Data Processing Addendum

Effective 1 October 2026. Draft for legal review. This Addendum forms part of the Terms of Service for customers subject to the GDPR, UK GDPR, PDPA or similar laws.

1. Roles

The Customer is the controller of Customer Data; Tenuta IQ is the processor. Tenuta IQ processes Customer Data only on the Customer's documented instructions, which include the Terms, the Customer's use of the Service and its configuration.

2. Subject matter and duration

Processing of personal data contained in lease, property, party, portal and document records for the purpose of providing the Service, for the term of the agreement plus the retention periods in the Privacy Policy.

3. Categories

Data subjects: the Customer's staff, tenants, franchisees, owners, guarantors, advisers, contractors and contacts named in documents. Data types: names, business contact details, roles, signatures, financial terms of agreements, identifiers such as company numbers, and any personal data contained in uploaded documents.

4. Obligations of Tenuta IQ

Confidentiality of personnel; the security measures on the Security page; assistance with data subject requests, impact assessments and regulator enquiries; notification of personal data breaches without undue delay and within 72 hours where required; deletion or return of Customer Data at the end of the agreement; making available information necessary to demonstrate compliance and allowing audits on reasonable notice, no more than once a year unless required by a regulator.

5. Sub-processors

The Customer authorises the sub-processors listed on the Sub-processors page. Tenuta IQ will give at least 30 days' notice of additions; the Customer may object on reasonable grounds, in which case the parties will work in good faith to resolve the objection or the Customer may terminate the affected Service.

6. International transfers

Customer Data is hosted in the Customer's chosen regional cell. Where a transfer outside that region occurs, it is covered by the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent lawful mechanism.

7. Liability

Liability under this Addendum is subject to the limitations in the Terms of Service.