Last updated: 8 October 2026
Agent Terms
Data processing terms
These terms apply between Featherton Ltd ("Processor", "we", CRO 586259) and the managing agent that uses blox (the "Agent"), and form part of the Terms of Service. They set out how we process personal data on the Agent's behalf, as Article 28 of the GDPR requires.
1. Subject matter and duration
We process personal data to provide blox to the Agent, for as long as the Agent uses blox and up to 30 days afterwards.
2. Roles
The Agent is the controller of the personal data it enters, or the processor of the owners' management company ("OMC") that is the controller. The Agent confirms it has authority from each OMC to engage us as a processor (or sub-processor) and to accept these terms for it. We process only on the Agent's behalf. For data about the Agent's own staff, billing and website use, we are a controller; see our Privacy Policy.
3. Data and people covered
| Item | Detail |
|---|---|
| People | Owners, directors, tenants and occupiers, supplier contacts, and the Agent's own staff |
| Data | Names, email addresses, phone numbers, postal addresses, unit and ownership details, balances and payment history, bank account details and bank transactions of the OMC's accounts (where the Agent connects a bank feed), communication records and the messages the Agent sends, tasks and notes, supplier bank details, uploaded documents |
| Special category data | Not intended. The Agent must not enter it unless necessary and lawful |
| Purpose | Providing blox: records, accounts, invoicing, bank feeds and matching, supplier payments, documents, tasks, communications, owner access and AI-assisted features |
| Duration | Term plus up to 30 days |
4. Instructions
We act only on the Agent's documented instructions (these terms and the Agent's use of blox), unless the law requires otherwise, and will tell the Agent if we believe an instruction breaches data protection law. The Agent is responsible for the lawfulness of the data it enters, for its accuracy, and for informing the people concerned. When the Agent uses an AI-assisted feature or connects a bank feed, that is an instruction to send the relevant data to the AI provider or to Enable Banking and the bank for that purpose.
5. Confidentiality
Everyone with access to the data is bound by confidentiality.
6. Security
We apply appropriate measures, including: sign-in by text-message code with optional authenticator-app two-factor sign-in; encryption in transit; database rules separating each agency and restricting each role; Admin and Staff roles; audit logging; limits on repeated sign-in attempts; private file storage with short-lived access links; bank connections made only through the bank's own consent flow; and logged support access.
7. Sub-processors
The Agent gives general authorisation for the sub-processors listed in section 14 of our Privacy Policy. We give 30 days' notice of changes. The Agent may object on reasonable data protection grounds within that time; if it cannot be resolved, either party may end the agreement. We impose equivalent terms on sub-processors and remain responsible for them.
8. Transfers outside the EEA
Only with a lawful safeguard (an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses), which are incorporated where needed.
9. Helping the Agent
We will, as far as reasonably possible, help the Agent answer requests from individuals, and with security, breach notification and impact assessments. If we receive a request directly from an individual, we pass it to the Agent without answering it.
On request, we also help the Agent move blocks, units, owners and opening balances into blox from its current software or spreadsheets, at no extra charge. We process that data only to load it into the Agent's account.
10. Breaches
We tell the Agent without undue delay after becoming aware of a personal data breach, aiming within 48 hours, with the information we have.
11. Return and deletion
On request within 30 days after the agreement ends, we provide a copy in a commonly used format, then delete the data, including from backups on their normal cycle, unless the law requires us to keep some. The Agent is responsible for keeping any records the law requires it or the OMC to keep, including the OMC's accounting records.
12. Evidence and audits
We provide the information needed to show compliance. Audits are limited to once a year, on reasonable notice, preferably satisfied by independent reports, at the Agent's cost.
13. Liability
Liability under these terms is subject to the limits in the Terms of Service.
14. Precedence and law
If these terms conflict with the Terms of Service on data protection, these terms prevail. Irish law governs, and the Irish courts have jurisdiction.
Questions: data@blox.ie.