1. Roles
The Customer is the controller of the personal data of its tenants, staff and building contacts held in EstateFlow. BAYH Solutions Ltd is the processor, and processes that data only to provide EstateFlowand only on the Customer’s documented instructions: this agreement, the EstateFlow Terms of Service, and the Customer’s use of the service’s settings.
2. The processing
| Item | Detail |
|---|---|
| People concerned | Tenants and other occupants, their emergency contacts, and the Customer’s staff and owners |
| Data | As listed under “What we collect” in the Privacy Policy, including passport or ID numbers and images |
| Purpose | Recording payments, issuing receipts, sending reminders and notices, the tenant portal, and apartment condition records |
| Duration | The subscription and the export period after it; retention periods as in the Privacy Policy |
3. Our obligations
- Process the data only on the Customer’s instructions, and tell the Customer if an instruction appears to break the law.
- Ensure everyone at BAYH with access to the data is bound to confidentiality.
- Keep appropriate security measures: encrypted connections, hashed passwords, access limited by building and role, and automatic deletion on the schedules in the Privacy Policy.
- Use only the sub-processors listed in the Privacy Policy, give the Customer 30 days’ notice of any new one, and let the Customer object. Each sub-processor is bound by terms that protect the data at least as well as this agreement.
- Help the Customer answer requests from people exercising their rights, and with any data protection impact assessment or regulator enquiry.
- Notify the Customer of a personal data breach without undue delay, and within 48 hours of becoming aware of it, with what is known of its nature, the data and people affected, and the steps taken.
- At the end of the subscription, return the data through the export and then delete it, except where the law requires us to keep it.
- Make available the information needed to show compliance with this agreement, and allow one audit a year on reasonable notice, at the Customer’s cost.
4. Transfers abroad
The data is stored in the European Union (Ireland). The Customer authorises this transfer. We make it only with the safeguards the Nigeria Data Protection Act 2023 requires, and with our sub-processors’ contractual commitments to protect the data.
5. The Customer’s obligations
The Customer has a lawful basis for the data it puts into EstateFlow, tells its tenants how their data is used (it may point them to our Privacy Policy), and uses the service’s retention and deletion features rather than keeping data longer than it needs.
6. Precedence
On any question about personal data, this agreement prevails over the EstateFlow Terms of Service.