Data Processing Terms

Annex to the Terms of Service Effective from: 8 October 2026

These terms are an agreement between the User as controller and SIA "Qhosting" (reg. No. 40103183497) as processor ("Opernt") under Article 28 of the General Data Protection Regulation (GDPR). They apply to personal data that Opernt processes on the User's behalf.

1. Subject matter and duration

Opernt processes personal data only as needed to provide the Service under the Terms of Service, for as long as the Service is used and until the data is deleted under section 9.

2. Nature and purpose of processing

Processing includes:

• storing and organising data;
• preparing charges and invoices;
• recognising and matching payments;
• sending notifications and reminders;
• storing documents;
• providing the tenant portal.

3. Data subjects

• Tenants, including former and prospective tenants.
• Tenants' contacts and guarantors.
• Payers who appear in the User's bank transactions.
• Other people whose data the User enters.

4. Categories of data

• Name and contact details.
• Personal code or date of birth, if the User enters it.
• Lease details, charges, payments, arrears and deposits.
• Bank account number and payment information.
• Documents and notes.
• Tenant portal usage data.

The User does not enter special categories of data unless necessary.

5. Opernt's obligations

Opernt: 1. processes data only on the User's documented instructions. These are the Terms of Service, these terms and the User's actions in the Service. The exception is where processing is required by law; 2. informs the User immediately if it considers that an instruction breaches data protection requirements; 3. ensures that people with access to the data are bound by confidentiality; 4. implements appropriate technical and organisational security measures (Article 32 GDPR), as described in section 11 of the Privacy Policy; 5. helps the User respond to data subject requests, as far as possible. If Opernt receives a request directly, it forwards it to the User; 6. helps the User meet its obligations under Articles 32–36 GDPR, taking into account the nature of the processing and the information available to Opernt; 7. informs the User without undue delay, and no later than 48 hours after becoming aware of it, of any personal data breach affecting the User's data. Opernt provides the information it has that the User needs to notify the supervisory authority; 8. provides, on request, the information needed to demonstrate compliance with these terms. Opernt allows reasonable audits agreed in advance in writing.

6. Sub-processors

• The User gives general authorisation to use the sub-processors listed in section 8 of the Privacy Policy.
• Opernt notifies the User at least 30 days in advance, by email or in the Service, before adding or replacing a sub-processor.
• The User may object on reasonable grounds. If no agreement is reached, the User may close their account and receive a refund for the unused paid period.
• Opernt enters into a contract with each sub-processor with equivalent data protection obligations and is responsible for the sub-processor's actions.

7. Transfers outside the EEA

Data is stored in the European Union. If a sub-processor accesses data from outside the European Economic Area, Opernt ensures appropriate safeguards (Article 46 GDPR). These are the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. User's obligations

The User:

• ensures there is a lawful basis for processing the data;
• informs data subjects about the processing under Articles 13 and 14 GDPR;
• enters only the data needed for the purpose.

9. Return and deletion of data

The User can export their data at any time while the account is active. After the account is deleted or use of the Service ends, Opernt deletes the personal data processed on the User's behalf within 30 days. Data in backups is deleted up to 7 days later. The exception is where the law requires the data to be kept.

10. Precedence

If these terms conflict with the Terms of Service on matters of personal data processing, these terms prevail.