Searchroom Article 28 Data Processing Agreement

Effective date: 12 July 2026

This Data Processing Agreement supplements the Searchroom Participation Agreement when an approved agency or organization uses Searchroom to process customer-controlled personal data. Searchroom is Shy Alter, operating Searchroom ("Searchroom").

Subject matter: Searchroom hosts and operates real-estate collaboration workspaces, including projects, invitations, members, property records, messages, feedback, viewing records, offers, closing tasks, document requests, uploaded document metadata, and uploaded files.

Duration: processing continues while the workspace is active and for the retention periods needed for service operation, deletion/export review, legal claims, security, fraud prevention, compliance, backup expiry, and documented legal holds.

Nature and purpose: Searchroom processes personal data to provide, secure, support, troubleshoot, retain, export, delete, and improve project collaboration workflows under the customer's documented instructions and the Terms.

Data subjects include agency representatives, agents, clients, invitees, project members, counterparties, viewing attendees, applicants, owners, landlords, tenants, buyers, sellers, and people whose information appears in project records or uploaded documents.

Data categories include account data, OAuth identifiers, project data, preferences, listings, source URLs, messages, feedback, viewing records, offer and closing records, document request metadata, uploaded file metadata, uploaded files, support requests, safety reports, privacy requests, and operational/security records. Personal documents may include identity or financial records.

The customer is controller for customer-controlled project data. Searchroom is processor or service provider for that data and controller for its own account, security, support, legal, safety, and service-operation data.

Searchroom processes customer-controlled personal data only to provide the service, follow documented customer instructions, comply with law, protect security, and enforce the Terms. Personnel and contractors with access to customer-controlled personal data must be subject to confidentiality obligations.

Security measures include project membership controls, document visibility controls, hashed invitation tokens, minimized event copy, authenticated privacy-request handling, operator-reviewed deletion/export workflows, and provider security measures for Convex-hosted database and file storage.

Searchroom stores and processes Searchroom application data and uploaded files in EU West, Ireland. Expo/EAS and app stores are limited to build, review, and distribution operations and receive no customer project content or personal documents. Google or Apple OAuth, when configured and selected by a user, process the limited identifiers and authentication events required for sign-in. Approved Searchroom domain mail routing processes minimized support, privacy, legal, deletion, and safety correspondence.

Active providers are Convex for the EU West application database and file storage; Google OAuth and Apple OAuth when selected for authentication; Expo/EAS, Apple App Store, and Google Play solely for build, review, and distribution; browser-store services where applicable; and approved Searchroom domain mail routing. Paddle and Documenso are dormant for the current release and receive no current user data. Future payment or signature processing is prohibited until separately approved.

For customer-controlled personal data, the agency gives Searchroom general written authorization to use Convex, solely for the EU West application database and file storage described in this DPA. Google and Apple OAuth are direct authentication providers when selected by a user, not customer-project-data subprocessors. Expo/EAS, app stores, browser stores, and dormant providers are not authorized to receive customer-controlled project data or real pilot documents.

Before appointing or replacing a subprocessor that will process customer-controlled personal data, Searchroom will give the agency prior written notice and a reasonable opportunity to object on data-protection grounds. Searchroom will bind each authorized subprocessor by written contract to data-protection obligations no less protective than those in this DPA and remains responsible for that subprocessor's performance of those obligations. If an objection cannot reasonably be resolved, Searchroom may suspend the affected processing and the agency may stop using the affected functionality or end access for that workspace.

Searchroom will provide reasonable assistance for data-subject requests, security obligations, breach assessment, data protection impact assessments, deletion/export, and audits, taking into account the nature of processing, available information, confidentiality, security, and the rights of other users in multi-party project records.

Searchroom will notify affected customers of confirmed personal-data breaches without undue delay after becoming aware, taking into account the information available to Searchroom and legal restrictions.

On termination, offboarding, or approved deletion request, Searchroom will delete, return, export, or retain personal data according to documented customer instructions, the Terms, the Privacy Notice, retention baseline, backup lifecycle, and legal obligations.

Separate explicit acceptance of this DPA and the Participation Agreement makes the standard contract effective for the private cohort. Invitation-code use, account registration, sign-in, or workspace access alone is not acceptance. The standard flow does not claim a qualified electronic signature or manual countersignature.

If this DPA conflicts with the Terms or Participation Agreement on the processing of customer-controlled personal data, this DPA controls for that processing.