Legal

01Definitions and Interpretation

In this DPA, the following terms have the following meanings:

• “Data Protection Legislation” means all legislation in force from time to time in the United Kingdom relating to data protection and privacy, including the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (as amended).
• “UK GDPR” means the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) as it forms part of the law of England and Wales, Scotland and Northern Ireland.
• “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach” and “Processing” have the meanings given in the UK GDPR.
• “Aggregated Data”, “Anonymisation Standard” and “Service Schedule” have the meanings given in the Terms of Service.
• “Sub-Processor” means any third party engaged by Cloudfox to process Personal Data on the Customer’s behalf, as listed in the Sub-processor list described in Appendix A.
• “Technical and Organisational Measures” means the security measures described in Appendix B.

References to a statute include that statute as amended or re-enacted. The Appendices form part of this DPA.

02Roles of the Parties

• Customer: Data Controller
• Cloudfox: Data Processor

Cloudfox processes Personal Data only on behalf of the Customer and on its documented instructions, which include the instruction in Section 6A. The Customer remains responsible at all times for ensuring it has a valid lawful basis for collecting the Personal Data and for transferring it to Cloudfox for processing.

03Scope and Order of Precedence

This DPA is incorporated by reference into the Terms of Service and is accepted by the Customer when it accepts the Terms of Service at account set-up. No separate signature is required for the DPA to take effect; a counter-signable copy is available on request to enterprise customers who require one for their own records. In the event of any conflict between this DPA and the Terms of Service or a Service Schedule in relation to the processing of Personal Data, this DPA prevails.

04Subject Matter, Duration, Nature and Purpose of Processing

• Subject matter and purpose: provision of the StaySynced services the Customer has chosen, as described in the applicable Service Schedule, and anonymisation under Section 6A.
• Nature of processing: extraction, cleaning, formatting, field-mapping, transmission, storage for reporting, anonymisation, aggregation and operational logging of Personal Data.
• Duration: for the duration of the Customer’s use of StaySynced and until deletion or return of Personal Data under Section 15.

05Types of Personal Data and Data Subjects

Each Service Schedule sets out the purpose, data types, data subjects and retention for its service. Those details form part of this DPA. In summary:

• Data Subjects: end-users, tenants, leads, applicants and staff whose data is held in the Customer’s connected systems, and, where the Customer uses attribution, visitors to the Customer’s website.
• Data Types: names, contact details (email, telephone, address), nationality, year of study, room type, rent, tenancy dates, payment plan, booking and tenancy details, CRM activity, online identifiers (for website visitors under the Attribution Schedule), and other fields determined by the Customer’s configuration.
• Nationality. The Customer chooses whether to include nationality. The Customer is responsible for its lawful basis for doing so and, where nationality is special category data in the Customer’s use of it, for the condition under Article 9 of the UK GDPR.
• Other special category data. The Customer must not configure StaySynced to process any other special category data, or criminal offence data, unless separately agreed in writing.

06Processing on Documented Instructions

Cloudfox processes Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case Cloudfox will inform the Customer of that legal requirement before processing, unless the law prohibits it). The Customer’s instructions are set out in this DPA, the Terms of Service, the Service Schedules the Customer has accepted, and the configuration the Customer establishes within the StaySynced platform. Cloudfox will inform the Customer if, in its opinion, an instruction infringes the Data Protection Legislation.

6AAnonymisation

6A.1 The Customer instructs Cloudfox, acting as the Customer’s Processor, to process Personal Data to produce anonymised statistical information in line with Section 5 of the Terms of Service and the Anonymisation Standard.

6A.2 Cloudfox applies appropriate technical and organisational measures to the anonymisation process, designed to prevent the identification of individual Data Subjects and to minimise disclosure of identifiable customer and property information.

6A.3 Until information has been effectively anonymised, Cloudfox treats it as Personal Data and applies this DPA to it, including its confidentiality, security, retention and deletion terms. Cloudfox limits access to the personnel carrying out the anonymisation, uses it for no other purpose, and does not make it available to any other customer.

6A.4 Once information has been effectively anonymised, so that individuals are not identifiable by means reasonably likely to be used, it is no longer Personal Data and this DPA no longer applies to it. It may then be used as Aggregated Data under the Terms of Service.

6A.5 Cloudfox will assess the risk of re-identification at least once a year, taking account of other available information, dataset size and concentration, and the possibility of identifying a single scheme by comparing reports. Cloudfox will not attempt to re-identify any Data Subject from Aggregated Data.

6A.6 If Cloudfox becomes aware that any Aggregated Data could identify a Data Subject, it will promptly stop further disclosure of it, assess its obligations, and delete or re-anonymise it without undue delay. Until then it treats that data as Personal Data under this DPA.

07Confidentiality

Cloudfox ensures that all personnel authorised to process the Personal Data are bound by an appropriate obligation of confidentiality and are made aware of the confidential nature of the data. Cloudfox limits access to the Personal Data to those personnel who require it to deliver the service.

08Security Measures

Cloudfox implements and maintains the Technical and Organisational Measures set out in Appendix B to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Cloudfox also publishes a Security overview.

09Personal Data Breach

Cloudfox will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer’s Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it. Cloudfox will provide reasonable assistance to the Customer in meeting the Customer’s own breach-notification obligations to the ICO and to affected data subjects. The Customer (as Controller) is solely responsible for determining whether and how to notify the ICO or data subjects.

10Sub-Processors

The Customer provides general written authorisation for Cloudfox to engage the Sub-Processors on the Sub-processor list. Cloudfox:

• imposes on each Sub-Processor, by written contract, data-protection obligations substantially equivalent to those in this DPA;
• remains fully liable to the Customer for the performance of each Sub-Processor’s obligations; and
• will email the Customer at least 30 days before adding or replacing a Sub-Processor, giving the Customer the opportunity to object on reasonable data-protection grounds within that period.

If the Customer objects and the parties cannot resolve the objection within 30 days of it being raised, the Customer may end the affected service by written notice. Cloudfox will refund the prepaid fees for the period after the service ends, pro rata.

A third party that the Customer connects to, or authorises to receive data from, StaySynced is not a Sub-Processor, and the Customer remains responsible for its own arrangements with that party.

Cloudfox does not use Customer Data to train AI models, and does not send Personal Data to an AI provider unless that provider is on the Sub-processor list.

11Data Subject Rights and Assistance

Taking into account the nature of the processing, Cloudfox will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests from data subjects exercising their rights under the Data Protection Legislation (access, rectification, erasure, restriction, portability and objection). If Cloudfox receives a request directly from a data subject, it will not respond itself (except to confirm onward referral) but will notify the Customer without undue delay.

12Assistance with Compliance Obligations

Taking into account the nature of the processing and the information available to Cloudfox, Cloudfox will provide reasonable assistance to the Customer with: the security of processing; the notification of Personal Data Breaches; the carrying out of data protection impact assessments (DPIAs); and prior consultation with the ICO where required.

13International Transfers

The arrangements for any transfer of Personal Data outside the United Kingdom are set out in Appendix C. Where any Sub-Processor processes Personal Data outside the UK, Cloudfox ensures that an appropriate transfer mechanism under the Data Protection Legislation is in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or reliance on UK adequacy regulations.

14Audit and Compliance

Cloudfox will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR and this DPA. On request, and subject to a confidentiality agreement, Cloudfox will provide its audit pack. Cloudfox will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on these terms: no more than once in any 12 months unless a Personal Data Breach or a regulator requires otherwise; on at least 14 days’ written notice; by an auditor bound by confidentiality; with the scope agreed in advance; and with the Customer paying Cloudfox’s reasonable time and costs.

15Retention, Deletion and Return of Data

Cloudfox keeps Personal Data only for as long as it needs to:

• run and troubleshoot the service, in operational logs;
• provide reporting to the Customer, in periodic snapshots kept for a rolling period of up to 36 months while the Customer’s subscription is active; and
• carry out anonymisation under Section 6A.

After the Customer’s subscription ends, Cloudfox will, at the Customer’s choice, return the Personal Data (on request within 30 days) and delete it, and in any case will delete it no later than 90 days after the subscription ends. Copies held in backups are overwritten on a rolling cycle of no more than 30 days. This applies unless the law requires continued storage. Cloudfox will certify completion of deletion in writing on request. Deletion and return under this Section do not extend to Aggregated Data. A Service Schedule may set a shorter period for its service.

16Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits either party’s liability where it cannot lawfully be limited.

17Governing Law

This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

18Contact

For data-protection enquiries, contact dataprotection@cloudfox.it.

AAppendix A — Sub-Processors

The current list of Sub-Processors, with the purpose and location of each, is published at Sub-processor list. Changes are notified under Section 10.

BAppendix B — Technical and Organisational Measures

Cloudfox maintains measures appropriate to the nature of the Personal Data and the risk, including:

• Encryption: data is encrypted in transit using TLS. Credentials for connected systems are encrypted at rest before storage.
• Access segregation: customers’ data is separated by database-level access controls. Privileged access is limited to system operations.
• Authentication: user access is authenticated and sessions are time-limited.
• Logging: significant organisation and system events are logged to support security monitoring and troubleshooting.
• Backups and recovery: regular automated backups, and the ability to restore availability of and access to data after an incident.
• Least privilege: access to production systems and Personal Data is limited to personnel who need it.
• Review: these measures are reviewed periodically. They may be updated provided the level of security is not materially reduced.

Further detail is in the Security overview, and in the audit pack available under Section 14.

CAppendix C — International Transfers

StaySynced’s primary database hosting is located within the EEA at Supabase in Ireland (eu-west-1). Transfers of Personal Data from the United Kingdom to the EEA are permitted under UK adequacy regulations without additional safeguards. Where a Sub-Processor that is a US-headquartered provider, such as Stripe, processes or accesses Personal Data outside the UK and the EEA, for example in the United States or India, Cloudfox relies on an appropriate transfer mechanism: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, the EU-US Data Privacy Framework (and its UK Extension), or UK adequacy regulations. Where a counter-signed transfer agreement is required by a Sub-Processor or by the Customer, the IDTA is used as the executable transfer annex. The application hosting (Vercel) executes its functions in the UK (London, eu-west-2 / lhr1). Its deployment builds run in the US but operate on source code, not customer Personal Data. The data-transformation (ETL) compute layer runs on Microsoft Azure virtual machines in the UK (UK South). No transfer of Personal Data outside the UK arises for that processing.