Data Processing Agreement

This data processing agreement (the “Agreement”) is entered into between the customer of the Rentalia service, acting as controller (the “Customer”), and NANOCREATIVES, a French simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 1,000, registered with the Créteil Trade and Companies Register under number 922 674 577, whose registered office is at 1 Cours Sainte-Marthe, Bâtiment B, 94320 Thiais, France, acting as processor (“Nanocreatives”).

Its purpose is to set out the conditions under which Nanocreatives processes, on behalf of the Customer, the personal data that the Customer enters, uploads or generates in the Service, in accordance with Article 28 of Regulation (EU) 2016/679 (“GDPR”).

The Agreement forms an integral part of the terms of use and sale of the Service (the “Terms”). It is accepted at the same time as the Terms.

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR. Other capitalised terms have the meaning given to them in the Terms.

The Customer is the controller of the personal data it enters in the Service about third parties. It determines the purposes and essential means of the processing.

Nanocreatives acts as processor for that data. It remains the controller of data relating to its customers’ accounts and billing, which is covered by its Privacy Policy and not by this Agreement.

The processing carried out on behalf of the Customer has the following characteristics:

The Customer shall refrain from entering in the Service special categories of data within the meaning of Article 9 GDPR or data relating to criminal convictions and offences, except where processing such data is necessary and lawful under the applicable law, under its sole responsibility.

• nature of the operations: hosting, storage, organisation, consultation, modification, generation of documents, sending of notifications on behalf of the Customer, and deletion;
• purpose: provision to the Customer of the rental management Service, in particular management of properties, units, tenants and leases, rent schedules, recording of payments received, issuance of receipts, rent receipts and statements, maintenance, document management, bookkeeping and notifications;
• data subjects: tenants, landlords and owners, guarantors, contractors and other service providers, and any other person whose data the Customer enters;
• categories of data: identification and contact data; data relating to properties and leases; financial data relating to rents, due dates and recorded payments; content of uploaded or generated documents; history of notifications sent; any other data the Customer chooses to enter;
• duration: the period during which the Customer uses the Service, plus the retrieval period provided for in Article 13.

Nanocreatives processes the data only on documented instructions from the Customer. The Terms, this Agreement and the actions carried out by the Customer and its Users through the features of the Service constitute the Customer’s instructions.

Where Nanocreatives is required to carry out processing under Union or Member State law to which it is subject, it informs the Customer before the processing, unless that law prohibits such information on important grounds of public interest.

Nanocreatives immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

Nanocreatives ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access the data only to the extent necessary for the provision of the Service, support and security.

Nanocreatives implements the appropriate technical and organisational measures provided for in Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons. These measures include in particular:

The Customer is responsible for the security of its own use of the Service, in particular the management of its Users’ accounts and roles and the confidentiality of their credentials.

• hosting of the application and databases in France;
• access control based on the roles assigned in each Space, and segregation of data between Spaces;
• mandatory two-factor authentication for administration roles;
• a session cookie that is inaccessible to scripts (httpOnly);
• no storage of card numbers;
• technical monitoring hosted by Nanocreatives.

The Customer gives Nanocreatives a general authorisation to engage sub-processors. As at the date of this Agreement, the sub-processors are as follows:

Nanocreatives informs the Customer of any intended change concerning the addition or replacement of a sub-processor before it is implemented. The Customer may object on reasonable grounds relating to data protection; failing agreement between the parties, the Customer may cancel its Subscription.

Nanocreatives imposes on each sub-processor, by contract, data protection obligations equivalent to those set out in this Agreement. It remains fully liable to the Customer for the performance of the sub-processor’s obligations.

• OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of the application and databases, in France;
• Cloudflare, Inc., United States: storage of uploaded files and generated documents (R2 service), DNS and network proxy services;
• Resend, United States: sending of transactional emails;
• Meta Platforms (WhatsApp Business) and Twilio: delivery of notifications by WhatsApp and SMS, transmitted through the messaging relay operated by Nanocreatives.

Some sub-processors are established outside the European Union. Transfers to Cloudflare, Inc. and Resend, established in the United States, are governed by the standard contractual clauses adopted by the European Commission. Any other transfer is carried out in accordance with Chapter V GDPR.

Taking into account the nature of the processing, Nanocreatives assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects to exercise their rights. Where a data subject sends Nanocreatives a request directly concerning data processed on behalf of the Customer, Nanocreatives forwards it to the Customer without responding to it itself, unless instructed otherwise by the Customer.

Nanocreatives also assists the Customer in ensuring compliance with the obligations set out in Articles 32 to 36 GDPR, relating to security, notification of personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to it.

Nanocreatives notifies the Customer of any personal data breach without undue delay after becoming aware of it.

The notification includes, to the extent available, the information provided for in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. This information may be provided in phases.

It is for the Customer, as controller, to notify the breach to the competent supervisory authority and, where applicable, to the data subjects.

Nanocreatives makes available to the Customer, on request sent to support@rentalia-pro.com, the information necessary to demonstrate compliance with the obligations set out in this Agreement.

Nanocreatives allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor mandated by it who is bound by a confidentiality obligation. Audits are carried out after reasonable prior notice, in a manner that does not disrupt the operation of the Service or compromise the security or confidentiality of other customers’ data, and their costs are borne by the Customer.

At the end of the use of the Service, the data remains retrievable by the Customer for a period stated in the application, of at least 30 days.

At the end of that period, Nanocreatives deletes or anonymises the data processed on behalf of the Customer, unless Union or Member State law requires its retention.

The Customer undertakes to:

• have a legal basis for each processing operation it carries out using the Service, including for sending notifications to data subjects;
• inform data subjects in accordance with Articles 13 and 14 GDPR;
• enter only data that is adequate, relevant and limited to what is necessary;
• respond to requests from data subjects to exercise their rights;
• document in writing any specific instruction given to Nanocreatives;
• maintain its own record of processing activities where required by the regulations.

Each party is liable for damage resulting from its own breaches of the GDPR and of this Agreement, under the conditions provided for in Article 82 GDPR and, to the extent permitted by law, within the limits set out in the Terms.

This Agreement takes effect upon acceptance of the Terms and remains in force for as long as Nanocreatives processes data on behalf of the Customer. In the event of conflict between this Agreement and the Terms on a matter relating to data protection, this Agreement prevails.

This Agreement is governed by French law. Any question regarding its application may be sent to support@rentalia-pro.com.

Version of 2026-10-30.