Data processing agreement

1Parties

• Controller: the Customer that subscribes to the Renterus Platform, identified in its company account (the “Controller”).
• Processor: RENTERUS SOFTWARE S.L., Tax ID B72826324, Calle Bellavista 4, Edif. Capri, Local 2, 29780 Nerja (Málaga), Spain (the “Processor” or “Renterus”).

2Subject matter

The Controller engages Renterus to process the personal data needed to provide it with the Renterus software service (the “Platform”), under the Terms of use and contracting and the subscribed Plan.

This agreement does not apply to the data that Renterus processes as controller (user accounts, the contractual relationship with the Customer, Platform security), which is covered by the Privacy policy.

3Duration

This agreement remains in force for as long as the Terms of use and contracting between the parties do. The obligations of confidentiality, of returning and deleting the data, and those which by their nature must survive will remain in force after it ends.

4Nature and purpose of the processing

Purpose: to provide the Controller with the Platform features it chooses to use, such as staff management and working-time records; electronic signature of documents; management of properties, owners, bookings, guests and traveller registration; identity verification; the Erus artificial intelligence assistant; invoicing; transfers; key management; internal and third-party communication; and the integrations with third-party services that the Controller activates.

Processing operations: collection, recording, organisation, structuring, storage, adaptation, consultation, use, disclosure by transmission to the recipients the Controller indicates or configures, alignment, restriction, erasure and destruction, by automated means.

5Types of data and categories of data subjects

Depending on the features the Controller uses, the processing may concern:

Special categories of data. If the Controller activates guest identity verification with facial comparison, biometric data intended to uniquely identify a person is processed (Art. 9 GDPR). It is for the Controller to have an exception under Article 9(2) GDPR that allows it (normally, the data subject’s explicit consent) and to assess whether a data protection impact assessment is needed. In addition, absences may include sick leave and medical appointments with their supporting documents, and employment documents may contain health data. The Controller will not enter other special categories of data unless they are essential and lawful.

6Obligations of the Controller

• Ensure that the processing has a valid legal basis and, where applicable, an exception under Article 9(2) GDPR, and that the data has been obtained lawfully.
• Inform data subjects in accordance with Articles 13 and 14 GDPR, including, for employees, prior information on working-time records and geolocation (Art. 90 LOPDGDD).
• Give Renterus lawful, documented instructions and configure the Platform accordingly.
• Carry out any impact assessments and prior consultations that are required.
• Supervise the processing, including through the audits provided for in this agreement.

7The Controller’s instructions

Renterus will process personal data only on the Controller’s documented instructions. The following are documented instructions: (i) this agreement and the Terms of use and contracting; (ii) the configuration and use of the Platform by the Controller and its authorised Users; and (iii) any additional written instructions that the Controller gives and Renterus accepts. These include the instruction to produce aggregated, anonymised statistics on the use of the Platform, as set out in the Terms.

If Renterus considers that an instruction infringes the GDPR or other data protection law, it will inform the Controller immediately. If Union or Member State law requires Renterus to process the data for another purpose, it will inform the Controller before the processing, unless that law prohibits this on important grounds of public interest.

Renterus will not use the data for its own purposes or disclose it to third parties, except to authorised sub-processors or when the Controller so instructs.

8Confidentiality

Renterus ensures that the people authorised to process the data have committed in writing to keep it confidential or are under a statutory obligation of confidentiality, which continues after their relationship with Renterus ends. They will access the data only to the extent necessary to provide the service, give support when the Controller requests it or resolve incidents.

9Security measures

Taking into account the state of the art, the costs, the nature, scope, context and purposes of the processing, and the risks to the rights of data subjects, Renterus applies the appropriate technical and organisational measures required by Article 32 GDPR, including:

• encryption of communications between users and the Platform (TLS);
• passwords stored using hashing algorithms, and secure session management;
• role-based access control with permissions configurable by the Controller, and logical separation of each customer’s data;
• activity logging of relevant actions;
• an information security management system certified to UNE-EN ISO/IEC 27001:2023;
• a database replicated across a three-node cluster, daily backups and restore procedures;
• updating and maintenance of systems and software dependencies;
• confidentiality commitments and training for staff with access to data;
• a procedure for managing and reporting security incidents;
• regular review of the effectiveness of the measures.

Renterus may update these measures provided that the overall level of security is not reduced.

10Sub-processors

The Controller grants Renterus a general authorisation to engage other processors (sub-processors). The current list of sub-processors is published in the Privacy policy.

Renterus will inform the Controller of any addition or replacement of sub-processors at least 15 days in advance, by email or through a notice on the Platform, so that it can object on reasonable grounds relating to data protection. If the parties cannot reach a solution, the Controller may terminate the contract without penalty in respect of the affected service.

Renterus will impose on each sub-processor, by contract, the same data protection obligations as in this agreement, in particular the obligation to provide sufficient guarantees of implementing appropriate technical and organisational measures. Renterus remains fully liable to the Controller for the sub-processors’ compliance.

Third-party services that the Controller decides to integrate (for example, booking channels) are not sub-processors of Renterus: data is disclosed to them on the Controller’s instructions. The channel manager that Renterus integrates into the Platform is a sub-processor and appears on the list.

11International transfers

Renterus will only transfer personal data outside the European Economic Area, directly or through sub-processors, where there is an adequacy decision (including the EU-US Data Privacy Framework for certified entities) or appropriate safeguards have been adopted under Article 46 GDPR, such as the European Commission’s standard contractual clauses, with any supplementary measures that are needed.

12Assistance with data subject rights

Renterus will assist the Controller, through appropriate technical and organisational measures and insofar as possible, so that it can respond to requests to exercise the rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decision-making. The Platform allows the Controller to consult, correct, export and delete the data.

If a data subject sends a request to Renterus, Renterus will forward it to the Controller without delay and in any case within 5 working days, and will not answer it directly unless the Controller instructs it to.

13Assistance with security, impact assessments and consultations

Taking into account the nature of the processing and the information available to it, Renterus will help the Controller comply with the obligations in Articles 32 to 36 GDPR: security of processing, notification and communication of personal data breaches, data protection impact assessments and prior consultation with the supervisory authority.

14Notification of personal data breaches

Renterus will notify the Controller, without undue delay and in any case within 48 hours of becoming aware of it, of any security breach affecting the data processed on its behalf, together with the information available to document and report the incident:

• the nature of the breach, with the categories and approximate number of data subjects and records concerned;
• the contact details at Renterus for further information;
• the likely consequences;
• the measures taken or proposed to address it and mitigate its effects.

If it is not possible to provide all the information at once, it will be provided in phases. It is for the Controller to notify the supervisory authority and, where applicable, the data subjects.

15What happens to the data when the service ends

When the service ends, Renterus will keep the data available to the Controller in read-only mode so that it can consult and export it, and will return it in a structured, commonly used format if asked. It will then delete or anonymise it, together with any existing copies, within the period and in the manner set out in the Terms of use and contracting, or earlier if the Controller asks in writing.

Backups will be deleted in their ordinary rotation cycles. Renterus may keep the data duly blocked for as long as liabilities may arise from the performance of the service or where the law requires it. At the Controller’s request, Renterus will certify the deletion.

16Information and audits

Renterus will make available to the Controller the information needed to demonstrate compliance with this agreement and will allow for and contribute to audits, including inspections, conducted by the Controller or another auditor it authorises.

Audits must be requested with reasonable notice of at least 30 days, carried out during working hours without affecting the security or data of other customers, at most once a year (unless there has been a security breach or an authority requires it) and at the Controller’s expense. Renterus may first meet these requests with documentation, certifications (such as its UNE-EN ISO/IEC 27001 certificate) or independent audit reports.

17Other obligations of the Processor

• Keep a record of the categories of processing activities carried out on behalf of the Controller (Art. 30(2) GDPR).
• Appoint a data protection officer where required and communicate their identity to the Controller.
• Cooperate with the supervisory authority on request.

18Liability

Each party is liable for the damage it causes by breaching this agreement or data protection law, in accordance with Article 82 GDPR. To the extent permitted by law, the limitations of liability in the Terms of use and contracting apply. If Renterus processes the data for its own purposes or breaches this agreement, it will be considered a controller in respect of that processing.

19Precedence and governing law

With regard to the protection of personal data, this agreement prevails over any other provision of the Terms of use and contracting. It is governed by Spanish law and the GDPR, and disputes will be submitted to the courts indicated in those terms.