Data processing terms

Subject matter

Management of a private residence and the operation of the Custos platform.

Duration

For as long as the management agreement runs, plus the retention stated in the privacy notice.

Nature and purpose

Recording visits, findings, devices, approvals, correspondence and invoices.

Categories of person

Owners and co-owners, members of the household, named representatives, contractors' staff and our own people.

Categories of data

Name and contact details, residence and access details, correspondence, photographs of the property, approvals and spend, and service history.

Custos processes personal data only on the client's documented instructions, including the instructions carried by ordinary use of the platform, unless required otherwise by law. If we consider an instruction unlawful, we say so before acting on it.

Everyone with access is bound to confidentiality, is given access only where their work requires it, and loses it the day their role ends.

We apply the measures described in the security overview: named accounts, role and residence-scoped access enforced by the database, append-only audit records, private storage for photographs and documents, and encryption in transit and at rest. Measures are reviewed as the service changes and may be improved, never weakened.

The client gives general authorisation for the subprocessors listed in the current annex. New subprocessors are notified at least thirty days in advance, with a right to object as described on the subprocessors page. Each is engaged under written terms no weaker than these, and we remain responsible for their performance.

We assist the client with requests from data subjects, with impact assessments and with prior consultation, taking into account the nature of the processing and what is available to us. Where a request reaches us directly, we forward it rather than answer it, unless the client has asked us to answer on their behalf.

We notify the client without undue delay after becoming aware of a personal data breach, with the facts as we know them, the likely consequences and the measures taken. We do not wait for a complete picture before making the first notification.

On termination the client receives a complete export of the residence file. Personal data is then deleted or returned at the client's choice, except where retention is required by law, in which case it is isolated and processed no further.

We make available the information needed to demonstrate compliance and allow an audit once in any twelve-month period, on reasonable notice, during business hours, and without disturbing other clients' data. A recent third-party report may be offered in place of an on-site audit where one exists.

Processing takes place within the European Economic Area wherever the service allows. Any transfer outside it relies on a lawful transfer mechanism, named in the subprocessor annex, together with the additional measures that mechanism requires.