Vendor Compliance & Data Protection
Last updated: November 2026
Third-Party Service Providers
Blue Horizon Residency uses carefully selected third-party vendors to deliver our services. All vendors are contractually bound by Data Processing Agreements (DPAs) to ensure compliance with GDPR, UK Data Protection Act 2018, and other applicable data protection regulations.
Approved Vendors & DPA Status
Resend
Email delivery and transactional notifications
DPA Status: ✓ Data Processing Agreement in place
Data Processed: Email address, name, contact information
Purpose: Sending transactional emails, booking confirmations, construction updates
GDPR Compliance: Resend is GDPR-compliant and certified
Retention: Data retained per Resend's privacy policy (typically 90 days for logs)
Base44
Application hosting and backend services
DPA Status: ✓ Data Processing Agreement in place
Data Processed: All user-submitted data including bookings, inquiries, lease agreements
Purpose: Secure storage, processing, and delivery of application data
GDPR Compliance: Base44 is GDPR-compliant with SOC 2 certification
Sub-processors: Base44 uses AWS for infrastructure (also GDPR-compliant)
Google Maps
Location mapping and property visualization
DPA Status: ✓ Google Data Processing Amendment (DPA) available
Data Processed: IP address, anonymized usage analytics
Purpose: Displaying property location and map services
GDPR Compliance: Google Maps API is GDPR-compliant
Tracking: Standard Google Analytics consent applies
Stripe (Future Implementation)
Payment processing (not currently enabled)
DPA Status: ✓ Stripe DPA available upon request
Data Processed: Payment card information (tokenized, not stored by us)
PCI-DSS Compliance: Stripe is PCI-DSS Level 1 certified
Implementation Note: When payment processing is enabled, explicit DPA review will be conducted
Data Security & Retention
- Encryption: All data in transit is encrypted using TLS 1.2+
- At Rest: Sensitive data (bookings, leases, inquiries) is encrypted at rest
- Access Control: Only authorized Blue Horizon staff can access customer data
- Retention Period: Data is retained for the duration of the business relationship + 7 years for legal compliance
- Deletion: Upon request, personal data is deleted within 30 days (legal holds excepted)
Sub-Processors & Data Transfers
We may use sub-processors (e.g., AWS for Base44, Google services) to deliver our services. All sub-processors are GDPR-compliant and listed in our Data Processing Agreement. For EU data subjects, Standard Contractual Clauses (SCCs) are in place for international data transfers.
Your Rights & Requests
As a data subject, you have the right to:
- Request access to your personal data
- Request correction or deletion of your data
- Object to processing or withdraw consent
- Request data portability
- Lodge a complaint with your data protection authority
Submit requests to inquiries@bluehorizonmasaki.com. We will respond within 30 days (or as required by law).
DPA Documentation
Full copies of Data Processing Agreements with our vendors are available upon request for organizations with a legitimate business need. Please contact our Data Protection Officer at inquiries@bluehorizonmasaki.com with "DPA Request" in the subject line.
Questions or Concerns?
If you have questions about our vendors, data processing, or compliance, please contact us:
Blue Horizon Residency
Email: inquiries@bluehorizonmasaki.com
Subject: "Data Protection & Vendor Compliance"
