Domistra™ Data Processing Addendum
Controller-to-Processor Data Protection Terms
Effective Date: September 28, 2026
Last Updated: September 28, 2026
Domistra Inc. | Bedford, Nova Scotia, Canada
This DPA is designed to supplement an agreement between Domistra Inc. and an organizational customer where Domistra Inc. processes personal data on the customer’s behalf. It should be incorporated into the applicable customer agreement or order form.
1. Parties and Scope
This Data Processing Addendum (“DPA”) applies where Domistra Inc. (“Processor”) processes Personal Data on behalf of the customer (“Controller”) in connection with the Domistra™ Services. Capitalized terms not defined here have the meaning in the governing agreement or applicable Data Protection Law.
2. Processing Instructions
Domistra Inc. will process Personal Data only on documented instructions from the Controller, including instructions inherent in the agreement and the Controller’s authorized use and configuration of the Services, unless processing is required by law. If legally permitted, Domistra Inc. will inform the Controller before processing required by law.
3. Controller Responsibilities
The Controller is responsible for the lawfulness of its instructions, notices, lawful bases, consents where required, data accuracy, user authorization, and compliance with laws applicable to its property, tenancy, employment, vendor and other business activities. The Controller will not instruct Domistra Inc. to process Personal Data unlawfully.
4. Confidentiality and Personnel
Domistra Inc. will ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations and receive access only as needed for their functions.
5. Security
Domistra Inc. will maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the nature, scope, context and purposes of processing and relevant risk. Measures include identity and access controls, encryption where appropriate, logging, vulnerability management, secure development, backups and incident response.
6. Subprocessors
The Controller provides general authorization for Domistra Inc. to engage subprocessors to provide the Services. Domistra Inc. will maintain a Subprocessor List and impose data-protection obligations appropriate to the processing. Where required by applicable law or contract, Domistra Inc. will provide notice of intended material additions or replacements and a reasonable mechanism to raise substantiated data-protection objections.
7. Data Subject Requests
Taking into account the nature of processing, Domistra Inc. will provide reasonable assistance to enable the Controller to respond to requests to exercise data-subject rights. If Domistra Inc. receives a request concerning Controller-controlled Personal Data, it may direct the requester to the Controller unless law requires otherwise.
8. Security Incidents
Domistra Inc. will notify the Controller without undue delay after becoming aware of a confirmed Personal Data Breach affecting Personal Data processed under this DPA, where notification is required. The notice will include information reasonably available to Domistra Inc. to assist the Controller with its obligations. Notification is not an admission of fault or liability.
9. DPIAs and Regulatory Cooperation
Taking into account the nature of processing and information available to Domistra Inc., Domistra Inc. will provide reasonable assistance with legally required data-protection impact assessments, prior consultations and regulator inquiries relating to the processing, subject to appropriate confidentiality and cost arrangements for exceptional requests.
10. International Transfers
Where a restricted international transfer requires safeguards, the parties will use an applicable lawful transfer mechanism. For EEA transfers, the applicable European Commission Standard Contractual Clauses may be incorporated where required, with the Controller as data exporter and Domistra Inc. as data importer to the extent applicable. For UK restricted transfers, the applicable UK addendum or other lawful mechanism may apply. Other jurisdictions will use safeguards required by applicable law.
11. Return and Deletion
At the end of the Services, Domistra Inc. will delete or return Controller Personal Data in accordance with the agreement and Controller instructions, unless law requires retention. Data may remain temporarily in secure backups until overwritten under standard cycles, with continued protection and no active use except recovery, security or legal requirements.
12. Audits and Information
Domistra Inc. will make available information reasonably necessary to demonstrate compliance with this DPA. Where required by law, the Controller may conduct an audit subject to reasonable advance notice, confidentiality, security, non-disruption and scope limitations. Independent assurance reports may be used to satisfy routine audit requests when available.
13. Schedule A - Processing Details
| Element | Description |
|---|---|
| Subject matter | Provision of Domistra™ PMS and contracted Services |
| Duration | For the term of the Services plus lawful retention/deletion period |
| Nature/purpose | Hosting, organizing, transmitting, securing, supporting and otherwise processing customer-controlled data to provide configured Services |
| Data subjects | Property managers, staff, landlords, tenants/residents, applicants, household members, vendors/contractors, authorized contacts and other persons whose data the Controller submits |
| Data types | Identity/contact, property/tenancy/lease, documents/eSign, maintenance/inspection/work order, communications, transaction/payment metadata, audit/security and other customer-submitted data |
| Sensitive data | May include identity documents, financial information or other sensitive information where submitted and lawfully processed; customers should minimize sensitive data to what is necessary |
14. Contact
Domistra Inc.
11 Puncheon Way, Bedford, Nova Scotia, B4B 2L1, Canada
- Privacy: privacy@domistra.com
- Legal: legal@domistra.com
- Security: security@domistra.com
Domistra™ and associated Domistra names, logos, product names and branding are trademarks or other intellectual property of Domistra Inc. Unauthorized use is prohibited.