Homy Data Processing Agreement

The Customer is controller, or an authorised processor acting for the identified controller; Homy is processor or subprocessor respectively. “Data Protection Law” means EU GDPR and applicable national privacy/electronic-communications law, plus UK GDPR and other data-protection law to the extent applicable to the processing.

The Customer instructs Homy to perform the enabled services, its documented account settings and authorised support requests within Schedule A. Additional instructions must be lawful, documented and consistent with the service; material changes in scope require agreement before processing begins. The Customer must have authority from any upstream controller to appoint Homy and authorise the specified subprocessors and transfers.

Homy must not independently exploit Customer Personal Data for advertising, sale, unrelated profiling or general-purpose AI training. Homy’s separate controller information is described in its Privacy Policy and is not created merely by relabelling Customer Personal Data.

Homy will:

• Process Customer Personal Data only on documented instructions, including for transfers, unless applicable law requires otherwise. Where permitted, notify the Customer before legally compelled processing.
• Promptly flag instructions it considers unlawful and suspend the disputed processing where necessary pending resolution.
• Limit access to authorised personnel needing it, under confidentiality obligations and appropriate training.
• Maintain risk-appropriate technical and organisational safeguards, including the verified measures in Schedule B, and not materially reduce the agreed protection during the term.
• Assist the Customer, taking account of the processing and available information, with rights requests, security obligations, impact assessments, regulatory consultations and incident duties. Forward relevant requests promptly unless prohibited by law, and do not independently respond on the Customer’s behalf without authority except where legally required.

Ordinary assistance is included. Material bespoke work may be charged at rates agreed in advance, except work necessary to remedy Homy’s breach. Fees must not obstruct a mandatory obligation or timely compliance.

Homy will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will provide available information about the event, affected data and people, likely consequences, protective action and a contact for follow-up; missing information may follow in stages without undue delay. Homy will investigate, contain and remediate within its responsibility, preserve relevant evidence and cooperate with the Customer.

The Customer remains responsible for its own required authority and individual notifications, with Homy’s assistance. Nothing prevents Homy from fulfilling a legal notification duty directly applicable to it. Notification does not by itself admit liability. Security incidents not involving personal data are addressed through the service’s incident arrangements.

The Customer authorises the completed list in Schedule C at acceptance and gives general written authorisation for additions or replacements subject to this section. Homy will notify the Customer by email at least 30 days before a new subprocessor begins relevant processing, identifying its function, data access and locations.

The Customer may object within that period on reasonable data-protection grounds. The parties will work to resolve the objection through information, an alternative or feature configuration. If it cannot be resolved before processing begins, the Customer may terminate the affected service with a proportionate unused-fee refund; Homy will not begin the disputed processing for that Customer while the objection is being resolved. Emergency substitutions require lawful authorisation and safeguards; urgency does not itself waive these requirements.

Homy will bind subprocessors to equivalent relevant data-protection obligations and remains responsible for their performance as required by law. Independent Customer-selected controllers are not made Homy subprocessors by appearing in an integration menu.

Locations and safeguards are specified in Schedule C, including remote access countries. Homy will not carry out a restricted transfer without a valid mechanism and any necessary supplementary measures. Where required, the parties will execute and complete the applicable Commission Standard Contractual Clauses, appropriate modules and annexes, and any UK addendum before the transfer. Homy will provide relevant transfer information and reasonably cooperate with required assessments. Nothing here treats a general contract acceptance as GDPR consent for routine international transfers.

Homy will provide information reasonably necessary to demonstrate compliance and permit and contribute to audits, including inspections, by the Customer or an independent qualified auditor bound to confidentiality. Existing independent assurance may be used first where adequate. Normally an audit occurs during business hours on reasonable notice with safeguards for other customers and systems. These arrangements cannot prevent a legally necessary audit, a regulator’s access, or urgent investigation of a credible breach. Routine audits are at the Customer’s reasonable expense; Homy bears reasonable costs attributable to verification and remediation of its material non-compliance. Information may be disclosed to the upstream controller, advisers or regulators where necessary under appropriate confidentiality conditions.

At termination, the Customer may request return or deletion of Customer Personal Data. A return option remains available for 30 days. Unless the Customer lawfully instructs earlier deletion, active copies will be deleted within 30 days after that return period; no response is treated as an instruction to delete. Residual copies in backups managed by Homy’s infrastructure providers remain isolated from ordinary processing and are deleted or overwritten through the provider’s normal backup-retention cycle; deletion instructions are reapplied if a backup is restored. Homy does not promise a fixed maximum backup-expiry period unless one is stated in the accepted order or an applicable provider commitment. Any legally required retention must be identified where lawful, restricted and ended when no longer required. Homy will confirm completion on request. Longer mandatory retrieval or switching rights prevail. This DPA continues while Homy retains Customer Personal Data.

The Terms’ limitations apply between the parties only insofar as legally permitted. They do not limit data subjects’ remedies, authorities’ powers, mandatory contribution rights or Homy’s statutory responsibility for subprocessors. Each party remains accountable for its own obligations. Required transfer clauses prevail in a conflict, followed by this DPA for data-processing matters.

The following measures form the contractual baseline, subject to the scope and capabilities of the enabled service and its managed providers. No certification, recovery time or provider-specific retention period is promised unless expressly stated in an accepted order.

1. Encrypted network transport for service and administrative connections, with managed certificate and configuration updates.
2. Provider-managed encryption at rest for the primary managed database, object storage, cache and backup services where supported by the applicable service; access to application credentials and provider-managed keys is restricted to authorised systems and personnel. Homy does not offer customer-managed encryption keys under this schedule.
3. Individual administrative identities, role-based least-privilege access, multi-factor authentication for privileged provider accounts where available, timely access revocation and periodic access review.
4. Listing-level tenant separation and server-side authorisation checks for account, guide and guest records; public guide content is explicitly separated from authenticated management operations.
5. Authenticated session handling, secret storage through deployment-provider secrets and protected API credentials; passwords are not stored in plaintext application logs.
6. Security and application event logging with access limited to authorised personnel. Logs are retained for operational, security and legal needs according to the configured provider service and are minimised to avoid unnecessary message content, payment credentials, access tokens or guide secrets.
7. Risk-based dependency and vulnerability management, patching, controlled source changes, review and pre-release validation appropriate to the service.
8. Incident triage, containment, recovery and escalation to the Customer’s designated contact, with breach notification governed by D3.
9. Managed database, object-storage and platform recovery facilities are used according to the configured provider plans. Recovery may include restoration through provider tooling and reapplication of deletion instructions. No fixed backup frequency, recovery-time objective or backup-expiry maximum is guaranteed unless stated in the accepted order.
10. Confidentiality duties for authorised personnel, security awareness, supplier assessment and processor terms appropriate to their functions.
11. Data export, active-copy deletion and rights-assistance processes, including requests to relevant subprocessors where required.
12. For enabled AI, Homy sends only the context selected for the requested function and does not combine one customer’s private records into another customer’s retrieval context. Homy does not authorise provider training on Customer Personal Data. Provider retention and model-improvement treatment remain subject to the applicable paid/business API terms and the account configuration used for that request.

The Customer authorises the providers below when the corresponding service or optional feature is enabled. “Applicable contracting entity” means the entity identified in Homy’s provider account and the provider terms applying to it. Countries include provider and subprocessor locations needed to deliver the service; current details may be requested at privacy@myhomy.app. Payment providers may also act as independent controllers for regulated, fraud-prevention and compliance purposes.

Changes follow D4. Direct notice is required for a new subprocessor processing Customer Personal Data; updates to this public list alone do not replace that notice.