Version: 1.0 Last Updated: April 19, 2026
This Data Processing Addendum ("DPA") forms part of the agreement (the "Agreement") between Twellie, Inc. ("Twellie," "Processor") and the customer identified in the Agreement ("Customer," "Controller"). It governs the Processing of Personal Data performed by Twellie on behalf of the Customer in connection with the Service.
This DPA is incorporated into and forms part of the Terms of Service. In case of conflict between this DPA and the Terms of Service, this DPA controls only with respect to the Processing of Personal Data. Otherwise the Terms of Service prevail.
By accepting the Terms of Service you are deemed to have signed this DPA on behalf of your organization. For execution of a separately signed copy, email legal@twellie.com.
Capitalised terms used but not defined here have the meanings given in the Agreement, the GDPR (Regulation (EU) 2016/679), or the UK GDPR, as applicable.
"Affiliate" — any entity that directly or indirectly controls, is controlled by, or is under common control with a party.
"Controller" — the Customer, who determines the purposes and means of the Processing.
"Data Subject" — an identified or identifiable natural person whose Personal Data is Processed.
"EU GDPR" — Regulation (EU) 2016/679 of the European Parliament and of the Council.
"Personal Data" — any information relating to an identified or identifiable natural person that is Processed under the Agreement.
"Processing" — any operation performed on Personal Data (collection, storage, use, disclosure, erasure, etc.).
"Processor" — Twellie, which Processes Personal Data on behalf of the Controller.
"Restricted Transfer" — a transfer of Personal Data from the EEA, UK, or Switzerland to a country not deemed adequate under the relevant Data Protection Law.
"Standard Contractual Clauses" ("SCCs") — Module 2 (Controller-to-Processor) of the European Commission's Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, as amended, incorporated here by reference.
"Sub-processor" — any third party engaged by Twellie to Process Personal Data on behalf of the Controller.
"UK GDPR" — the EU GDPR as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
"UK IDTA" — the International Data Transfer Agreement issued by the UK Information Commissioner, as updated from time to time.
Twellie will Process Personal Data provided by the Controller or collected by Twellie on behalf of the Controller in order to deliver the Service described in the Agreement.
The duration of Processing is the term of the Agreement plus any additional period required to comply with legal obligations or to return or delete Personal Data.
The nature of the Processing includes hosting, storage, transmission, analysis, generation of Reports, and support. The purpose is solely to deliver and support the Service.
End users of the Customer's workspace; residents of properties submitted for analysis whose information appears in public records or photographs.
Twellie does not intentionally Process special categories of data (GDPR Art. 9).
Twellie will:
Process Personal Data only on the Controller's documented instructions, including with regard to transfers, except where required by EU, UK, or other applicable law. Where Twellie relies on a legal requirement, it will inform the Controller unless the law prohibits such notification on important grounds of public interest. The Terms of Service + this DPA constitute the Controller's complete and final instructions.
Ensure that persons authorised to Process Personal Data are under appropriate contractual or statutory confidentiality obligations.
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (the "Security Measures"), as described in Annex II to this DPA.
Engage Sub-processors only in accordance with Section 5 below.
Taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligations to respond to data-subject requests under Articles 12-22 GDPR. Twellie provides self-service access, export, and deletion tools via the Service.
Assist the Controller in ensuring compliance with Articles 32-36 GDPR (security, personal data breaches, impact assessments, consultation with supervisory authorities), taking into account the nature of the Processing and the information available to Twellie.
At the choice of the Controller, delete or return all Personal Data after the end of the Service, and delete existing copies unless EU, UK, or other applicable law requires storage.
Make available to the Controller all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to Section 8 below.
The Controller:
The Controller provides general authorisation for Twellie to engage Sub-processors to deliver the Service. The current list of Sub-processors is available at https://twellie.com/sub-processors and incorporated into this DPA by reference.
Twellie will notify the Controller of any intended addition or replacement of a Sub-processor, giving the Controller an opportunity to object at least fifteen (15) days before the new Sub-processor begins Processing. Notification will be via email to the Controller's primary administrative contact and by updating the published Sub-processor list.
If the Controller has a reasonable basis to object — e.g., the new Sub-processor cannot comply with Data Protection Law — the Controller may notify Twellie at legal@twellie.com. Twellie will work in good faith to find a reasonable alternative. If no alternative can be agreed within thirty (30) days, either party may terminate the affected part of the Service without liability (except that the Controller remains obligated to pay for Service already rendered).
Twellie will:
To the extent any Processing involves a Restricted Transfer from the EEA to a country not recognised as adequate, the Standard Contractual Clauses (Module 2: Controller-to-Processor) will be deemed incorporated into this DPA and executed by the parties. The following options apply:
For Restricted Transfers originating in the UK, the UK International Data Transfer Addendum (or the UK IDTA as a standalone instrument at the Controller's option) applies and is incorporated into this DPA. Tables 1-4 are populated by reference to the corresponding sections of this DPA and the SCCs.
For Restricted Transfers originating in Switzerland, the SCCs apply as modified by the Swiss Federal Data Protection Authority, with Switzerland as the governing jurisdiction and the Swiss authority as the competent supervisory authority.
Twellie maintains the supplementary technical, organisational, and contractual measures described in Annex II to mitigate risks identified in the Schrems II judgment (including encryption in transit and at rest, access controls, and commitments to challenge overbroad government requests).
Twellie may, at its discretion, participate in an adequacy framework (e.g. the EU-U.S. Data Privacy Framework) as a self-certifying participant; if it does so, certifications will be published on the Sub-processor page. Where the Controller wishes to rely on DPF adequacy, Twellie will cooperate.
Twellie will notify the Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting the Controller's Personal Data.
The notification will describe, to the extent then known:
Additional information will be provided as it becomes available.
The Controller remains solely responsible for any notifications to Data Subjects or supervisory authorities required under Articles 33-34 GDPR.
Minor incidents that pose no risk to Data Subjects (e.g. failed login attempts, malware blocked at the perimeter) do not constitute Personal Data Breaches and are not individually reportable, though Twellie aggregates and reports them through internal security reviews.
Twellie will make available independent third-party audit reports (e.g. SOC 2, ISO 27001 when obtained) to the Controller under NDA as the principal means of demonstrating compliance.
Where the Controller reasonably requires further information that is not addressed in the audit reports, Twellie will respond to reasonable written requests within thirty (30) days.
On-site audits are available once per twelve-month period, subject to:
Twellie may decline access to:
The liability of each party under this DPA is subject to the exclusions and limitations set out in the Agreement. Nothing in this DPA excludes or limits liability for:
This DPA enters into force on the Effective Date of the Agreement and terminates upon termination of the Agreement, except for provisions that by their nature should survive.
This DPA may be amended by Twellie to the minimum extent necessary to comply with changes in Data Protection Law. Twellie will provide thirty (30) days' notice of material amendments. The Controller's continued use after the effective date constitutes acceptance.
In case of conflict between this DPA and the SCCs, the SCCs prevail in respect of Restricted Transfers only. In case of conflict between this DPA and the Agreement, this DPA prevails in respect of data protection.
This DPA may be executed electronically and in counterparts, each of which is an original.
Controller: the Customer identified in the Agreement. Contact: the email associated with the admin Account. Processor: Twellie, Inc., [ADDRESS — INSERT BEFORE LAUNCH]. Contact: legal@twellie.com.
Twellie implements the following Security Measures. Measures are regularly reviewed and updated as technology and threats evolve; the current list is always available at https://twellie.com/security.
includeSubDomains;The current list of authorised Sub-processors is published at https://twellie.com/sub-processors and includes at minimum the categories: authentication/database, payments, email, AI/ML model providers, error monitoring, analytics, infrastructure, and distribution (where applicable).
By accepting the Agreement and the Terms of Service, the Controller and the Processor are deemed to have executed this DPA. For a separately countersigned copy bearing wet-ink or electronic signatures, please email legal@twellie.com with the subject line "Signed DPA request." Twellie will countersign and return within ten (10) business days.
© 2026 Twellie, Inc. All rights reserved. This document is a template for enterprise engagements and an informational disclosure for consumer customers.