Data Processing Addendum
Last updated: July 2024.
Notice
This Data Processing Addendum (the “DPA”) applies to the extent that Plentific Ltd ("Plentific") processes Personal Data on behalf of property management companies, landlords, tradespeople, contractors and others (each a "Customer") in the course of providing Services. This DPA does not apply where Plentific is the Data Controller
DPA
Background
A. The Customer and Plentific have entered into an agreement that may require Plentific to process Personal Data on behalf of the Customer (“Agreement”).
B. This DPA sets out the additional terms, requirements and conditions on which Plentific will process Personal Data when providing services under the Agreement. This DPA contains the mandatory clauses required by Article 28(3) of the UK retained version of General Data Protection Regulation for contracts between controllers and processors.
1. Definitions and Interpretations
1.1. This DPA is subject to the terms of the Agreement and is incorporated into the Agreement. Interpretations and defined terms set forth in the Agreement apply to the interpretation of this DPA.
1.2. The Annexes form part of this DPA and will have effect as set if set out in full in the body of this DPA. Any reference to this DPA includes the Annexes.
"Data Controller” means the person who, alone or jointly with others, determines the purposes for which and the manner in which any Personal Data are Processed.
"Data Processor” means any person (other than an employee of a Data Controller) who Processes Personal Data on behalf of a Data Controller.
"Data Protection Legislation” means the Data Protection Act 2018 and any other applicable legislation in relation to the processing of personal data under the Agreement.
“Digital Platform” means https://plentific.com/, https://www.xtaggroup.co.uk/, activehousing.co.uk and any other URL notified to the Customer by Plentific from time to time and the content and all sub-domains of each such URL.
“End-Users” means, where the Customer is a property management company or landlord, the tenants and other occupiers of the Customer’s properties.
“Personal Data” means all User and End-User data: (i) which relates to an identified or identifiable natural person and (ii) in respect of which the Customer is the Data Controller and (iii) which will be Processed by Plentific in connection with this Agreement, as more particularly described in the Agreement.
“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Personal Data.
“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"Services” means the services provided by Plentific to the Customer under the Agreement.
"Sub-Processor” means another processor engaged by Plentific for carrying out Processing activities in respect of the Personal Data on behalf of the Customer.
“User” means each Customer’s employee, representative, consultant, contractor or agent who is authorised to use the Service and has been supplied with user account details and a password by the Customer (or by Plentific at the Customer’s request).
2. Personal Data Types and Processing Purposes
2.1. The Customer and Plentific acknowledge that for the purpose of the Data Protection Legislation, the Customer is the Data Controller and Plentific is the Data Processor.
2.2. The Customer retains control of the Personal Data and remains responsible for its compliance obligations under the Data Protection Legislation, including establishing a lawful basis for Processing, providing any required notices and obtaining any required consents, providing full information to any data subject whose Personal Data may be Processed under the Agreement, and for the processing instructions it gives to Plentific.
2.3. Where the Personal Data relates to End-Users, the Customer warrants that it shall only enter or include such Personal Data in the Service in specifically designated form fields as identified by Plentific. The Customer acknowledges that if it enters such data in other locations, the data may be retained for as long as Plentific has a continuing Customer in relation to the data location used (as set out in clause 11.4).
2.4. ANNEX A describes the subject matter, duration, nature and purpose of processing and the Personal Data categories and data subject types applicable to the Service.
3. Plentific’s Obligations
3.1. Subject to clause 3.6, Plentific will only process the Personal Data to the extent, and in such a manner, as is necessary for the provision of the Service in accordance with the Customer's written instructions. Plentific will not process the Personal Data for any other purpose or in a way that does not comply with this DPA or the Data Protection Legislation. Plentific must promptly notify the Customer if, in its opinion, the Customer's instruction would not comply with the Data Protection Legislation.
3.2. Subject to clauses 2.3 and 11.4, Plentific must promptly comply with any Customer request or instruction requiring Plentific to amend, transfer, delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised processing.
3.3. Plentific will maintain the confidentiality of all Personal Data and will not disclose Personal Data to third parties unless the Customer or this DPA specifically authorises the disclosure, or as required by law. If a law, court, regulator or supervisory authority requires Plentific to process or disclose Personal Data, Plentific must first inform the Customer of the legal or regulatory requirement and give the Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice.
3.4. Plentific will reasonably assist the Customer with meeting the Customer's compliance obligations under the Data Protection Legislation, taking into account the nature of Plentific's processing and the information available to Plentific, including in relation to data subject rights, data protection impact assessments and reporting to and consulting with supervisory authorities under the Data Protection Legislation.
3.5. Plentific must promptly notify the Customer of any changes to Data Protection Legislation that may adversely affect Plentific's performance of the Agreement.
3.6. Plentific may anonymise the Personal Data so that it is no longer capable of identifying a living individual and therefore no longer constitutes Personal Data. Plentific may then use such anonymised data for its own purposes.
4. Plentific’s Employees
4.1. Plentific will ensure that all employees:
4.1.1. are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data;
4.1.2. have undertaken training on the Data Protection Legislation relating to handling Personal Data and how it applies to their particular duties; and
4.1.3. aware of both Plentific's duties and their personal duties and obligations under the Data Protection Legislation and this DPA.
5. Security
5.1. Plentific must at all times implement appropriate technical and organisational measures against unauthorised or unlawful processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data.
5.2. Plentific will maintain policies on:
5.2.1. the pseudonymisation and encryption of Personal Data;
5.2.2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
5.2.3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
5.2.4. a process for regularly testing, assessing and evaluating the effectiveness of security measures.
6. Personal Data Breach
6.1. Plentific will promptly and without undue delay and in any event within 72 hours notify the Customer if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable.
6.2. Plentific will without undue delay notify the Customer if it becomes aware of:
(a) any accidental, unauthorised or unlawful processing of the Personal Data; or
(b) any Personal Data Breach.
6.3. Where Plentific becomes aware of (a) and/or (b) above, it shall, without undue delay, also provide the Customer with the following information:
(a) description of the nature of an occurrence falling within the provisions of clause 6.2(a) and/or (b), including the categories and approximate number of both data subjects and Personal Data records concerned;
(b) the likely consequences; and
(c) description of the measures taken or proposed to be taken to address the occurrence falling within the provisions of clause 6.2(a) and/or (b), including measures to mitigate its possible adverse effects.
6.4. Immediately following any unauthorised or unlawful Personal Data processing or Personal Data Breach, the parties will co-ordinate with each other to investigate the matter. Plentific will reasonably co-operate with the Customer in the Customer's handling of the matter, including:
(a) assisting with any investigation;
(b) providing the Customer with physical access to any facilities and operations affected;
(c) facilitating interviews with Plentific's employees, former employees and others involved in the matter;
(d) making available all relevant records, logs, files, data reporting and other materials required to comply with all Data Protection Legislation or as otherwise reasonably required by the Customer; and
(e) taking reasonable and prompt steps to mitigate the effects and to minimise any damage resulting from the Personal Data Breach or unlawful Personal Data processing.
6.5. Plentific will not inform any third party of any Personal Data Breach without first obtaining the Customer's prior written consent, except when required to do so by law.
6.6. Plentific agrees that the Customer has the sole right to determine:
6.6.1. whether to provide notice of the Personal Data Breach to any Data Subjects, supervisory authorities, regulators, law enforcement agencies or others, as required by law or regulation or in the Customer's discretion, including the contents and delivery method of the notice; and
6.6.2. whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.
7. Cross-Border Transfer of Personal Data
7.1. Plentific does not ordinarily transfer or otherwise process Personal Data outside the UK or the European Economic Area (the “EEA”) and shall only do so provided that Plentific ensures that such transfer (and any onward transfer): (i) is pursuant to a written contract including provisions relating to security and confidentiality of the Personal Data; (ii) is effected by way of a valid cross-border transfer mechanism under the Data Protection Legislation from time to time; and (iii) otherwise complies with Data Protection Legislation.
7.2. Where the Customer is based in the European Economic Area (“EEA”), the parties acknowledge that the provision of the Services will involve the transfer of Personal Data out of the EEA to the UK. The Customer hereby gives its consent to the transfer of the Personal Data to Plentific in the UK. The parties agree to take such steps as may be required to comply with Data Protection Legislation in relation to such transfer.
8. Sub-Processors
8.1. The Customer grants a general authorisation for Plentific to appoint Sub-Processors to the extent necessary as is needed to provide the Services to the Customer in accordance with the Agreement and as may be required by applicable law provided that Plentific:
8.1.1. only appoints Sub-Processors who offer sufficient contractual guarantees of their compliance with terms which are no less onerous than the terms set out in this Data Processing Addendum;
8.1.2. gives the Customer prior notice of the appointment of any new Sub-Processor, including details of the Processing to be undertaken by such new Sub-Processor (together with such other information or assistance as the Customer may reasonably request); and
8.1.3. provides the Customer with a reasonable period of notice to reasonably assess and object to the appointment of the Sub-Processor where the Customer has reasonable concerns. Where Plentific receives a reasonable written objection from the Customer in relation to the appointment of a Sub-Processor, both parties shall engage in good faith discussions to address the objection.
8.2. Plentific shall remain liable to the Customer where the Sub-Processor fails to fulfil its data protection obligations, as well as for any acts or omissions of the Sub-Processor in regard of its Processing of Personal Data.
8.3. The current list of Sub-Processors from time to time is available at List of Sub-Processors and Customer approves the use of such Sub-Processors as appear on the list at the date this DPA comes into force between the parties.
8.4. On the Customer’s reasonable written request, Plentific will audit a Sub-Processor’s compliance with its obligations regarding the Customer’s Personal Data and provide the Customer with the audit results.
9. Complaints, Data Subject Requests and Third Party Rights
9.1. Plentific must, at no additional cost, take such technical and organisational measures as may be appropriate, and promptly provide such information to the Customer as the Customer may reasonably require, to enable the Customer to comply with:
9.1.1. the rights of data subjects under the Data Protection Legislation, including subject access rights, the rights to rectify and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
9.1.2. information or assessment notices served on the Customer by any supervisory authority under the Data Protection Legislation.
9.2. Plentific must notify the Customer immediately if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party's compliance with the Data Protection Legislation.
9.3. Plentific must notify the customer within 30 days if it received a request from a data subject for access to his/her Personal Data or to exercise any of his/her related rights under the Data Protection Legislation.
9.4. Plentific will give the Customer its full co-operation and assistance in responding to any complaint, notice, communication or data subject request.
9.5. Plentific must not disclose the Personal Data to any data subject or to a third party other than at the Customer’s request or instruction, as provided for in this DPA or as required by law.
10. Term and Termination
10.1. This DPA will remain in full force and effect so long as:
10.1.1. the Agreement remains in effect, or
10.1.2. Plentific retains any Personal Data related to the Agreement in its possession of control.
10.2. Any provision of this DPA that expressly or by implication should come into or continue in force on or after the termination of the Agreement in order to protect Personal Data will remain in full force and effect.
10.3. Plentific's failure to comply with the terms of this DPA is a material breach of the Agreement. In such an event, the Customer may terminate any part of the Agreement authorising the processing of Personal Data effective immediately on written notice to Plentific without further liability or obligation.
10.4. If a change in any Data Protection Legislation prevents either Party from fulfilling all or part of its Agreement obligations, the Parties will suspend the processing of Personal Data until that processing complies with the new requirements. If the Parties are unable to bring the Personal Data processing into compliance with the Data Protection Legislation, either Party may terminate the Agreement on written notice to the other Party.
11. Data Return and Destruction
11.1. At the Customer’s request, Plentific will give the Customer a copy of or access to all or part of the Customer’s Personal Data in its possession or control in the format and on the media reasonably specified by the Customer.
11.2. Subject to clause 11.4, on termination of the Agreement for any reason, Plentific will securely delete or destroy or, if directed in writing by the Customer, return and not retain, all or any Personal Data in its possession or control, except as may be required by law, including the Data Protection Legislation.
11.3. If any law, regulation, or government or regulatory body requires Plentific to retain any documents or materials that Plentific would otherwise be required to return or destroy, it will notify the Customer in writing of that retention requirement, giving details of the documents or materials that it must retain, the legal basis for retention, and establishing a specific timeline for destruction once the retention requirement ends.
11.4. The parties acknowledge that Plentific operates as a marketplace where different parties can discover and transact with each other. All such parties may be Plentific’s customers for services and each may be a Customer under this DPA. Where Plentific Processes Personal Data relating to the relationship between different Customers, it is possible that each Customer is a Data Controller in relation to aspects of that Personal Data and that Plentific will be under an obligation to retain and Process such Personal Data in accordance with the instructions of a continuing Customer.
12. Audits
12.1. Plentific will permit the Customer and its third-party representatives to audit compliance with its Agreement obligations, on at least 30 days' notice, during the Term. Plentific will give the Customer and its third-party representatives all necessary assistance to conduct such audits. The assistance may include, but is not limited to:
12.1.1. physical access to, remote electronic access to, and copies of the records and any other information held at Plentific's premises or on systems storing Personal Data;
12.1.2. access to and meetings with any of Plentific's personnel reasonably necessary to provide all explanations and perform the audit effectively; and
12.1.3. inspection of all records and the infrastructure, electronic data or systems, facilities, equipment or application software used to store, process or transport Personal Data.
12.2. The notice requirements in clause 12.1 will not apply if the Customer reasonably believes that a Personal Data Breach occurred or is occurring, or Plentific is in breach of any of its obligations under this DPA or any Data Protection Legislation.
12.3. Plentific will promptly address any exceptions noted in the audit reports with the development and implementation of a corrective action plan by Plentific's management.
13. Warranties
13.1. Plentific warrants and represents that:
13.1.1. its employees, subcontractors, agents and any other person or persons accessing Personal Data on its behalf are reliable and trustworthy and have received the required training on the Data Protection Legislation relating to the Personal Data;
13.1.2. it and anyone operating on its behalf will process the Personal Data in compliance with the Data Protection Legislation and other laws, enactments, regulations, orders, standards and other similar instruments;
13.1.3. it has no reason to believe that the Data Protection Legislation prevents it from providing any of the Agreement's contracted services; and
13.1.4. considering the current technology environment and implementation costs, it will take appropriate technical and organisational measures to prevent the unauthorised or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Personal Data, and ensure a level of security appropriate to:
(a) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage;
(b) the nature of the Personal Data protected; and
(c) comply with all applicable Data Protection Legislation.
13.2. The Customer warrants that it has obtained all rights and consents necessary for Plentific to Process the Users’ and End-Users’ Personal Data in accordance with this Agreement, and has sole responsibility for ensuring the accuracy, quality, integrity, legality, reliability, relevance, and appropriateness of all such Personal Data.
13.3. Each Party warrants that it shall:
13.3.1. maintain such records in relation to the Processing of the Personal Data as is required under Data Protection Legislation, and, on request, make those records available to any supervisory authority or government authority;
13.3.2. provide such information as may reasonably be required by the other Party to comply with its obligations under Data Protection Legislation; and
13.3.3. on request, co-operate with any supervisory authority or government authority in relation to the Processing of Personal Data pursuant to this Agreement.
14. General
14.1. This Agreement constitutes the entire agreement between the parties in relation to the Processing of Personal Data and supersedes and extinguishes all previous agreements relating to the Processing of Personal Data.
ANNEX A – PERSONAL DATA PROCESSING PURPOSES AND DETAILS
Nature and purpose of processing: Plentific will Process Personal Data as necessary to provide the Service pursuant to the Agreement, and as further instructed by Customer in its use of the Service.
Duration of Processing: Subject to Section 11 of the DPA, Plentific will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Categories of Data Subjects: Customer may enter Personal Data in the
Digital Platform, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to:
● Users of Customers
● End-Users
Types of Personal Data: Customer may enter Personal Data in the Digital Platform, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to the following categories of Personal Data:
● First and last name
● Contact information (address, post code, telephone number, email)
● IP address
● Image(s) and Photograph(s)
● Device and browser
Sub-processors
List of sub-processors used by Plentific (as referred to in the DPA).
Last updated: July 2024
Approved Sub-processors:
● Aircall, Inc.
● Amazon Web Services, Inc.
● Auth0, Inc. (Okta, Inc.)
● Atlassian Pty Ltd.
● FullStory, Inc.
● GitHub, Inc.
● Google, Inc.
● Hevo Data, Inc.
● HotJar Limited
● HubSpot, Inc.
● Looker Data Sciences, Inc.
● MANGOPAY S.A.
● NetSuite Inc.
● Plentific GmbH
● Plentific Inc.
● Plentific Yazilim Anonim Şirketi
● Salesforce UK Limited
● Segment.io, Inc.
● SendGrid, Inc. (Twilio, Inc.)
● Slack, Inc.
● Snowflake, Inc.
● Stripe, Inc.
● Tray.io, Inc.
● Twilio, Inc.
