This Data Processing Addendum (the "DPA") forms part of the Customer Agreement (or other written agreement) between TenTotal ("TenTotal" or "Provider") and the customer that uses TenTotal ("Customer") (the "Agreement"). It applies to Personal Data that TenTotal processes on Customer's behalf when providing the Service. If the DPA conflicts with the Agreement, the DPA prevails.
Definitions
- Applicable Data Protection Laws means the privacy and data protection laws that apply to the processing of Personal Data under the Agreement, including PIPEDA, Alberta's PIPA and other provincial laws, and, where they apply, the EU or UK GDPR.
- Customer Data has the meaning given in the Agreement.
- Personal Data means Customer Data that is information about an identifiable individual. It does not include contact details of Customer's own staff that we use to manage the customer relationship, which our Privacy Policy covers.
- Process means any operation performed on Personal Data, such as collecting, storing, using, disclosing or deleting it.
- Security Incident means a breach of our security leading to the accidental or unlawful loss, alteration, unauthorized disclosure of, or access to, Personal Data we process. It does not include unsuccessful attempts that do not compromise Personal Data, such as blocked log-in attempts or network scans.
- Subprocessor means a third party we engage to process Personal Data in providing the Service.
Roles
Customer controls the Personal Data and decides why and how it is processed (Customer is the "organization" responsible under PIPEDA and PIPA, and the "controller" under the GDPR). TenTotal processes Personal Data only on Customer's behalf as its service provider ("processor"). Details of the processing are in Annex 1.
Customer's instructions
We will process Personal Data only on Customer's documented instructions, which include the Agreement, this DPA and Customer's use and configuration of the Service, unless the law requires otherwise (in which case we will tell Customer first, where allowed). We will tell Customer if, in our opinion, an instruction breaks Applicable Data Protection Laws. Instructions outside the scope of the Service must be agreed in writing.
Confidentiality and our people
We will make sure that everyone we authorize to access Personal Data is bound by a duty of confidentiality, and that access is limited to people who need it to provide, support or secure the Service. We do not look at Customer's records except to provide support Customer has asked for, to keep the Service secure and working, or where the law requires it.
Security
- Our measures. We maintain technical and organizational measures to protect Personal Data, as described in Annex 2, appropriate to the nature of the data and the risks. We may update them as long as the overall level of protection does not decrease.
- Security incidents. We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer's Personal Data. Our notice will describe what is known at the time, the steps we have taken, and steps Customer may wish to take, and we will provide updates as more becomes known. We will reasonably cooperate so Customer can meet its obligations to report breaches to the Privacy Commissioner, affected individuals or others, and keep the records the law requires. Notifying a Security Incident is not an admission of fault.
- Customer's part. Customer is responsible for its own use of the Service, including choosing who has access and at what level, protecting its sign-in details and devices, and exporting copies of its data when it needs them.
Individuals' requests
If a tenant, owner or other individual asks us to access, correct or delete their Personal Data, we will (unless the law prevents us) promptly forward the request to Customer and not respond ourselves except to say that we have done so. Taking into account the nature of the processing, we will help Customer respond, mainly through the features of the Service (for example, editing or exporting records). Help beyond the normal Service may be charged at our usual rates.
Customer's responsibilities
Customer confirms that it has the authority, notices and consents required by Applicable Data Protection Laws for us to process Personal Data under the Agreement, including notice to its tenants and others that their information is kept in a third-party system that may be located outside their province or country. Customer will not submit sensitive information that the Service is not designed to hold, such as social insurance numbers, full payment card numbers, health information or banking passwords.
Subprocessors
- Authorization. Customer authorizes us to use Subprocessors. Our current Subprocessors are listed on our Subprocessors page.
- Our obligations. We will have a written contract with each Subprocessor that protects Personal Data at least as well as this DPA does, to the extent relevant to its services, and we remain responsible for our Subprocessors' performance.
- Changes. We will update the Subprocessors page and notify Customer's account owner at least 15 days before a new Subprocessor begins processing Personal Data. If Customer objects on reasonable data protection grounds, we will work in good faith to address the concern. If we cannot, Customer may cancel the affected Service and receive a refund of prepaid fees for the unused term.
Transfers outside Canada
Personal Data may be processed in Canada, the United States and other countries where we or our Subprocessors operate. Wherever it is processed, we will protect it as this DPA requires. Where the GDPR applies to a transfer, the parties agree to the European Commission's standard contractual clauses (and the UK addendum, where relevant), which are incorporated by reference and completed with the information in Annex 1.
Artificial intelligence
We will not use Personal Data to train, fine-tune or improve any artificial intelligence model, whether ours or a third party's. If Customer turns on the optional AI helper, Personal Data is sent to our AI provider only to answer the user's question, and we require that provider not to use it for model training. The AI helper does not make automated decisions about individuals; any change it suggests takes effect only if a person confirms it.
Audits and information
We will make available the information reasonably needed to show our compliance with this DPA, such as answers to security questionnaires and summaries of our security practices. Where the law requires an audit, Customer may audit our compliance once a year on at least 30 days' written notice, during business hours, under a confidentiality agreement and at Customer's cost, in a way that does not compromise the security of other customers' data.
Return and deletion
During the subscription, Customer can export its data from the Service at any time. When the Agreement ends, we will keep Customer Data for 30 days so Customer can export it, then delete Personal Data from our active systems within a reasonable period. Copies in our backups are deleted as the backups expire. We may keep Personal Data only where the law requires, and then only for that purpose and protected under this DPA.
General
This DPA lasts for as long as we process Personal Data for Customer. Each party's liability under this DPA is subject to the limits in the Agreement, except where the law does not allow it. We may update this DPA to reflect changes in law or in our Subprocessors, provided the update does not materially reduce the protection of Personal Data.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Provider | TenTotal, Calgary, Alberta, Canada. Privacy contact: privacy@tentotal.ca. Role: processor (service provider). |
| Customer | The landlord, property manager or other organization that subscribes to TenTotal. Role: controller (responsible organization). |
| Individuals | Customer's tenants and their contacts, property owners, guarantors, vendors and contractors, and Customer's own users. |
| Types of Personal Data | Names, business names, contact details (e-mail, phone, mailing address), lease details (units, dates, rent and charges), billing and payment history, balances and arrears, GST status and exemption references, maintenance requests, documents and photos Customer uploads, communications sent through the Service, and user sign-in and activity records. |
| Sensitive data | None intended. Customer must not upload sensitive information the Service is not designed to hold. |
| Nature and purpose | Hosting, storing, organizing and displaying records; calculating rent, common area costs, property tax recovery and GST; producing invoices, statements, notices and reports; sending e-mails Customer asks the Service to send; providing the tenant portal; backups; support; and security. |
| Duration | For the term of the Agreement and the export and deletion period after it. |
| Frequency | Continuous, as Customer uses the Service. |
Annex 2: Security measures
- Separation of data. Database access rules keep each customer's records separate, so one company can never see another's data.
- Access control. Role-based permissions inside each customer's workspace (account owner, manager, read-only); unique sign-ins for every user; staff access on a need-to-know, least-privilege basis.
- Encryption. Encrypted connections (TLS) for all traffic; data encrypted at rest by our hosting providers.
- Passwords. Passwords are never stored in readable form, only as salted hashes; optional sign-in with Google.
- Integrity and audit. Posted invoices and payments cannot be silently changed; corrections are recorded as new entries, and key actions are kept in an audit log.
- Backups and resilience. Regular backups by our database provider, optional automatic daily backups kept for 30 days, and on-demand data export for customers.
- Secure development. Changes are reviewed and tested before release, and dependencies are kept up to date.
- Monitoring and incidents. Logging of system activity and errors, and a process to investigate, contain and notify Security Incidents.
- Providers. Hosting in professionally managed data centres with physical and environmental protections provided by our Subprocessors.
Adapted from attorney-drafted templates by General Legal, PC, released under CC0 1.0. This document is provided for the use of TenTotal and its customers; it is not legal advice to you.