# KeyAccess Data Processing Agreement Version 2026-11-10. Last updated 10 November 2026. ## 1. Parties and scope This data processing agreement (“DPA”) is between the customer that has accepted the KeyAccess Terms and Conditions (the “Customer”, acting as controller) and the operator of KeyAccess (“KeyAccess”, acting as processor). It forms part of the Terms and applies whenever KeyAccess processes personal data on the Customer’s behalf in providing the Service. Where the Customer is itself a processor for another controller, KeyAccess acts as its sub-processor, and the Customer is responsible for passing on the relevant instructions. Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given by the data protection law that applies. If this DPA and the Terms conflict on the processing of personal data, this DPA applies. ## 2. Details of the processing - Subject matter and purpose: providing the Service, including drafting and sending approved replies, organising viewing notes, checking property details, matching buyers to properties, writing listings and seller reports, tracking deals and promises, running the seller portal, and carrying out approved work in connected apps and websites. - Duration: for as long as the Customer uses the Service, and until the data is deleted or returned under section 10. - Nature of processing: storing, organising, retrieving, analysing with AI models, transmitting to connected apps and websites on the Customer’s approval, and deleting. - Data subjects: the Customer’s staff, and its clients, prospective clients, buyers, tenants, sellers, landlords and other contacts. - Types of personal data: names, email addresses, phone numbers, message content, property details linked to a person, viewing feedback, property requirements, deal progress, and details of messages with leads (sender, recipients, time and conversation) for mailboxes the owner chooses to track. - Special category data: none is intended. The Service refuses buyer requirements about a person rather than a property, and the Customer must not use the Service to process special category or criminal offence data. ## 3. Customer instructions KeyAccess processes personal data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s use and configuration of the Service, including its requests, approvals, bot settings and connections, are its instructions. KeyAccess will tell the Customer if it believes an instruction breaks data protection law, unless the law forbids that. KeyAccess will process personal data for any other purpose only where the law requires, and will tell the Customer first unless the law forbids it. KeyAccess will not sell the personal data, use it for advertising, or use it to train AI models. The Customer is responsible for the lawfulness of its instructions, for having a lawful basis for the processing, and for giving data subjects any required notices. ## 4. Confidentiality KeyAccess ensures that everyone it authorises to process the personal data is bound to keep it confidential. KeyAccess staff access customer data only as needed to provide and support the Service, and platform administration shows account details and usage, not message or record content. ## 5. Security KeyAccess maintains technical and organisational measures appropriate to the risk, including: - separation of each customer’s data at the database level, enforced on every request, job and file; - role-based permissions within each organisation, with personal connections and website logins private to their owner; - passwords stored only as salted, one-way hashes; - encryption of stored keys and website sessions with AES-256-GCM, with each website session sealed by its own key held apart from the computer; - no storage of website passwords: people type them into the website themselves; - a separate secure computer for each person in each organisation, never shared, and deleted when the person leaves; - approval before anything is sent or changed outside KeyAccess, bound to the exact version approved; - records of important actions, such as approvals, connections and permission changes; - error reports with email addresses, keys and tokens removed; - encryption of data in transit, and emergency stops to pause work across the Service or for a single customer. KeyAccess may update these measures, provided the overall level of protection is not reduced. ## 6. Sub-processors The Customer authorises KeyAccess to use the following sub-processors: - Anthropic: AI models that draft, sort and check work. The content needed for each request, such as an enquiry, viewing notes or a page screenshot. Based in United States. - OpenAI: AI models, when an organisation chooses them. The content needed for each request. Based in United States. - xAI: AI models, when an organisation chooses them. The content needed for each request. Based in United States. - Composio: Connecting apps such as Gmail, and carrying out approved actions in them. Connection tokens, and the messages or records an approved action sends or reads. Based in United States. - Orgo: Secure remote computers for website logins and website work. Sealed website sessions, and what's on screen while a computer runs. Based in United States. - Paddle: Payments, as reseller and merchant of record. Billing name, email, address, tax details and payment details. Based in United Kingdom. - Render: Hosting the KeyAccess website, application, background work and database. All data held by KeyAccess, stored in its Virginia region. Based in United States. - Supabase: The KeyAccess database, if chosen instead of Render's. All data held by KeyAccess, stored in the region KeyAccess chooses. Not chosen yet, and listed here before it receives any data. - Resend: Sending account emails, such as email confirmations, password resets and invitations. Name, email address and the email’s content. Based in United States. KeyAccess imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance. ## 7. Changes to sub-processors KeyAccess will give the Customer at least 30 days’ notice before a new sub-processor processes the Customer’s personal data, by updating the list in this DPA and notifying account owners. The Customer may object on reasonable data protection grounds within that period. If the parties can’t resolve the objection, the Customer may end the affected Service and receive a refund of unused prepaid fees. ## 8. Helping the Customer Taking into account the nature of the processing, KeyAccess will help the Customer respond to requests from data subjects to exercise their rights, and with security, breach notification, data protection impact assessments and consultations with authorities. The Service lets the Customer view, correct and delete most data itself. If KeyAccess receives a request directly from a data subject about the Customer’s data, it will pass it to the Customer and not respond itself, unless the law requires. ## 9. Personal data breaches KeyAccess will tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer’s personal data. It will provide the information it has about the nature of the breach, the data and people affected, its likely consequences, and the measures taken or proposed, adding more as it becomes available. KeyAccess will take reasonable steps to contain the breach and limit its effects. ## 10. Return and deletion When the agreement ends, the Customer may obtain a copy of its personal data, by export or on request, for 30 days. KeyAccess will then delete the Customer’s personal data within 90 days, except where the law requires it to be kept, in which case it stays protected by this DPA and is used for nothing else. Backups are overwritten in their normal cycle. ## 11. Information and audits KeyAccess will make available the information reasonably needed to show compliance with this DPA, and will allow audits by the Customer or an independent auditor it appoints, on at least 30 days’ notice, during business hours, no more than once a year unless a breach or an authority requires otherwise, and subject to confidentiality. The Customer bears its own costs. KeyAccess may first offer documents or reports that answer the Customer’s questions. ## 12. International transfers Some sub-processors are based outside the country where the Customer’s data is collected. Where the law requires it, KeyAccess will ensure transfers are protected by appropriate safeguards, such as standard contractual clauses approved by the relevant authority, which are incorporated into this DPA by reference where they apply. ## 13. Liability, law and contact Each party’s liability under this DPA is subject to the limits in the Terms, except where the law doesn’t allow them. This DPA is governed by the same law, and disputes go to the same courts, as the Terms. Contact KeyAccess about this DPA through the support contact published at keyaccess-ai.com.