Data Processing Agreement

Parties and scope

This Data Processing Agreement ("DPA") forms part of the agreement between your firm ("Controller") and Halcyra ("Processor") and applies to any personal data Halcyra processes on the Controller's behalf when providing the Halcyra scheduling service.

Subject matter and duration

Processing consists of tenant contact details, property addresses, appointment status, and SMS conversation content, for as long as the Controller's subscription is active plus the retention period set out in the Data Retention policy.

Processor obligations

• Process personal data only on the Controller's documented instructions.
• Ensure staff and systems with access to the data are bound by confidentiality.
• Implement appropriate technical and organisational measures (see the Security Overview).
• Assist the Controller in responding to data subject requests and regulator enquiries.
• Notify the Controller without undue delay on becoming aware of a personal data breach (see Breach Response).
• Delete or return all personal data at the end of the engagement, except where retention is required by law.
• Make available information necessary to demonstrate compliance with this DPA.

Subprocessors

The Controller provides general authorisation for Halcyra to engage the subprocessors listed on the Subprocessor list, which Halcyra will keep up to date and will notify the Controller of any intended changes.

International transfers

Where a subprocessor is located outside the UK, Halcyra relies on that subprocessor's UK GDPR-compliant transfer mechanism (such as the UK International Data Transfer Addendum) as set out on the Subprocessor list.

A note on this draft

This page sets out the DPA in plain terms for reference. The full-clause version is issued to authorised firms as part of onboarding or procurement and can also be requested directly at hello@halcyra.co.uk.