Data Processing Addendum
Version 19.08.2026. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the Customer and IziRento (pre-launch software project) concerning the use of IziRento.
This DPA applies only where we process Customer Personal Data on behalf of a Customer. It does not apply to Account Data for which we act as an independent controller. If there is a conflict about Customer Personal Data, this DPA prevails over the Terms.
1. Parties and roles
1.1. The Customer is the Controller or Business; IziRento (pre-launch software project) is the Processor or Service Provider for Customer Personal Data. A property owner remains responsible for the processing performed by managers, staff and Tenant Users acting through the Customer account.
1.2. If the Customer processes personal data on behalf of another controller, the Customer warrants that it is authorised to appoint us as a sub-processor and to give the instructions in this DPA.
1.3. Terms such as Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach, Business, Consumer, Service Provider, Sell and Share have the meanings given by Applicable Data Protection Law.
2. Applicable Data Protection Law
“Applicable Data Protection Law” means privacy and data-protection law that applies to the relevant processing, including, where applicable, the EU GDPR, UK GDPR and Data Protection Act 2018, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and applicable US state privacy laws.
3. Processing details
- Subject matter: providing a hosted rental-management platform and Customer-selected features.
- Duration: the term of the Customer account, followed by the deletion and backup periods described in this DPA and the Privacy Notice.
- Nature and purpose: collection from the Customer, hosting, organisation, retrieval, display, transmission to authorised users, support, backup, security, and optional OCR/AI processing initiated by the Customer.
- Data subjects: current and former tenants, prospective tenants, household members, guarantors, emergency contacts, owners, managers, contractors, service providers and other persons whose data the Customer chooses to submit.
- Data types: names, contact details, addresses, lease and occupancy information, rent and payment records, deposits, utility bills and meter readings, inspection and maintenance records, communications, documents, images, video, device/access records, and any other data submitted by the Customer.
- Special data: the Service is not designed for unrestricted processing of special-category, biometric, precise health, criminal-conviction or children's data. Customer must not submit it unless strictly necessary, lawful and expressly permitted by the Service.
4. Customer instructions
4.1. We will process Customer Personal Data only on documented instructions from the Customer, including the Terms, this DPA, the Customer's configuration and use of Service features, support requests, and other written instructions accepted by us.
4.2. We may process Customer Personal Data where required by applicable law. Unless legally prohibited, we will inform the Customer before that processing.
4.3. If we reasonably believe an instruction infringes Applicable Data Protection Law, we may notify the Customer and suspend the affected processing until the instruction is confirmed, modified or withdrawn. Customer remains responsible for the lawfulness of its instructions.
5. Customer obligations
- Determine and document a lawful basis for every category and purpose of Customer Personal Data.
- Give all notices required to tenants, applicants and other Data Subjects before placing their data in the Service.
- Collect only data that is adequate, relevant and necessary; keep it accurate; define and enforce retention periods.
- Configure roles and invitations using least privilege and promptly revoke access that is no longer needed.
- Respond to Data Subject requests and regulatory enquiries as Controller.
- Obtain any consent or authorisation required for communications, monitoring, recordings, documents, cloud imports and optional AI/OCR processing.
- Not instruct us to violate law or process prohibited content.
- Maintain appropriate endpoint, credential and organisational security outside the Service.
6. Confidentiality and personnel
We will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and receive access only where needed for their duties. We will provide appropriate privacy and security guidance to such persons.
7. Security measures
7.1. Taking into account the state of the art, implementation costs, the nature and risks of processing, we will maintain appropriate technical and organisational measures designed to protect Customer Personal Data.
7.2. Measures may include access controls, role separation, authentication, encryption in transit, network and tenant isolation, security logging, backups, vulnerability and dependency management, incident response, malware scanning where enabled, and restricted production access.
7.3. No system is risk-free. This clause is an obligation to maintain appropriate measures, not a warranty that a breach can never occur.
8. Sub-processors
8.1. Customer grants general written authorisation for the sub-processors listed on the Sub-processors page at https://izirento.com/subprocessors.
8.2. We will impose data-protection obligations on a sub-processor that are no less protective in substance than those applicable to us under this DPA, to the extent relevant to its services. We remain responsible for the sub-processor's performance of those obligations as required by law.
8.3. We will provide reasonable advance notice of a new sub-processor that will process Customer Personal Data. Customer may object on reasonable data-protection grounds within the stated notice period. If the parties cannot resolve a legitimate objection, Customer may discontinue the affected feature or terminate the Service before the new sub-processor begins processing; this is Customer's sole contractual remedy for the objection.
8.4. A third-party account or connector independently selected and authorised by Customer may be Customer's own processor rather than our sub-processor. Customer is responsible for evaluating and contracting with that provider unless our Sub-processors page states otherwise.
9. International transfers
9.1. Customer authorises processing in the countries identified on the Sub-processors page, subject to lawful transfer safeguards.
9.2. For a restricted transfer of Customer Personal Data from the EEA to a country without an adequacy decision, the 2021 EU Standard Contractual Clauses are incorporated by reference: Module Two (Controller to Processor), or Module Three where Customer is a Processor; the docking clause applies; optional Clause 7 applies; the competent supervisory authority and governing law are determined by the exporter's establishment where legally permitted.
9.3. For restricted transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs is incorporated by reference. The parties will provide information reasonably required to complete the applicable transfer schedules.
9.4. The parties will cooperate on transfer impact assessments and supplementary measures where legally required.
10. Data Subject requests
10.1. Customer is responsible for responding to requests concerning Customer Personal Data. If we receive such a request directly, we will, where legally permitted, direct the requester to Customer and notify Customer.
10.2. Taking into account the nature of processing, we will provide commercially reasonable assistance through Service functionality or support so Customer can fulfil applicable obligations. We may charge reasonable fees for exceptional assistance beyond standard functionality where permitted by law.
11. Personal Data Breach
11.1. We will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.
11.2. As information becomes available, notice will describe the nature of the incident, affected data and Data Subjects where known, likely consequences, measures taken or proposed, and a contact point.
11.3. Our notification is not an admission of fault or liability. Customer remains responsible for determining whether and how to notify authorities and Data Subjects, and we will provide reasonable cooperation.
12. DPIAs and regulatory consultation
Taking into account the nature of processing and information available to us, we will provide reasonable assistance with data-protection impact assessments and prior consultation required for Customer's use of the Service. Customer remains responsible for deciding whether an assessment or consultation is required.
13. Return and deletion
13.1. During the account term, Customer should use available export and deletion functionality and maintain any independent backup it requires.
13.2. Following termination and on Customer's request, we will delete or return Customer Personal Data in accordance with the Terms, unless law requires retention. Data may remain in encrypted or access-restricted backups until overwritten under normal backup cycles and will not be restored except for disaster recovery.
13.3. Customer acknowledges that deletion may be irreversible. Customer is responsible for exporting data before account closure.
14. Information and audits
14.1. We will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR-equivalent processor obligations.
14.2. Customer must first use current security documentation, questionnaires and independent reports we make available. If that is insufficient and law requires an audit, Customer may request one no more than once annually, with reasonable notice, during business hours, under confidentiality, without accessing other customers' data or disrupting operations.
14.3. Customer bears its audit costs and our reasonable costs for non-routine assistance, unless the audit identifies a material breach by us.
15. US service-provider commitments
To the extent US state privacy law applies to Customer Personal Data, we act as a Service Provider/Processor. We will not Sell or Share Customer Personal Data, retain/use/disclose it outside the direct business relationship or specified purposes, or combine it with personal data received from another source except as legally permitted to provide the Service, maintain security, prevent fraud or comply with law. We will notify Customer if we determine we can no longer meet these obligations and permit reasonable steps to stop and remediate unauthorised use.
16. Liability and precedence
The liability limitations and exclusions in the Terms apply to this DPA to the maximum extent permitted by law. Nothing in this DPA limits liability that cannot lawfully be limited, or changes either party's statutory allocation of responsibility to Data Subjects or regulators.
17. Term and contact
This DPA begins when Customer accepts the Terms or first submits Customer Personal Data and continues until we no longer process Customer Personal Data. Privacy and DPA enquiries: [email protected].