Data Processing Agreement

Last updated: 16 June 2026

This Data Processing Agreement ("DPA") applies where PropertyOS processes

personal data on your behalf — for example, when a landlord or agency

(the "Controller") uses PropertyOS to manage data about their tenants. It forms

part of the Terms of Service and reflects Article 28 of the

GDPR.

Note — not legal advice. A countersigned copy is available on request.

1. Roles

  • Controller — you (the landlord or agency) decide why and how tenant data

is processed.

  • Processor — PropertyOS, operated by Oleksii Veselovskyi (Belgium),

processes that data only on your documented instructions.

For account, billing and security data about *you*, PropertyOS acts as an

independent controller (see the Privacy Policy).

2. Scope and subject matter

We process tenant, landlord and property data that you enter into PropertyOS, for

the duration of your use of the service, solely to provide the features you use.

3. Our obligations as processor

We will:

  • process personal data only on your documented instructions;
  • ensure persons authorised to process data are bound by confidentiality;
  • implement appropriate technical and organisational security measures

(section 5);

  • assist you with data-subject requests and with your security, breach and DPIA

obligations, to the extent we are able;

  • notify you without undue delay after becoming aware of a personal-data breach;
  • delete or return personal data at the end of the service, subject to legal

retention; and

  • make available the information needed to demonstrate compliance, and allow for

audits as required by Article 28(3)(h).

4. Sub-processors

You authorise us to engage the sub-processors listed at

/legal/subprocessors. We impose equivalent data-protection

obligations on each, and will give notice of intended changes so you may object.

5. Security measures

Encryption in transit (TLS) and of uploaded files at rest; hashed passwords and

breached-password checks; optional two-factor authentication; role-, property-

and organisation-based access control; rate limiting; malware scanning of

uploads; audit logging; EU-based hosting; and a documented breach-response

procedure.

6. International transfers

Personal data is hosted in the EU. Any transfer outside the EEA by a

sub-processor relies on an adequacy decision or the Standard Contractual Clauses.

7. Breach notification

We notify you without undue delay (and in any case within 72 hours where

feasible) after becoming aware of a personal-data breach affecting your data,

with the information you need to meet your own GDPR Article 33/34 obligations.

8. Requesting a signed DPA

To receive a countersigned DPA, or for any processing question, email

[email protected].