Data processing agreement

This agreement is part of our platform terms, and it applies automatically to every organisation that uses KimonComply under them, from the date at the top of this page. Nobody needs to sign anything.

It covers the information your organisation puts into KimonComply. If this agreement and the platform terms ever say different things about that information, this agreement applies.

To keep a copy, print this page from your browser. The version number and the dates at the top show exactly which words applied.

Your organisation decides what its information is for and how it is used. That makes your organisation the controller. UK GDPR uses this word for whoever decides.

KimonComply is run by Kimon Services (UK) Ltd, a company registered in England and Wales, company number 15309792, whose registered office is at 71-75 Shelton Street, London, WC2H 9JQ. We handle your organisation's information on its behalf, which makes us its processor. UK GDPR uses this word for whoever handles information for someone else.

We also look after the details people use to sign in, so that we can run the service. Our privacy notice explains that part.

We store your organisation's information, keep it safe and show it to the people your organisation lets see it. We also use it to keep documents and their versions, records, registers, audits and findings, to send the emails and reminders your organisation sets up, and to produce the reports and packs it asks for.

If your organisation uses the property service, the compliance officers who run that service work with its property records to carry out the checks and reminders the service provides.

We do this only to provide KimonComply to your organisation. We do not sell its information and we do not use it for advertising.

We do it for as long as your organisation has an account with us, and afterwards only as section 12 describes.

The kinds of information we handle for your organisation are these.

• •Its records for ISO standards: documents and their versions, records and registers, audits, findings, photographs and the files it uploads as evidence.
• •Its records for the property service: its properties, the people who rent them and their contact details, safety certificates and Right to Rent copies.
• •The names and email addresses of the people it invites to use KimonComply, and the record of what each of them did and when.

The people it is about are the people who work for or with your organisation, the people named in its records, such as auditors, suppliers and customers, and, if it uses the property service, its renters.

Your organisation decides what it puts in.

We handle your organisation's information only on its documented instructions. Those instructions are our platform terms, this agreement, and what your organisation's people do in KimonComply, such as uploading a file, inviting someone or asking for a report.

That includes instructions about where the information goes. We do not send it to another country, or let anyone reach it from one, except as sections 8 and 9 describe.

If the law makes us do something with it that your organisation did not ask for, we will tell your organisation before we do it, unless the law forbids us to.

We make sure that everyone who works on your organisation's information for us, our own staff and the staff of the companies in section 8, has agreed to keep it confidential or is under a legal duty to, before they work on it.

We let each of them reach only what they need for the work they are doing.

We protect your organisation's information with these measures.

• •Everything travels over an encrypted connection, between your browser and us and between us and the companies in section 8.
• •Every file your organisation uploads is encrypted where it is stored.
• •Reaching your organisation's records needs someone signed in as a member of your organisation, and the database itself enforces that, so one organisation cannot see another's records.
• •The record trail keeps a list of what was done and when, each entry locked to the one before it, so a change to an earlier entry can be detected.

The disk our records sit on is not itself encrypted. What protects them there is that very few people can reach the machine. Our privacy notice will say when this changes.

We use other companies to help run KimonComply, such as the machine it runs on and the service that sends its email. UK GDPR calls them sub-processors. Every one is listed on our sub-processors page, with what it does, the kinds of information it handles, and where.

Your organisation gives us general permission to use the companies on that list, and to add a company or replace one, on the terms below.

When we add or replace a company, we update the sub-processors page first, with the date the change takes effect. Updating that page is how we tell your organisation. Please look at it from time to time.

Your organisation can object to a new company. Write to info@kimonservices.com before the date the change takes effect, say which company and why, and we will answer.

If we cannot meet the objection, your organisation can stop using the module that relies on that company, or close its account, before the change takes effect. Our platform terms say what happens to its records when it does.

Before a company handles any of your organisation's information, we put it under a written agreement that protects the information at least as well as this agreement does. We stay responsible to your organisation for what each company does with it.

UK GDPR has rules for information handled in a third country, and we keep to them. Our sub-processors page says where each company handles information.

We transfer information to a third country only under the safeguards UK GDPR requires, such as an approved data transfer agreement, and only once that agreement is signed.

If a safeguard we rely on stops applying, we will stop that transfer or replace the safeguard with another the law allows, and we will tell your organisation.

People have rights over their information, such as asking to see it, to correct it or to have it erased. Your organisation's account admin can deal with many requests in KimonComply itself, for example by erasing a person's details from People and roles.

Where your organisation needs our help to answer a request, write to info@kimonservices.com and we will give it, so that your organisation can answer within the time the law allows.

If a person asks us directly about information your organisation holds, we will pass the request to your organisation, and we will not answer it ourselves unless your organisation asks us to.

If we learn of a breach affecting your organisation's information, we will tell your organisation as soon as we can, without undue delay. We will say what happened, what information and how many people it may affect, and what we are doing about it. We will keep telling your organisation as we learn more.

We will also help your organisation keep its information safe, report a breach to the regulator or to the people affected, and carry out a data protection impact assessment, including talking to the regulator about one. That assessment is the check UK GDPR asks for before information is handled in a way that carries a high risk to people.

Closing your organisation's account does not delete anything. Its records stay as they were, as our platform terms explain. They are still there if a certification body asks for them or your organisation comes back.

If your organisation wants a copy of its records, write to info@kimonservices.com and we will provide one.

If your organisation wants the personal details in its records erased, write to info@kimonservices.com. A person handles the request. This is what happens.

• •People's names, email addresses and passwords are overwritten so they can no longer be read, and their sessions are removed so nobody stays signed in.
• •Names in competence records, and the name and address on the notice your renters read, are overwritten in the same way.
• •The record trail is kept. It is a list of what was done and when, each entry locked to the one before it. Nobody, including us, can edit it or remove it. It holds dates, actions and account references rather than names or email addresses, so once the details above are overwritten it names nobody.
• •Audit reports and audit-ready packs that have already been issued are kept exactly as issued, for the current certification cycle and the one after it, roughly six to seven years. A certified organisation has to be able to show the audits it has run, and UK GDPR allows information to be kept where it is needed to meet a legal obligation or to defend a legal claim.

We will give your organisation the information it reasonably needs to show that we keep to this agreement. Write to info@kimonservices.com and ask.

Your organisation, or an auditor it chooses who agrees to keep what they see confidential, may audit us, including by inspection, to check that we keep to it, and we will help. We ask for reasonable notice, and no check may reach another organisation's information.

If we think an instruction from your organisation would break UK GDPR or another data protection law, we will tell your organisation straight away. We may wait to carry out that instruction until we have talked it through with your organisation.

This agreement lasts for as long as we hold any of your organisation's information, including after its account closes.

Each change to it is a new version of this page, with its own version number and dates at the top. Because it is part of our platform terms, it changes only with a new version of those terms, and the platform terms say how we tell your organisation about one.