Data Processing Agreement
This Data Processing Agreement (DPA) forms part of the Naybourhood Terms of Service between NYBRHD LTD (company number 15818462), trading as Naybourhood (the processor), and the customer (the controller). It applies where we process personal data in Customer Data on the customer's behalf.
1. Scope and roles
The customer is the controller of personal data it uploads or connects, such as buyer and lead records. We process that data as processor only to provide the service under the Terms. Subject matter: buyer intelligence, enrichment and scoring. Duration: the term of the subscription plus the deletion period below. Data subjects: buyers, leads and prospects of the customer, and customer users. Categories: contact details, enquiry and preference details, budget and location information, professional and business information, CRM status and similar data the customer chooses to provide.
2. Instructions
We process personal data only on the customer's documented instructions, which are these terms and the customer's use and configuration of the service, unless required by law (in which case we will inform the customer where legally permitted). We will tell the customer if we believe an instruction infringes data protection law.
3. Confidentiality
Everyone we authorise to process personal data is bound by appropriate confidentiality obligations.
4. Security
We implement appropriate technical and organisational measures, including encryption in transit, role-based access controls, logical separation of customer workspaces, logging and restricted administrative access.
5. Sub-processors
The customer gives general authorisation for us to engage sub-processors (for example hosting and database, enrichment and data providers, AI services, payments and email). We impose data protection obligations on them equivalent in substance to this DPA and remain responsible for their performance. We will give notice of new sub-processors and the customer may object on reasonable data protection grounds; if we cannot address the objection, the customer may terminate the affected service. A current list is available on request.
6. Data subject requests
Taking into account the nature of processing, we will assist the customer by appropriate measures in responding to requests from individuals exercising their rights, and will forward any request we receive directly.
7. Personal data breaches
We will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and provide information reasonably available to help the customer meet its own notification obligations.
8. Assistance
We will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, where related to our processing.
9. Deletion and return
On termination, the customer may export its data while access remains. We will then delete Customer Data within a reasonable period (normally within 90 days), unless law requires us to retain it. Backups are overwritten in the ordinary course.
10. Audit and cooperation
We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to reasonable audits, on reasonable notice, no more than once a year (unless required by a regulator or following a breach), subject to confidentiality and without access to other customers' data.
11. International transfers
Where personal data is transferred outside the UK, we will ensure an appropriate safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
12. Customer obligations
The customer is responsible for having a lawful basis for processing, providing appropriate privacy information to individuals, and the accuracy and lawfulness of Customer Data.
13. Precedence
If this DPA conflicts with the Terms in relation to personal data processing, this DPA prevails. See also our Privacy Notice. Customers needing a signed copy can request one through our contact page.