Data processing terms

Last updated 2026-10-21 · Version 1.0

1. Roles and scope

These Data Processing Terms (“DPT”) form part of the Realest Terms of Service between you (the “customer”) and i7V Renewables Ltd (“Realest”, “we”, “us”).

When you use Realest, you add personal data about your clients and contacts, such as buyers, tenants, vendors, landlords, viewing attendees, enquirers and invoice clients (“Client Data”). For Client Data:

• you are the controller (under POPIA, the “responsible party”), and
• we are your processor (under POPIA, the “operator”).

The details of the processing are in Annex A.

These DPT do not cover personal data we handle as a controller, such as your own account details. Our privacy policy covers that.

“Data Protection Law” means, as applicable, the UK GDPR and the Data Protection Act 2018, the EU GDPR, and POPIA.

2. Your instructions

We process Client Data only on your documented instructions. Your instructions are these DPT, the Terms of Service, and the way you use and configure Realest, including what you share and publish through it.

We will not process Client Data for any other purpose, unless the law requires it. If it does, we will tell you before we process it, unless the law prevents us.

If we believe an instruction breaks Data Protection Law, we will tell you.

3. Your responsibilities

You confirm that:

• you have a lawful basis to collect Client Data and add it to Realest
• you have told the people concerned how their data will be used, including that you use Realest
• your instructions to us comply with Data Protection Law

4. Confidentiality

We make sure everyone we authorise to access Client Data is bound by a duty of confidentiality and accesses it only as needed to provide, support or secure Realest.

5. Security

We maintain appropriate technical and organisational measures to protect Client Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The current measures are described in Annex B. We may update them, as long as the overall level of protection does not fall.

6. Sub-processors

You give us general authorisation to use sub-processors to help provide Realest. The current sub-processors are listed in Annex C.

We will give you at least 30 days’ notice before adding or replacing a sub-processor, by email or in the app. If you object on reasonable data protection grounds, tell us within that period. We will discuss your objection with you. If we cannot resolve it, you may cancel your subscription and delete your account.

We put a written contract in place with each sub-processor that gives Client Data at least the same protection as these DPT. We remain responsible to you for our sub-processors’ performance.

7. International transfers

Client Data is stored mainly in the UK, with uploaded photos stored in the EU. Our staff access Client Data only from the UK.

Some sub-processors process data in other countries, including the United States. Where Client Data leaves the UK or the EU, we use a lawful transfer mechanism, such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the UK-US data bridge for certified providers. For data about people in South Africa, we only transfer it to recipients bound by law or contract to protect it to a standard substantially similar to POPIA.

8. Helping you with people’s rights

Realest lets you find, correct, export and delete Client Data, so you can respond to requests from the people concerned.

If we receive a request directly from one of your clients or contacts, we will pass it to you within 5 working days and will not respond to it ourselves, unless you ask us to.

Where you need further help to respond to a request, we will give reasonable assistance.

9. Personal data breaches

If we become aware of a personal data breach affecting Client Data, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it.

We will give you the information we reasonably can to help you meet your own obligations, including notifying a regulator or the people affected. We will take reasonable steps to contain the breach and reduce its effects.

10. Impact assessments and regulators

We will give you reasonable help with data protection impact assessments and with any consultation with a regulator, where they relate to your use of Realest.

11. Deletion and return of Client Data

You can export Client Data at any time while your account is active, and during the 30 days after your subscription ends, through the locked “Export my data” screen. Exports include contacts, properties, appointments, leads, notes and trip records, in a reusable format.

When your account is deleted, or 30 days after your subscription ends, we permanently delete Client Data from Realest. Copies in our backups are overwritten within 7 days after that.

We will keep Client Data longer only where the law requires us to, and only for as long as it requires.

12. Information and audits

We will make available the information reasonably needed to show that we meet these DPT. You may audit our compliance once in any 12-month period, at your own cost, on at least 30 days’ written notice. Audits are normally carried out by written questions and documents. If an on-site audit is needed, the auditor must be bound by confidentiality, and the audit must be carried out during business hours with minimal disruption.

We may also allow audits more often where a regulator requires it, or after a personal data breach affecting your Client Data.

13. Liability

Each party’s liability under these DPT is subject to the limits in section 11 of the Terms of Service, including the data protection limit of [amount to be confirmed].

14. Duration and order of precedence

These DPT apply for as long as we process Client Data for you. If these DPT and the Terms of Service conflict on how we handle Client Data, these DPT apply.

Annex A: Details of the processing

Annex B: Security measures

• Encrypted connections between the apps and our servers (HTTPS)
• Passwords stored using a secure one-way hashing method (bcrypt)
• Role-based access controls, with database-level rules limiting each account to its own records
• Staff access limited to authorised administrators, recorded in an audit log, and made only from the UK
• Hosting with DigitalOcean in London, with daily database backups and 7-day point-in-time recovery
• Limits on repeated sign-in and form submissions to reduce abuse
• Sign-in tokens stored in the device’s secure storage (iOS Keychain or Android Keystore)
• A documented process for handling personal data breaches

Annex C: Sub-processors