Data processing agreement

Where this stands today

A signed agreement is available on request. It is not yet something you can download, complete and sign for yourself, and there is no executed agreement published on this site.

Write to us and we will send the current text, fill in the details for your agency and sign it.

This page is the summary. The signed document is what governs, and where the two differ, the document does.

Who is who

The agency decides which clients it records, why, and what it does with them. Those decisions are the agency's and it answers for them.

We hold and process that data on the agency's behalf and on its instructions, in order to provide the service described on these pages.

What is processed, and for how long

The agreement sets this out formally. In plain terms:

• The purpose: running an agency's diary, its client and property records, and the reminders attached to its appointments.
• The duration: for as long as the agency uses the service, and until it asks for its records to be removed.
• The data: names, email addresses, telephone numbers, language and channel preferences, notes written by an agency's staff, appointment history and consent records.
• The people: an agency's clients and prospective clients, and the agency's own staff.
• The operations: storing, displaying, searching, scheduling messages from, and erasing on the agency's instruction.

Acting on instructions

We process an agency's data to provide the service and to keep it running. We do not use it for our own purposes, we do not sell it, and we do not use it to advertise.

Where the law obliges us to do something with it, we say so to the agency unless the law itself forbids that.

The measures the software actually applies

Each of these is something in the code rather than an intention:

• Every record carries the agency it belongs to, and queries are filtered on that at the database layer rather than screen by screen.
• Five roles inside an agency decide who sees what, and a refusal answers as not found rather than as forbidden.
• The destination of a scheduled message is encrypted at rest, with a one-way hash beside it that the suppression check reads instead.
• A suppression list per agency and channel is consulted before consent and overrides it.
• Administrative actions go into an append-only audit log, with anything shaped like a password, token or key replaced before writing.
• Application logs pass through a filter that strips telephone numbers, email addresses and confirmation links.

Other suppliers

Running the service takes somewhere to host the application and its database, and a route out for email. The suppliers involved are named in the agreement we send.

They are not listed on this page, because a list published here would go out of date without anybody noticing. Ask and we will tell you who they are, and we tell an agency before that list changes.

Helping with a request from a client

When a client of an agency asks for a copy of their data, a correction or an erasure, the agency answers and we help it answer.

Correction and erasure are steps inside the product that the agency takes for itself. A copy of the records is something we produce by hand today.

If something goes wrong

If we become aware of a breach affecting an agency's data, we tell the agency with what we know at the time, rather than waiting until we have the whole picture.

We say what happened, which records are involved as far as we can tell, and what we are doing about it. We update the agency as that changes.

When an agency leaves

On request we remove the agency's records. Ask for a copy first if you want one, because afterwards there is nothing left to copy from.

Backups age out on their own schedule, so a record can survive in one for a short period after it has gone from the service.

How to ask for the agreement

Write to the data protection address below, or to the general one where no separate address is published.

Tell us your agency's registered name and the country it operates in, and we will send the document ready for signature.