Data Processing Agreement (DPA)

Parties and roles

The client (landlord or letting administrator) is the controller: they decide which tenant data is processed and why.

The AxiRent operator is the processor: data is processed only under this agreement and the client's documented instructions, expressed through the use of the system itself.

Subject matter, duration and nature

Subject matter - administration of tenancies: properties, tenancy records, meter readings, invoices, reminders, issue tracking, documents.

Duration - for as long as the client uses the service. On termination, data is deleted or returned as set out under Termination below.

Data subjects - the client's tenants and the client's account users. Categories - contact details, tenancy terms, accounting records, files the client uploads. Special categories of data are not processed and must not be uploaded.

Processor obligations

Process data only on the client's instructions and only to run the service - never for our own purposes, advertising or sale.

Ensure persons with access are bound by confidentiality.

Apply technical and organisational measures: role- and organisation-scoped access control, two-factor authentication, encrypted transport (TLS), hashed passwords, an audit log, breached-password checks.

Assist the client with data-subject requests (access, rectification, erasure, portability) - the system ships export and deletion tools.

Notify the client of a personal-data breach without undue delay and no later than 48 hours after becoming aware of it, stating what happened, which data is affected and what has been done.

Sub-processors

The client consents to these sub-processors: Supabase (database and files, EU region), Cloudflare (R2 file storage), Vercel (application infrastructure and cookieless traffic statistics), Stripe (payment processing - card data never reaches AxiRent), Google (Gemini API - only the content needed for a specific AI action is sent), Groq and OpenAI (speech-to-text for voice and video; OpenAI is also the help assistant's fallback model), Slack (when a user asks for a person from support, their conversation with the assistant is passed on), our email delivery provider (invoices, reminders, invitations).

Services the client connects with its own account and under its own agreement (for example Stripe Connect, Paysera, Dokobit, Rivile, B1, Shelly, TTLock) are not AxiRent's sub-processors: they are providers the client chose, to whom data is passed only on the client's instruction and only as far as the feature it turned on requires.

When a sub-processor changes, this list is updated in advance; continued use constitutes consent, and a client who objects may stop using the service and take their data.

Data location

The database is stored in the European Union. Where a sub-processor processes data outside the EU (for example speech-to-text), the European Commission's Standard Contractual Clauses apply.

Termination

On leaving, the client can export all data (XLSX) themselves. On request, or within 90 days of account closure, data is deleted - except what accounting and tax law requires us to keep.

Audit

On request, the operator provides information demonstrating compliance with this agreement. This document and the privacy policy are updated together with the system - the date above shows the last review.