Data processing agreement

1. Who is responsible for what

When you add tenant details, upload documents that name other people, or correspond with tenants and contractors through Kept, you decide what goes in and what it is used for. You are the controller of that personal data, and Cube Systems Limited, trading as Kept, is your processor, acting only on your documented instructions.

This includes the data collected through tenant response pages: email opens, page views, postcode-confirmation attempts and submitted responses, as described in our privacy policy.

If you use Kept for a landlord you are authorised to act for, and you hold the data as their processor, we act as your sub-processor and the commitments on this page apply in the same way.

We are a controller, not a processor, for your own account details, billing records, this website and our trade partner and referral programme records. Our privacy policy covers those.

2. What we commit to

This page is our data processing agreement under Article 28 of UK GDPR. It covers every customer on every plan, including the Free plan, and forms part of our terms of use, so there is nothing separate to sign. Under it, we:

• process your data only on your documented instructions, which include using Kept as designed with the settings you choose, and tell you if we believe an instruction breaks data protection law;
• make sure everyone who has access to it is bound by confidentiality;
• keep the security measures described below in place, as Article 32 requires;
• use sub-processors only under written contracts with equivalent data protection obligations, and tell you before we add or replace one;
• help you respond to people exercising their data protection rights, and help with data protection impact assessments and any prior consultation with the ICO;
• tell you without undue delay about a personal data breach affecting your data;
• delete or return your data at your choice when you close your account: you can export it at any time, and we delete it as set out below; and
• make available the information you need to show compliance with Article 28, and allow for and contribute to audits, including inspections, by you or an auditor you appoint.

If UK law requires us to process your data other than on your instructions, we will tell you before we do, unless that law forbids it. Questions about these terms go to hello@usekept.co.uk.

3. Details of the processing

• Subject matter: providing the Kept website, app and reminder service to you.
• Duration: while your account is open, then until the data is deleted as set out below.
• Nature and purpose: hosting, storing, organising, retrieving and sending records so you can keep track of your duties as a landlord: tenancy details, documents, correspondence you send and receive through Kept, tenant response pages, reminders, audit packs and the share links you create.
• People the data is about: your tenants, contractors and anyone else named in the tenancy records, documents and correspondence you keep in Kept.
• Types of personal data: names and contact details; tenancy details such as start dates and deposit and Right to Rent check dates; documents you upload or forward in, such as certificates, tenancy agreements and proof of service; letters and emails sent and received through Kept; and responses submitted through tenant response pages, with technical details of the visit such as IP address, browser, device and timezone.
• Your obligations and rights: you are responsible for having a lawful basis to hold and use the data, for keeping it accurate and for what you send through Kept, as our terms of use explain. You give us instructions through the way you use Kept and its settings, or by email.

4. Where it is held

Kept is hosted in the UK on Amazon Web Services (AWS), in its London region. Our servers, databases, uploaded documents and inbound mail are in the UK, and Kept's email is sent and received through Amazon SES in the same region.

Documents are delivered through Amazon CloudFront over signed, time-limited links. If someone opens a document from outside the UK, CloudFront may serve it from a location near them. Some other providers process limited data outside the UK. The sub-processors page lists each one and where it processes data.

5. How it is protected

• All traffic is encrypted in transit (HTTPS).
• Passwords are hashed with argon2id, and email-verification and password-reset tokens are stored only as SHA-256 hashes.
• Optional two-factor authentication, and email alerts when an account is used from a new device.
• Document downloads use signed, time-limited links rather than public ones.
• Each tenant response page is unique to its letter and protected by the property's postcode.
• Access to production systems is restricted, and we keep encrypted backups for disaster recovery.

6. Sub-processors

You give us general written authorisation to use sub-processors. Each one is named on our sub-processors page with what it does, what it receives and where, and works under a written contract with data protection obligations equivalent to those on this page. We remain responsible to you for their work.

Before we add or replace a sub-processor, we will tell you by email and update that page. You can object on reasonable data protection grounds. If we cannot resolve your objection, you can export your data and close your account before the change takes effect.

7. Requests from tenants and others

Requests from tenants or contractors to see, correct or delete their data should go to you, as the controller. Kept lets you export your documents and records as a zip at any time, and we will help you find, correct or delete anything you cannot manage yourself.

If someone contacts us directly about data you control, we will pass the request on to you and help where we can.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay. As controller, you decide whether to report it to the ICO, which must normally be done within 72 hours of becoming aware of it, and whether to tell the people affected.

We will tell you what happened, the kinds of data and approximate number of people affected, the likely consequences and what we are doing about it, and keep you updated as we learn more.

9. Information and audits

We will answer reasonable questions about how we protect your data and give you the information you need to show compliance. If you need an audit or inspection, contact us and we will agree the scope and timing with you.

10. When you close your account

You can export your documents and records at any time, on any plan, including after you cancel a paid plan. If you close your account, there is a seven-day cooling-off window during which you can reactivate it. After that, your account data, documents and correspondence are permanently deleted within 30 days, except the billing records the law requires us to keep, which our privacy policy covers.

11. Contact

Questions about this agreement or your data go to hello@usekept.co.uk, or by post to Cube Systems Limited, trading as Kept, Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. We are registered with the Information Commissioner's Office, registration number ZC216972.