Data processing agreement

Parties

This agreement is between the business that signs up for il-blokka and accepts it (the Controller) and Ryan Galea, a sole trader trading as il-blokka, of Barumbara Court, Mgr Alfred Mifsud, Birkirkara, Malta, VAT registration number 32953510 (the Processor). It forms part of the terms of service (the Agreement) and meets Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Cap. 586). Words such as personal data, processing and personal data breach have their GDPR meaning.

1. Subject matter, duration, nature and purpose

1. The Processor provides il-blokka to the Controller under the Agreement, and in doing so processes personal data on the Controller’s behalf.
2. Duration: the term of the Agreement, plus the period in clause 10 for return and deletion.
3. Nature and purpose: hosting and operating the software; storing, displaying and exporting what the Controller enters or uploads; generating statements, receipts and notices; sending the emails the Controller asks for; reading uploaded documents and suggesting bank matches with an AI provider; answering questions in the AI assistant; providing the resident and supplier portals; and giving support when the Controller asks.
4. Data subjects: owners, tenants, committee members, building contacts, suppliers’ contact persons, and the Controller’s staff.
5. Personal data: names, email addresses, telephone numbers, postal addresses, identity card or company registration numbers, unit ownership and occupancy, amounts charged, paid and owed, payment references, bank details of suppliers, uploaded documents and correspondence, maintenance requests, meeting attendance and votes. The Controller decides whether to record identity card numbers and does so only when clearly justified (Cap. 586, article 8). No special categories of data are intended; the Controller does not upload them unless the law allows it and it needs to.

2. Instructions

1. The Processor processes personal data only on the Controller’s documented instructions: this agreement, the Agreement, the settings the Controller chooses and its use of the features. This includes transfers outside the EEA under clause 5. If the law requires other processing, the Processor tells the Controller first unless the law forbids it.
2. The Processor tells the Controller straight away if it believes an instruction infringes data protection law.
3. The Controller is responsible for the lawfulness of the data it enters and for informing data subjects about the processing.

3. Confidentiality and support access

1. Everyone the Processor authorises to process the data is bound by confidentiality.
2. The Processor looks at the Controller’s data only when the Controller asks for support, through support sessions that are time-limited, need a stated reason and appear in the Controller’s audit log.

4. Security (GDPR Article 32)

The Processor maintains at least the measures in Annex 2, and improves them as risks and technology change.

5. Sub-processors and transfers

1. The Controller gives general authorisation for the sub-processors in Annex 3.
2. The Processor gives the Controller at least 30 days’ notice by email to its company admins before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties can’t resolve it, the Controller may end the Agreement without penalty and is refunded fees paid for the time after it ends.
3. The Processor imposes on each sub-processor data protection obligations equivalent to this agreement and remains liable to the Controller for their performance.
4. Transfers outside the EEA rely on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses, with supplementary measures where needed.
5. On request, the Processor switches the Controller’s AI processing to its EU-only provider (Annex 3).

6. Data subjects' rights

1. The Processor gives the Controller tools to answer requests: viewing and exporting a person’s records, correcting them, and anonymising a person, which replaces their name and contact details, ends their portal access and keeps the financial records the Controller must keep.
2. If a data subject contacts the Processor directly, the Processor passes the request to the Controller without delay and does not answer it itself, except to say it has been passed on.

7. Personal data breaches

1. The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, by email to the Controller’s company admins.
2. The notice describes the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed, and is updated as more becomes known.
3. The Processor helps the Controller meet its own duties to notify the Information and Data Protection Commissioner within 72 hours and, where needed, the data subjects.

8. Other assistance

The Processor helps the Controller with security, data protection impact assessments and prior consultation of the Commissioner, taking into account the nature of the processing and the information available to it.

9. Information and audits

1. The Processor makes available the information needed to show compliance with Article 28, including this agreement, its annexes and a summary of the latest restore test.
2. The Controller, or an auditor it appoints who is bound by confidentiality, may audit the Processor once a year, or after a personal data breach, on 30 days’ notice, during business hours, at the Controller’s cost, and without access to other customers’ data.

10. Return and deletion

1. During the Agreement, the Controller can export its data at any time, as set out in section 13 of the terms.
2. When the Agreement ends, the Processor keeps the data available, read-only, for 90 days so the Controller can export it or ask for the complete export, and reminds the Controller’s company admins 30 and 7 days before the end. The Controller may instead ask for earlier deletion.
3. The Processor then deletes all the Controller’s personal data, including financial records and documents, unless EU or Maltese law requires the Processor to keep it, and confirms the deletion in writing on request. Keeping the Controller’s own accounting records is the Controller’s duty, which the export meets.
4. Copies in encrypted backups expire within 12 months and are not restored except to recover from an incident.

11. Liability, precedence and law

1. Each party’s liability under this agreement is subject to the limits in the Agreement. Those limits do not apply to liability that the law does not allow to be limited, including for fraud, wilful misconduct or gross negligence, and do not affect data subjects’ rights under Article 82 GDPR.
2. If this agreement and the Agreement conflict on the processing of personal data, this agreement prevails. Where standard contractual clauses apply, they prevail over both.
3. This agreement is governed by the laws of Malta, and the courts of Malta have exclusive jurisdiction.

12. Contact

Data protection contact for the Processor: Ryan Galea, [email protected]. The Controller’s contacts are its company admins in il-blokka.

Annex 1: Processing details

As in clause 1. Processing is continuous for the term of the Agreement.

Annex 2: Technical and organisational measures

• Separation: every customer’s data carries its organisation and is protected by database row-level security that the application cannot bypass, with automated tests that one customer cannot reach another’s data.
• Access control: roles and permissions checked in one place; two-factor authentication required for staff; session revocation; single-use, expiring invitation links.
• Audit: an append-only audit log of sign-ups, role changes, financial postings, approvals, exports, support access, settings changes and anonymisation.
• Financial integrity: an immutable double-entry ledger, period locks and protection against duplicate postings.
• Uploads: size limits, file-type checks, malware scanning, re-encoding of images, and documents served only through short-lived links after a permission check.
• Encryption: TLS for all traffic, with HSTS; encrypted backups; passwords stored only as hashes.
• Infrastructure: hosting in the EU; separate credentials for running the application, changing the database and taking backups; the database is not reachable from the internet.
• Resilience: encrypted backups kept separately from the servers, with a second encrypted copy at another provider: the database every hour and documents every night, kept for up to 12 months, with weekly integrity checks and regular restore tests.
• Monitoring: server logs rotated and overwritten automatically; personal data removed from error reports.
• AI: document content treated as data, never as instructions; AI output checked against a fixed structure; no AI-initiated changes; human review before anything is recorded; providers that don’t train on the data.

Annex 3: Sub-processors

Used for every customer:

Used only when switched on for the Controller, or for everyone after notice under clause 5.2: