Progressa

Legal

Data Processing Agreement.

Draft — not yet reviewed. This is written to be accurate about what we actually do today, but it has not been through legal review and it is not legal advice. It may change before Progressa opens.

There is nothing to process yet, so there is no agreement in force. This page explains when one will be needed and what it will say, so you can see it coming rather than discover it at signup.

Why it does not apply today

A data processing agreement governs the situation where your agency is the controller of personal data about your own clients, and we process it on your instructions. That situation does not exist yet. Progressa is not open, we hold no agency’s client records, and there is no system for us to hold them in.

The two things we do hold today — waitlist details and research notes — are ours as controller, not yours. Those are covered by the Privacy Notice, and a DPA is the wrong instrument for them.

During our research this week

We deliberately keep ourselves out of processor territory while researching. We ask agents not to show us real client or transaction data, we do not ask for exports or logins, and if something identifying appears on a shared screen we do not record it or write it down. That way there is nothing to govern, which is simpler for both of us than papering it.

If your agency’s own policy requires something signed before you will even talk to us, a mutual NDA is the appropriate document at this stage rather than a DPA. Ask and we will send one.

What the agreement will cover

When Progressa opens, the DPA will be part of the terms, and will set out:

  • the subject matter, duration, nature and purpose of the processing
  • the categories of personal data and of data subjects
  • that we act only on your documented instructions, and tell you if an instruction appears unlawful
  • confidentiality obligations binding anyone with access
  • the technical and organisational security measures in place, described specifically rather than as a gesture
  • the sub-processors we use, and advance notice before that list changes, with a right to object
  • how we assist you with access, correction and erasure requests from your clients
  • breach notification, and the period within which you will hear from us
  • deletion or return of data when the agreement ends, and by when
  • audit and information rights
  • where data is hosted, any international transfer, and the lawful basis for it

Where data will sit

Worth flagging early because it tends to matter to agencies: the waitlist database is currently hosted in London, in the United Kingdom, which is outside the EU but covered by a European Commission adequacy decision. Before the product handles any agency’s client data we intend to be in an EU region, and the agreement will state the location plainly.

If you need something sooner

If your agency needs an executed agreement, or a security questionnaire completed, before Progressa opens, email hello@progressa.ie and it will be dealt with directly by a person rather than routed into a process.

True Home Properties Limited, registered in Ireland, company number 811518.