Data Processing Agreement
Effective date: 1 January 2025· Aligned with the NZ Privacy Act 2020 & GDPR
1. Introduction
This Data Processing Agreement ("DPA") forms part of the contractual relationship between PS Nexa Homes("we", "us", "our") and you ("Client", "Data Subject") when you use our website, services, or engage us to manage property on your behalf.
We are committed to protecting personal information in accordance with the New Zealand Privacy Act 2020, the EU General Data Protection Regulation (GDPR) where applicable, and the New Zealand Information Privacy Principles (IPPs).
2. Data Controller
PS Nexa Homes acts as the Data Controller for personal data collected through this website and our property management services.
3. Personal Data We Process
We collect and process the following categories of personal data:
| Category | Examples | Legal Basis |
|---|---|---|
| Identity Data | Full name, date of birth | Contract / Legitimate interest |
| Contact Data | Email address, phone number, postal address | Contract / Consent |
| Financial Data | Bank account details for rent payments, payment history | Contract / Legal obligation |
| Property Data | Property address, tenancy details, maintenance history | Contract |
| Technical Data | IP address, browser type, cookies, session data | Legitimate interest / Consent |
| Usage Data | Pages visited, search queries, enquiry history | Legitimate interest / Consent |
| Communications | Emails, messages, enquiry forms | Contract / Legitimate interest |
4. Legal Basis for Processing
We process your personal data under one or more of the following lawful bases:
- Contract (IPP 1 / GDPR Art. 6(1)(b)): Processing necessary to perform a property management agreement or tenancy agreement with you.
- Legal Obligation (IPP 1 / GDPR Art. 6(1)(c)): Compliance with the Residential Tenancies Act 1986, Healthy Homes Standards, AML/CFT Act 2009, and Tax Administration Act.
- Legitimate Interest (IPP 1 / GDPR Art. 6(1)(f)): Fraud prevention, security, service improvement, and business analytics.
- Consent (IPP 2 / GDPR Art. 6(1)(a)): Marketing communications, non-essential cookies, and analytics. You may withdraw consent at any time.
5. Purpose of Processing
We process personal data for the following purposes:
- Managing rental and sale property listings on your behalf
- Tenant screening, tenancy management, and rent collection
- Property inspections and maintenance coordination
- Healthy Homes compliance reporting
- Responding to enquiries and appraisal requests
- Sending service updates and relevant communications
- Legal compliance and dispute resolution
- Website analytics and improvement (with consent)
6. Data Sharing and Third Parties
We do not sell personal data. We share data only where necessary with trusted third parties acting as data processors on our behalf, under contractual data protection obligations:
| Recipient | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database hosting and storage | USA (SCCs applied) |
| Vercel Inc. | Website hosting and delivery | USA (SCCs applied) |
| Email service provider | Transactional email delivery | USA/EU |
| Accounting software | Rent processing and financial records | NZ / Australia |
| MBIE / Tenancy Tribunal | Legal obligations under RTA 1986 | New Zealand |
| Credit check agencies | Tenant vetting (with tenant consent) | New Zealand |
Where data is transferred outside New Zealand, we ensure adequate safeguards are in place (Standard Contractual Clauses, adequacy decisions, or equivalent protections).
7. Cookies and Tracking
Our website uses the following cookie categories:
| Category | Examples | Legal Basis |
|---|---|---|
| Strictly Necessary | Session tokens, CSRF protection, auth state | No consent required |
| Analytics | Page view tracking, error monitoring | Consent required |
| Marketing | Ad retargeting, conversion tracking | Consent required |
You can manage or withdraw cookie consent at any time via the cookie preference banner. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal.
8. Data Retention
We retain personal data only as long as necessary for the purpose collected:
| Data Type | Retention Period | Reason |
|---|---|---|
| Tenancy records | 7 years from end of tenancy | RTA 1986 / IRD requirements |
| Financial records | 7 years | Tax Administration Act |
| Enquiry / contact forms | 3 years | Legitimate interest |
| Website analytics | 26 months | Industry standard |
| Marketing consent records | Until withdrawn + 3 years | Legal compliance |
| CCTV / property inspection photos | 90 days | Security / dispute |
9. Your Rights
Under the NZ Privacy Act 2020 and GDPR you have the following rights. To exercise any right, contact us at privacy@psnexahomes.co.nz. We will respond within 20 working days.
Right of access
Request a copy of the personal data we hold about you.
Right to correction
Ask us to correct inaccurate or incomplete data.
Right to erasure
Request deletion of data no longer needed (subject to legal retention).
Right to restriction
Ask us to restrict processing in specific circumstances.
Right to object
Object to processing based on legitimate interests or direct marketing.
Right to portability
Receive your data in a structured, machine-readable format.
Right to withdraw consent
Withdraw consent for analytics/marketing at any time.
Right to complain
Lodge a complaint with the NZ Privacy Commissioner (privacy.org.nz) or your local DPA.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including:
- TLS encryption in transit for all web traffic
- Encrypted database storage via Supabase (AES-256)
- Role-based access controls — staff access only what their role requires
- Multi-factor authentication for admin systems
- Regular security reviews and dependency updates
- HSTS, CSP, and other HTTP security headers on all web responses
In the event of a data breach that poses a risk of harm, we will notify affected individuals and the Office of the Privacy Commissioner within the timeframe required by the Privacy Act 2020 (as soon as practicable).
11. Children's Data
Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us immediately at privacy@psnexahomes.co.nz.
12. Automated Decision-Making
We do not make decisions about you solely based on automated processing that produce legal or similarly significant effects. Any AI-assisted tools (e.g. property match scoring) are advisory only and are reviewed by a human before any action is taken.
13. Changes to This Agreement
We may update this DPA from time to time. Material changes will be communicated via email or a prominent notice on our website before taking effect. The effective date at the top of this page indicates when the current version was last revised.