Data processing terms

Who is responsible for what

Your company is accountable for the personal information. You decide what to collect, who to approve, how long to keep it and who on your team can see it. Canadian privacy law puts that responsibility on you and it cannot be signed away, not to us, not to anyone.

Kaza processes it on your instructions. We hold and move that information so the software can do the job you bought it for, and for nothing else.

What we process

• People who enquire: name, email, phone, and what they asked about.
• People who apply: household, employment and income, rental history and references, and any document they upload, commonly a pay stub or a piece of ID.
• People who rent from you: their lease, rent ledger and payments, deposits, repair requests, and notes your staff write.
• Your staff: name, email, role, and an audit record of consequential actions they take.

What we will not do with it

• We do not sell it, rent it, or share it between companies on the platform.
• We do not use it to train any model, ours or anyone else’s.
• We do not use it to market to your applicants or residents.
• We do not use it for our own purposes at all, beyond running, securing and repairing the service for you.

Who can reach it

Your staff, limited by their role. A contractor sent to fix something sees the address, a first name and a phone number, never income, an application, or any other tenancy.

Kaza’s operators can reach a company’s data to run and repair the service. Any time that happens it is under the same audit log your own staff are subject to, and that log cannot be edited after the fact.

The third parties that receive data are named individually, with what each one sees, on the sub-processors page. We tell you before that list changes, not after.

How it is protected

Each company gets its own database rather than a row in a shared table, so one company’s data is not somewhere another company’s query could reach. Uploaded documents are stored privately and are not reachable by a public link. Access is by role, and consequential actions are written to an append-only audit log.

The full description is on the security page.

Where it is held, and comparable protection

Data is held on Cloudflare’s infrastructure, each company in its own database rather than a shared one. Some processing happens outside Canada: the sub-processors page names every service and where it sits. If that is unacceptable for your organisation, tell us before you sign up rather than after.

Canadian privacy law requires you to use contractual means to ensure a comparable level of protection while a third party processes information on your behalf. The measures on the security page are the ones we commit to here, and we will tell you if they materially change for the worse.

If there is a breach

We will tell you without undue delay, and we aim to do it within 72 hours of confirming a breach that affects your company, with what happened, what information was involved, and what we have done.

That speed matters for a specific reason: under PIPEDA the obligation to report a breach to the Privacy Commissioner and to notify affected people is yours, not ours, because the information is under your control. We cannot make that report for you, so our job is to get you what you need fast enough to make it. The detail is on the breach page.

When someone asks you for their information

An applicant or resident can ask your company for a copy of what you hold, or ask you to correct or erase it. Answering is your call. It is your relationship and your legal duty. Kaza gives you the tools to find it, export it and delete it, and we will help if a request is awkward.

If someone contacts us directly about data that belongs to your company, we do not answer for you. We point them to you and tell you they asked.

Getting your data out, and what happens when you leave

You can take a complete copy of your company’s database at any time, as ordinary SQLite that opens without us. “You own your data” is a file we hand you, not a sentence in a policy.

If you stop using Kaza, take that copy first. After an account closes we delete the company’s database, and backups age out on their own cycle rather than being kept indefinitely.

What this is not

These are honest commitments about how the software behaves, written to be read. They are not legal advice, and for a large portfolio or an unusual arrangement they are worth your own lawyer’s eye. If your counsel needs something specific in writing, ask us at info@3d3d.ca: a real answer is more use to both of us than a document nobody has read.