Data processing agreement

This is a translation provided for convenience. The Spanish version is the agreement, and prevails in the event of any difference between the two.

This agreement applies where a comunidad de propietarios (the Controller) uses Vecinto, operated by SYS82 LTD (the Processor), to process personal data. It is entered into under Article 28(3) of Regulation (EU) 2016/679 (GDPR) and forms part of the agreement between us.

The Processor is established in the United Kingdom and is therefore subject to the UK GDPR as well as to the EU GDPR, which reaches it under Article 3(2) because it offers this service to data subjects in the Union. Where this agreement refers to the GDPR it means both, and the Processor complies with whichever imposes the higher standard.

1. What is processed, and why

Subject matter. Providing the Vecinto community portal: a member register, a contacts list, house rules, a document library, a board for reporting problems, an agenda for juntas, a notice board, and the emails the platform sends about them.

Duration. For as long as the Controller uses the service, and for the thirty days after closure described in clause 8.

Categories of data subject.

• Owners and occupiers of properties in the community.
• Members of the committee, and the administrador de fincas.
• People listed in the community's useful contacts.

Categories of personal data.

• Identity and contact details: name, email address, telephone number, photograph, biography.
• Membership details: the property, whether owner or occupier, role, status, dates.
• Content the member creates: problems reported, agenda items, notices, replies, uploaded documents.
• A record of who changed what and when, without IP addresses or browser details.

No special category data is requested or required. The platform provides free-text fields, and a member may write anything into one. The Controller is responsible for what its members choose to write.

2. Instructions

The Processor processes personal data only on the Controller's documented instructions, including as to transfers, unless required otherwise by Union or Member State law — in which case the Processor informs the Controller before processing, unless that law forbids it.

Use of the platform by the Controller and its members constitutes the Controller's instructions. The Processor will tell the Controller if, in its opinion, an instruction infringes data protection law.

3. Confidentiality

Everybody the Processor authorises to process the personal data is bound by an obligation of confidentiality, and is given access only where their work requires it.

4. Security

The Processor implements the measures set out in Annex B, which are appropriate to the risk under Article 32. The Processor may change them, provided the level of protection is not reduced.

5. Subprocessors

The Controller gives general authorisation for the subprocessors listed in Annex A. The Processor will give the Controller at least thirty days' notice before adding or replacing one, and the Controller may object on reasonable data protection grounds. Each subprocessor is bound by terms no less protective than these, and the Processor remains fully liable for their performance.

6. Assisting the Controller

Requests from data subjects. The platform allows members to exercise most rights themselves: to see and correct their own details, to decide who sees each field, and to erase everything of theirs permanently. Where a member approaches the Processor directly, the Processor refers them to the Controller and assists with the response.

Articles 32 to 36. The Processor assists the Controller, taking into account the nature of the processing and the information available to it, with security, breach notification, impact assessments and prior consultation.

7. Personal data breaches

The Processor notifies the Controller without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligation under Article 33.

8. Deletion and return

When the Controller stops using the service, the Processor produces a complete export of everything held for the community — the register, the properties, the contacts, the house rules, everything raised, and every document under the names people gave them — and sends it to whoever holds the right to manage the community.

The portal is switched off immediately. Everything is deleted thirty days after closure, including the uploaded files behind the records. Backups age out within fourteen days and are never used to reinstate deleted data.

9. Information and audit

The Processor makes available the information needed to demonstrate compliance with Article 28, and allows and contributes to audits by the Controller or an auditor it mandates, on reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise.

10. Transfers outside the EEA

The application, the database and all uploaded files are held on servers in the European Union. Two flows leave it, and each has its own basis:

The Processor's own access from the United Kingdom relies on the European Commission's adequacy decision for the United Kingdom. Should that decision lapse or be annulled, the Processor will put Standard Contractual Clauses in place with the Controller before continuing, and will tell the Controller before it does so.

Because EU Standard Contractual Clauses alone do not satisfy UK law, onward transfers to the United States are additionally covered by the UK International Data Transfer Addendum to those clauses. Details are in Annex A.

11. Representative in the Union

The Processor is established outside the Union and is required to designate a representative there under Article 27. It has not yet done so. Until it has, the Controller and any data subject should address the Processor directly at privacy@sys82.com.

12. Term, liability and law

This agreement runs for as long as the Processor processes personal data for the Controller. Liability is as set out in the terms of service, which are the main agreement between the parties. Spanish law governs, and the courts of the Controller's province have jurisdiction — the Controller is a Spanish comunidad and a dispute would be heard there in any event.

---

Annex A — Subprocessors

Annex B — Technical and organisational measures

These describe the platform as built, not aspirations.

Access

• No passwords exist anywhere in the product. Members sign in by a link emailed to them, valid for thirty minutes and usable exactly once; a copy of the email is worthless to anybody else.
• Nobody can register themselves. A member exists only because somebody in the community invited them.
• What each member may do is governed by a role, and every action is checked against it on the server on every request.
• A community can never be left without anybody able to manage it: the platform blocks removing or demoting the last such member.

Separation

• Each community has its own address, and every record carries the community it belongs to. Queries are filtered by it automatically rather than by each piece of code remembering to; code that fails to establish which community it is acting for raises an error instead of returning data.
• A sign-in link issued for one community does not work on another.

Storage and transmission

• All traffic is encrypted with TLS, with HSTS and preloading.
• Uploaded documents are stored privately in the European Union. They are never publicly addressable, and are served only after a membership check, over links that expire.
• A document's stored name is a random identifier, so a filename such as acta-junta-morosos.pdf never appears in a URL or in a log.
• Every photograph uploaded anywhere in the platform — a profile picture, a photograph on the notice board, a photograph attached to a reported problem — is re-encoded and stripped of embedded metadata, including any location the camera recorded. Files that are not images, such as a PDF quotation, are stored as they arrive.
• Uploads are restricted to an allowlist of document and image formats.

Accountability

• The platform records who changed what and when, and deliberately records no IP addresses, no browser details and no message contents.
• A member who erases their data is shown in that record only as a former member.

Resilience

• The database is backed up before every change to the platform, and backups are kept for fourteen days.
• Changes are deployed by an automated procedure that verifies the service is answering afterwards and reverses itself if it is not.

Data minimisation

• Only a name and an email address are required of a member. Everything else is optional and controlled by them.
• Each member decides, field by field, who may see their details.
• No analytics, no advertising, no tracking, no profiling and no automated decision-making.