Data Processing Agreement
The standard terms, published before you ask
This page publishes the terms under which Domaveri processes personal data on behalf of client institutions, so your DPO can review before procurement begins. The signed execution version, including SCCs where applicable, is supplied with the vendor file.
Last updated 2 September 2026
1. Parties and roles
This Data Processing Agreement is entered into between the client institution ("Controller") and Albert D Matalon, LLC, trading as Domaveri ("Processor"), and forms part of the Services Agreement.
2. Subject matter and duration
Processing of personal data as necessary to provide occupancy and asset verification services for assets designated by the Controller, for the term of the Services Agreement plus the agreed retention period.
3. Nature and purpose of processing
Compilation, analysis and delivery of evidence relating to the occupancy status of premises: aerial and satellite imagery, street-level photographs of building exteriors, and consumption or activity signals where lawfully available; production of verification certificates and portfolio reports.
4. Categories of data subjects and data
- Data subjects
- Individuals associated with assets in the Controller’s portfolio (e.g. borrowers, occupants), and incidentally captured members of the public.
- Personal data
- Asset addresses and identifiers linkable to individuals; exterior imagery of premises. Faces and vehicle plates are irreversibly blurred at ingestion. No special categories of data are sought or used.
5. Processor obligations
The Processor shall process personal data only on documented instructions from the Controller; ensure persons authorized to process data are bound by confidentiality; implement appropriate technical and organizational measures under Article 32 GDPR (TLS 1.2+ in transit, AES-256 at rest, role-based access, MFA, logging); assist the Controller with data subject rights requests and Articles 32–36 obligations; notify the Controller without undue delay, and in any event within 72 hours, of a personal data breach; delete or return all personal data on termination per the exit plan; and make available information necessary to demonstrate compliance, including allowing and contributing to audits by the Controller or its competent authority.
6. Sub-processors
The Controller grants general written authorization to engage the sub-processors listed on our sub-processor register. The Processor will give at least 30 days’ notice of intended changes, during which the Controller may object on reasonable grounds.
7. International transfers
Client portfolio data and evidence packs are processed and stored in the EU by default. Any transfer outside the EEA relies on Standard Contractual Clauses (Module 2: Controller to Processor) with supplementary measures as appropriate; transfer impact assessments are available on request.
8. Audit and regulator access
The Processor grants the Controller and its competent supervisory authorities the rights of access, audit and information required under GDPR and, where applicable, DORA-aligned outsourcing provisions.