Data Processing Agreement

1. Roles and scope

The customer organisation determines the purposes and means of processing the personal data it records in Verixad (typically details of landlords, tenants, applicants, contractors and team members) and is the controller. Verixad processes that data only to provide the service described in the Terms of Service, on the customer’s documented instructions as expressed through their use of the product, and is the processor.

Verixad processes personal data only on those instructions, including in relation to transfers outside the UK. If Verixad forms the view that an instruction would breach UK data protection law, it will say so to the customer rather than carry it out silently. Where this agreement and the Terms of Service disagree about the handling of personal data, this agreement governs. It applies for as long as Verixad holds the customer’s data.

2. What is processed

Data subjects: the customer’s team members, landlords, tenants, applicants, contractors and other contacts the customer records. Categories: names, contact details, tenancy and property records, compliance documents and their contents, maintenance and screening records, and communications the customer logs or sends. Verixad does not require, and asks customers not to store, payment card numbers, bank credentials or full credit files; the product is designed so records of identity checks can be held as the fact that a check happened rather than the underlying documents.

3. Security measures

Every organisation’s records are segregated at the database layer by row level security, and uploaded files live in private storage reachable only through signed URLs that expire quickly and are scoped to the organisation. Data is encrypted in transit and at rest. Access within a customer organisation is governed by that organisation’s own roles and permissions. Verixad’s own administrative access works on account information; it reaches an organisation’s records only under that organisation’s support grant (section 4). It is protected by multifactor authentication and recorded on an audit trail that can only be added to, never edited.

4. Verixad staff access

Verixad’s operators cannot browse customer records. Support access to an organisation’s records exists only when that organisation’s owner grants it from their own settings, and only the operators whose role is to answer customers can use it. Each grant is scoped (read only, or read together with the fixes the customer asks for: bringing back something deleted, or rerunning a document reading that failed), lasts no more than 30 days and records the reason, and every grant, past and present, remains visible to the customer. Every record opened and every fix made under a grant is logged. Routine operation uses account information only: plan, usage, counts, billing state, the sign in details of the organisation’s users, email delivery, and what the customer sends to Verixad.

Direct access to the underlying database and hosting is held by the person who runs the service, protected by multifactor authentication, and used only to operate, repair or restore it, to investigate a security issue, or to comply with the law.

5. Confidentiality

Everyone at Verixad who could reach customer data is bound to keep it confidential, by their contract of engagement and for as long after it ends as the obligation can lawfully run. That duty is separate from the access controls in section 4: the controls are what make access rare, and this is what binds the few people who have it.

6. Subprocessors

Verixad uses the following subprocessors to run the service. The customer gives a general authorisation for these and for any replacement. We will update this page before adding or replacing a subprocessor, and a customer who objects may terminate under the Terms. Each subprocessor is engaged under a written contract placing obligations on it that are equivalent to the ones in this agreement, and Verixad remains responsible to the customer for what its subprocessors do.

7. AI features

Two features use an AI subprocessor: document reading, and the assistant built into the app. Each runs on an action by a user in the customer’s organisation, so each use is an instruction from the customer to process that data for that purpose: a document is read when a user uploads it with their own “Read uploaded files” setting on (it is on by default and each user can turn it off), asks for it to be read, or adds it through Add your data; the assistant runs when a user asks it a question. Only users whose role allows them to add or edit documents can have a document read, and the customer decides those roles; Verixad support reruns a reading that failed only when the customer’s owner has granted support access that allows it. Emailed documents are not read automatically and spreadsheets are never sent. Only what the feature needs is sent, not the organisation’s wider records, and the provider’s commercial terms do not permit training on the data. There is no organisation wide setting that turns document reading off.

What these features produce is a suggestion, not a finding. Output is shown for a person to accept, edit or reject, is recorded with its provenance, and never alters a record by itself. Verixad makes no automated decision producing legal effects concerning a person, or similarly significantly affecting them, so Article 22 of the UK GDPR is not engaged. Customers should not rely on an AI suggestion without checking it, and remain responsible for any decision they take after reading one.

8. Assistance, breach notification and audits

Verixad assists the customer in meeting their own obligations: the product lets the customer export the organisation’s records themselves as a JSON file, with every document file downloadable together as a ZIP file, and gives access record by record that is suitable for responding to data subject requests. If Verixad becomes aware of a personal data breach affecting a customer’s data, it will notify that customer without undue delay with the information available. Customers may reasonably request written information about the measures in this agreement; audits beyond that are by arrangement, on reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, and subject to confidentiality.

Verixad also assists the customer, so far as it reasonably can and given the information available to it, with the customer’s own duties on security, on notifying a breach to the Information Commissioner or to affected people, on data protection impact assessments, and on any prior consultation with the regulator that follows from one. Where a data subject contacts Verixad directly, Verixad will not answer on the customer’s behalf: it will tell the person who holds their records and pass the request to the customer.

9. Retention, return and deletion

Service data is retained for as long as the organisation’s account exists. Records the customer deletes are recoverable by the customer for 60 days and then permanently removed, files included. Deleting an organisation is an action only the customer can start, and it has a cooling off period of seven days. When it completes, every record and file belonging to that organisation is permanently removed. What remains is a record of the deletion itself (organisation, date, requester), the billing records Verixad keeps as its own records under UK law, support correspondence for the period stated in the Privacy Policy, and the personal accounts the organisation’s members sign in with, which are not removed because a person can belong to more than one organisation. Customers can export their records themselves at any time before either happens.

At the end of the service the choice is the customer’s: they may take their data back, or have it deleted. Export is available in the product throughout, so a customer who exports and then deletes their organisation has done both. If a customer asks for the data to be returned another way, Verixad will provide it within 30 days of the request. After the deletion completes, Verixad keeps no copy except where UK law requires one, and backups age out on their own retention cycle rather than being edited, which is stated here because a claim of instant erasure from backups would not be true of any system of this kind.

10. Where Verixad acts as a controller

Not everything Verixad does with data sits inside the processor role, and saying so is cleaner than blurring it. Verixad is the controller for the account and billing records of the agency staff who sign up (a tenant’s or contractor’s portal login is the customer’s, under this agreement), for the security and audit logs it keeps to protect the service, and for its own correspondence with customers. Those are Verixad’s decisions, made for Verixad’s purposes, and the Privacy Policy sets out the lawful basis for each. Everything the customer puts into the service about properties, tenancies and people remains the customer’s, under this agreement.

11. What the customer is responsible for

As controller, the customer decides why and how the data is processed, and the duties that follow are theirs:

• Having a lawful basis for everything they record, and giving Verixad lawful instructions.
• Giving their own privacy notice to the tenants, applicants and contractors whose details they enter. Verixad’s policy explains Verixad’s part; it is not a substitute for the customer’s notice, and a tenant asking about their data will be pointed back to the customer.
• Registering with the Information Commissioner where the law requires it of them.
• Answering subject access requests and other rights requests about their own records.
• Keeping the data accurate, and deciding who in their organisation may see it.
• Not storing what this agreement asks them to keep out, including payment card numbers, bank credentials and full credit files, and not putting criminal offence or health data into free text fields where it does not belong.

12. International transfers

Service data is hosted in the European Union. Where a subprocessor processes data outside the UK or EU (for example, email or AI processing), transfers rely on that provider’s standard contractual safeguards.

13. Getting a signed copy

This page is the current DPA and applies automatically to every customer. If your organisation needs a countersigned copy for its own records, contact us and we will provide one.