at the end of the relationship, consistent with the deletion and document-download flows described in the app and our Privacy Policy; and
• make available the information reasonably necessary to demonstrate compliance with this DPA.

Some sub-processors below process data outside the UK. Where that happens, we rely on an adequacy regulation, the UK International Data Transfer Addendum, or the sub-processor's own equivalent safeguard as the transfer mechanism.

OpenFreeMap serves only the map imagery itself. No tenant or landlord data is sent to it — a tile request conveys the area of the map being viewed and nothing more — and it does not log IP addresses in normal operation. It is listed here for completeness rather than because it receives personal data from the Service.

Questions about this DPA: info@tenarize.com.