Data Processing Agreement (DPA)

Status: draft, for review before signature. This describes the terms under which Leasebook processes personal data on behalf of an agency customer, grounded in what the software actually does — see PRIVACY.md and SUB-PROCESSORS.md for the factual basis. Where the software does not yet implement a control this document commits to, that is stated explicitly rather than implied.

1. Parties and roles

• Controller: the agency (the customer signing this agreement). The agency determines what personal data is entered into Leasebook, who has access to it, and how long it is kept for its own regulatory purposes.
• Processor: Leasebook. We process personal data only on the controller's documented instructions, given by the controller's own use of the product (creating contacts, tenancies, uploading documents, sending notifications) and by configuration the controller controls (organisation settings, notification preferences, plan/entitlements).

> This line cannot be signed as it stands. "Leasebook" is the product. > A processor is a legal person, so this must name the entity that > contracts and invoices — with its registered address and company number > — and that entity has not been decided > (GO-TO-MARKET.md §11.3). It is the item with the longest lead time in > the whole motion if the answer turns out to be "incorporate first", and > it is the first thing a buyer's solicitor will ask. Left blank > deliberately rather than filled with a plausible-looking name.

• Data subjects: the agency's tenants, owner-clients, and any other natural person whose details the agency records in the product (a contractor, a solicitor, an emergency contact).

2. Subject matter and duration

Processing continues for the duration of the agency's use of the product, and for the backup retention period after data is deleted (see §7). This agreement takes effect alongside the agency's commercial agreement with Leasebook and terminates with it, subject to §8 (data return/deletion on termination).

3. Nature and purpose of processing

Leasebook stores and processes the categories of personal data listed in PRIVACY.md ("What personal data the software stores") for the purpose of letting/property management administration: tenancy management, rent tracking, maintenance work orders, owner-client relationship management and statements, compliance record-keeping (RTB registration, document expiry), and the notifications the agency configures to be sent to tenants and owner-clients.

4. Sub-processors

The current sub-processor list is SUB-PROCESSORS.md. We will not add a new sub-processor that receives personal data without updating that list; the agency may raise an objection to a new sub-processor by contacting us. Note that today's sub-processor list is short by design: address validation (Google) is the only sub-processor that receives identifying data (a property address) as standard, and cloud AI gap-fill is consent-gated per run and does not receive tenant personal data at all — see SUB-PROCESSORS.md for the detail behind each entry.

5. Confidentiality and access control

Role-based access control is enforced server-side, not only hidden in the interface — a request for data outside a role's scope is rejected by the server regardless of what the client sends. Concretely, as implemented in business-store.mjs/server.mjs:

• A tenant seat can see only its own tenancy, work orders and documents, not another tenant's, another property's, or the agency's fee agreements.
• An owner-client seat can see only the properties assigned to it.
• Reading the organisation's audit log or notification history requires the operations-management role, not merely organisation membership — a plain seat cannot browse the whole agency's activity.
• Public-facing share links (Deal Room shares, maintenance report/job links) store only a hash of the access token server-side; the plaintext token is shown once, at creation, and a wrong or revoked token returns a plain "not found" rather than confirming that a record exists.

Full detail: docs/SECURITY.md.

6. Assistance with data subject rights

The agency is the point of contact for a data subject's rights request; we support the agency in fulfilling it:

• Access/rectification: agency staff can view and correct a data subject's records directly in the product today.
• Erasure: we can erase an account holder's own login and personal account data on request (eraseAccount), and if that person is the last remaining owner of an organisation, the entire organisation's data is removed with it. For a tenant or owner-client who is a record in an agency's book rather than an account holder, eraseContactPersonalData (POST /api/v2/organisations/:id/contacts/:contactId/erase, restricted to a business owner or admin) erases their reachability data — the organisation_contacts name, company, email, phone and notes — and their logged free-text activities, and blanks the recipient address on any notification-log row addressed to them. This is not a blanket delete. The tenancy record itself, including the tenant's name, is retained: it is the legal record of the tenancy, and Irish RTB/Revenue recordkeeping obligations require the agency to keep it. The notification-log row also survives with only the address removed, since the delivery fact is audit evidence, not personal data on its own. A tenant erasure request should still be raised with the agency, who performs the erasure through the product; we act on it directly only if the agency asks us to.
• Portability: there is no automated export-my-data feature today; a request is fulfilled manually on the agency's instruction.

7. Data retention and deletion

Personal data is retained for as long as the agency's organisation exists in the product, consistent with the agency's own regulatory recordkeeping obligations (RTB history, financial statements). Nightly backups are retained on a rolling 14-day window and pruned automatically (docs/OPERATIONS.md). We do not currently offer a category-by-category configurable retention/deletion schedule; if the agency needs one for a specific data category, that is a request to raise with us directly, not something the product enforces today.

8. On termination

On termination of the underlying commercial agreement, the agency's organisation data can be exported (manually, on request, per §6) and then deleted from the live system; deletion propagates to the backup retention window described in §7 rather than being purged from historical backups immediately, consistent with how the backup system works today.

9. Location of processing and international transfer

Personal data is processed and stored on a single self-hosted server; see PRIVACY.md ("Where the data lives") for its current hosting posture, including the fact that the deployment is not yet served over TLS — a fact the agency's own solicitor should weigh before go-live, and one we are not overstating here. There is no transfer of personal data to a second location beyond the sub-processors named in SUB-PROCESSORS.md.

10. Security incident notification

We will notify the agency without undue delay on becoming aware of a personal data breach affecting their data, and will provide the information reasonably available to us to help the agency meet its own notification obligations. There is no automated breach-detection tooling in the product today; this is an operational commitment, not a system control.

11. Audit

The agency may request evidence of the controls described in this agreement and in docs/SECURITY.md. We do not currently offer a formal third-party audit certification (e.g. SOC 2, ISO 27001); this document will be updated if and when one is obtained.

12. Precedence

Where this document and the commercial agreement conflict on data-protection terms, this document governs for that subject matter. Where this document describes a control that the product does not yet implement, the product's actual behaviour — as documented in PRIVACY.md and SUB-PROCESSORS.md, which are kept current against the code — controls, and the gap is a commitment to close (with the relevant docs/SALES-READINESS.md item cited), not a claim that it is already closed.