Data Processing Agreement

This agreement forms part of the Terms of Service between you (the controller) and Tarlara Digital Ltd (the processor) and applies where we process personal data on your behalf.

1. Subject matter and duration

We process personal data to provide the Tarlara Property and Tarlara Rural applications, for as long as your subscription is active plus the retention period described in the Privacy Policy.

2. Nature and purpose

Hosting, storage, retrieval, organisation and display of the operational records you create, together with authentication, notifications, support and — where enabled — AI-assisted features.

3. Types of personal data

• Names and contact details of your users, contractors, suppliers and contacts.
• Any personal data contained in the documents, photos and notes you upload.

4. Categories of data subject

• Your staff and invited users.
• Your contractors, suppliers and other third parties you record.

5. Our obligations

• Process personal data only on your documented instructions, including the use of the service.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organisational security measures.
• Assist you with data subject requests, security incidents and impact assessments, so far as reasonable.
• Delete or return personal data at the end of the agreement, subject to legal retention.
• Make available the information needed to demonstrate compliance.

6. Security measures

• Encryption in transit; encryption at rest at the hosting layer.
• Row-level access rules enforcing separation between organisations and holdings.
• Role-based permissions controlled by you.
• Approved, time-limited and logged support access to customer records.
• Regular backups operated by our hosting provider.

7. Subprocessors

You authorise the subprocessors listed on our Subprocessors page. We will give notice before adding or replacing a subprocessor, and you may object on reasonable data protection grounds.

8. International transfers

Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Addendum.

9. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to us.

10. Contact

Data protection contact: To be confirmed.