Data Processing / DPA information

1. Determine roles by data flow

For its own account administration, security, billing if later enabled, support and marketing, the app operator may be a controller where it determines purposes and means. A landlord may be a controller for tenant/tenancy records; Sapphire may act as processor where it handles those records solely on documented landlord instructions. Tenants and contractors are not automatically controllers or processors just because they have a role label.

Joint or independent controller relationships must be assessed where parties determine purposes together or use information independently. Map each flow, instruction and lawful disclosure; confirm the legal parties before contracting. No live operational processing contract exists in this preview.

2. Required Article 28 terms

An executed agreement must state subject matter, duration, nature and purpose; personal-data types and data-subject categories; controller rights and obligations; documented instructions including transfers; confidentiality commitments; appropriate security; assistance with rights, breaches, DPIAs and regulator consultation; subprocessor conditions; return/deletion; and proportionate audit/information duties. Unlawful instructions must be flagged. This checklist is not a substitute for signed terms.

3. Subprocessors and international access

Lovable/Lovable Cloud, Google Fonts and map-tile requests are observed in the app; Shopify retains the historical contact and legacy buyer pages; the new Contact page only prepares mailto drafts, with no configured sender. Whether each is a subprocessor for a specific landlord flow is not yet determined. A verified register must give legal entity, service, data role, location/access, contractual safeguards and onward providers. A consent/authorization and change-notice mechanism must be agreed where Article 28 requires it.

Hosting geography and restricted-transfer mechanisms are unverified. Do not describe all processing as UK-only. Confirm adequacy or appropriate UK transfer instruments and assessments with the operator and providers before tenant records are accepted.

4. Instructions, export, deletion and breaches

No processor export/deletion portal is wired. A future verified instruction must identify the controller and scope, avoid erasing another person’s records improperly, handle legal holds, revoke access, delete or return applicable files/records, document backup treatment and audit outcome. See Account Deletion; refreshing a demo is not contract termination or server deletion.

Agree security schedules, incident contacts, assistance responsibilities, audit evidence, backup expiry, approved retention and end-of-service return/deletion before launch. Processor breach notification must be without undue delay; no contractual response time or tested breach workflow is claimed here.