Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between ARX Property Management Solutions Ltd ("ARX", the "Processor") and the subscribing client organisation (the "Client", the "Controller") identified in the Master Service Agreement ("MSA"). It forms part of the MSA and is incorporated by reference. This page is the reference copy; the version attached to the Client's MSA is the binding version.

This DPA sets out the terms on which ARX processes personal data on behalf of the Client in accordance with Article 28 of the UK GDPR and the Data Protection Act 2018.

1. Definitions

• "Personal Data", "Data Subject", "Processing", "Controller", "Processor" and "Sub-Processor" have the meanings given in the UK GDPR.
• "Client Data" means all personal data uploaded to, or generated within, the ARX Platform by or on behalf of the Client, including data submitted by the Client's residents, staff and contractors through links or forms issued by the Platform.
• "Services" means the ARX software platform and the associated support services described in the MSA.

2. Subject Matter and Purpose

ARX processes Client Data solely to provide the Services. Processing includes:

• Storing and retrieving building, asset, compliance, document, maintenance and inspection records
• Managing user accounts, access control and the audit trail of actions taken in the Platform
• Sending notification emails and secure one-time links to users, residents and contractors
• AI-assisted classification, extraction and suggested routing of documents, emails and jobs, with human review
• Generating reports, dashboards and exports for the Client

3. Categories of Personal Data and Data Subjects

3.1 Personal data

• Identity data: names, job titles, employer, employee or contractor identifiers
• Contact data: email addresses, telephone numbers
• Operational data: job logs, inspection records, compliance documents, photographs taken during work, sign-in and sign-out times on site
• Location data: building addresses, unit or floor references linked to a named person
• Resident data: name, unit, contact details, requests, feedback and safety concerns raised through the Platform
• Technical data: IP addresses, device information, access and audit logs

3.2 Data subjects

• The Client's employees and operational staff
• Contractors, suppliers and their attending engineers
• Residents, tenants and leaseholders of the Client's buildings
• Consultants, compliance officers, regulators and other duty holders given access by the Client

Special category data is not required by the Platform. The Client must not upload it except where incidental to an incident or safety record, and must ensure a lawful basis for doing so.

4. Duration

ARX processes Client Data for the term of the MSA and thereafter only as needed to return or delete it under Section 10, or to comply with a legal obligation.

5. ARX's Obligations

ARX will:

• Process Client Data only on the Client's documented instructions, which include the MSA, this DPA and the Client's use of the Platform's functions, unless required otherwise by UK law
• Ensure that persons authorised to process Client Data are bound by confidentiality obligations
• Implement and maintain the technical and organisational measures in Section 7
• Engage Sub-Processors only in accordance with Section 9
• Assist the Client, taking into account the nature of the processing, in responding to Data Subject rights requests, and forward any such request received directly by ARX to the Client within 3 working days
• Assist the Client with security, breach notification, data protection impact assessments and prior consultation with the ICO, so far as the information is available to ARX
• Notify the Client of personal data breaches as set out in Section 8
• Make available the information needed to demonstrate compliance with Article 28 and allow audits under Section 11
• Not use Client Data for its own purposes, and not use Client Data to train artificial intelligence models

6. Client's Obligations

The Client will:

• Ensure it has a valid lawful basis under UK GDPR for all Client Data it uploads to, or collects through, the Platform
• Provide the required privacy information to its staff, contractors and residents
• Give ARX clear and lawful instructions, and configure user roles and access within the Platform appropriately
• Decide and set its own retention periods, including any longer retention required by the Building Safety Act 2022 for Golden Thread information
• Comply with all applicable data protection law in its use of the Platform

7. Security Measures

• Encryption in transit (TLS 1.2 or higher, HSTS enforced) and encryption at rest for databases and file storage
• Role-based access control limiting each user to the data and actions their role requires
• Short-lived access tokens, session timeout on inactivity, rate limiting and login throttling
• Append-only audit trail recording who created, changed or approved each record
• Validation of uploaded files by type and size; object storage with public access blocked and versioning enabled
• Daily automated database backups with tested restore procedures
• Application error monitoring, external availability monitoring and dependency vulnerability scanning with patching
• Two-factor authentication on ARX administrative, hosting and source-code accounts; credentials held in a password manager; no shared logins
• Endpoint protection on ARX-managed devices; secret scanning before code is committed
• Documented information security, incident response, backup and retention, and acceptable use policies

8. Personal Data Breaches

• ARX will notify the Client without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Client Data
• The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed, and will be updated as further information becomes available
• The Client remains responsible for deciding whether to notify the ICO or Data Subjects; ARX will provide reasonable assistance

9. Sub-Processors

The Client gives general written authorisation for ARX to use the following Sub-Processors, each bound by a written contract meeting Article 28(3):

• Render, Inc. - application hosting, database and cache - Frankfurt, EU region - UK adequacy regulations
• Amazon Web Services - file storage and transactional email - London, eu-west-2 region - UK
• SendGrid (Twilio) - backup email delivery - United States - UK Addendum to the EU SCCs
• OpenAI - AI classification and extraction via API only; no training on Client Data - United States - UK Addendum to the EU SCCs
• Sentry - application error monitoring; technical error data only - United States - UK Addendum to the EU SCCs
• UptimeRobot - external availability monitoring; no Client Data - United States - UK Addendum to the EU SCCs

ARX will give the Client at least 30 days' written notice before adding or replacing a Sub-Processor. The Client may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Client may terminate the affected Services without penalty. ARX remains fully liable to the Client for the performance of its Sub-Processors.

10. Return and Deletion of Data

• On termination or expiry of the MSA, ARX will make an export of all Client Data available in a structured, commonly used, machine-readable format within 30 days
• Unless the Client instructs ARX in writing to retain Client Data (for example to meet Building Safety Act 2022 Golden Thread retention), ARX will securely delete all Client Data, including copies held by Sub-Processors, within 60 days of confirming the export, except where UK law requires retention
• ARX will confirm deletion in writing on request

11. Audit

On at least 30 days' written notice and no more than once in any 12-month period (or following a personal data breach), the Client or an independent auditor bound by confidentiality may audit ARX's compliance with this DPA. ARX will cooperate and provide relevant documentation. Audits will be conducted during business hours, with minimal disruption, and the Client bears its own audit costs.

12. Anonymised Data

ARX may create and use aggregated statistics derived from Client Data that do not identify any individual, building or Client (for example average job completion times by asset type) to improve the Platform and produce sector benchmarks. No personal data is contained in these outputs.

13. Governing Law and Precedence

This DPA is governed by the law of England and Wales and subject to the exclusive jurisdiction of its courts. If this DPA conflicts with the MSA, this DPA prevails on data protection matters. Data protection enquiries: info@arx-pms.com