Privacy

DATA PROCESSING AGREEMENT

1. Parties and scope

This Data Processing Agreement (“DPA”) forms part of the Caseta Terms of Service. It is between:

• The Customer: the agent or agency that holds a Caseta account. The Customer acts as controller.

• Caseta: Jamie Paterson Landon, trading as Caseta (NIE Y3328533X), Calle Cuba, 58, 46006 Valencia, Spain. Caseta acts as processor.

This DPA applies whenever Caseta processes personal data on the Customer’s behalf while providing the Caseta platform (“Customer Personal Data”). It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 (LOPDGDD). Annex 1 describes the processing.

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the GDPR. If this DPA and the Terms of Service conflict on data protection, this DPA prevails.

2. Caseta’s obligations

2.1 Instructions
Caseta processes Customer Personal Data only on the Customer’s documented instructions. These instructions are the Terms of Service, this DPA, and the Customer’s configuration and use of the platform. Caseta will tell the Customer if it believes an instruction breaks data protection law. If the law requires other processing, Caseta will inform the Customer first, unless the law forbids it.

2.2 No other use
Caseta will not use Customer Personal Data for its own purposes, sell it, or use it to train AI models.

2.3 Confidentiality
Caseta ensures that everyone authorised to process Customer Personal Data is bound by confidentiality, by contract or by law.

2.4 Security
Caseta implements the technical and organisational measures in Annex 2, as required by Article 32 GDPR. Caseta may update these measures, but never in a way that lowers overall protection.

2.5 Data subject requests
If a data subject contacts Caseta directly, Caseta will pass the request to the Customer without undue delay and will not respond itself unless authorised. Caseta will provide reasonable help, including export and deletion tools in the platform, so the Customer can meet its obligations under Chapter III GDPR.

2.6 Other assistance
Caseta will provide reasonable help, taking into account the information available to it, with security, breach notification, data protection impact assessments and prior consultation with authorities (Articles 32 to 36 GDPR).

2.7 Customer obligations
The Customer is responsible for:

• Having a lawful basis for the personal data it puts into Caseta

• Giving data subjects the required privacy information, including on websites it publishes through Caseta

• Not uploading special category data unless strictly necessary and lawful

• Keeping its account credentials secure

3. Subprocessors, transfers and breaches

3.1 Subprocessors
The Customer gives general authorisation for Caseta to use the subprocessors in Annex 3. Caseta will give at least 15 days’ notice by email or in-app notice before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may cancel the affected service without penalty. Caseta binds each subprocessor to data protection obligations equivalent to this DPA. Caseta remains responsible to the Customer for its subprocessors’ performance.

3.2 Modules that send data to third parties
When the Customer turns on a module that sends data to a third party, that third party is not Caseta’s subprocessor. Examples include property portals, social networks or the Customer’s own email recipients. It receives data on the Customer’s instruction and under its own terms.

3.3 International transfers
Caseta will transfer Customer Personal Data outside the EEA only under a valid safeguard under Chapter V GDPR. This means an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, with additional measures where needed.

3.4 Personal data breaches
Caseta will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information listed in Article 33(3) GDPR as far as it is available, with further details as they become known. Caseta will take reasonable steps to contain the breach and reduce its effects. It is the Customer’s responsibility, as controller, to notify the AEPD and data subjects where required.

4. Audits, termination and general terms

4.1 Audits
On written request, Caseta will provide the information needed to show it complies with this DPA. Where that is not enough, the Customer may carry out an audit, or have an independent auditor bound by confidentiality do so. Audits are limited to once a year unless a breach has occurred. They require 30 days’ notice, happen during business hours and are at the Customer’s cost.

4.2 Return and deletion
When the account ends, the Customer can export its data for 30 days. After that, Caseta deletes Customer Personal Data from live systems, and from backups within a further 30 days. The only exception is data Caseta must keep by law. Caseta will confirm deletion in writing on request.

4.3 Liability
Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited.

4.4 Term
This DPA applies for as long as Caseta processes Customer Personal Data. Obligations that by their nature continue after that time (such as confidentiality and deletion) survive termination.

4.5 Changes
Caseta may update this DPA to reflect changes in law or in its services, with at least 30 days’ notice of material changes. Changes will never reduce the protection given to Customer Personal Data.

4.6 Law and jurisdiction
This DPA is governed by Spanish law. The courts of Valencia, Spain, have jurisdiction.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit (TLS) and at rest through hosting providers

• Logical separation of each Customer’s data by organisation, enforced on every database query

• Passwordless sign-in through single-use links or Google, with session controls

• Role-based access for Customer team members

• Production access limited to authorised personnel with two-factor authentication and confidentiality obligations

• Regular backups held by the hosting provider

• Subprocessors chosen for their security certifications and bound by DPAs

• Incident response process including breach notification under section 3.4

Annex 3: Subprocessors