Translation of the French version. The French version is authoritative; in case of doubt, the interpretation most favourable to the consumer prevails.
Data Processing Agreement (landlords)
Version in force as of 2 November 2026 (Garentiz 3.14.23).
This agreement, entered into pursuant to Article 28 of the GDPR, applies between the landlord using Garentiz (the “controller”) and Nayaro SRL, BE 0647.588.826, Chemin de la Cure d'Air 16, 7000 Mons, Belgium, support@garentiz.com (the “processor”). It forms part of the terms accepted when signing up.
1. Subject matter and duration
The processor processes, on behalf of the controller, the personal data needed for the rental management carried out in Garentiz, for the entire period of use of the service and until the end of processing described in Article 6.
2. Description of the processing
Data subjects: tenants, co-tenants and co-signatories, occupants, guarantors, rental applicants and visitors, people who use a property's QR code, tradespeople and service providers, delegates, co-owners and joint owners, recipients of a link share, senders of linked e-mails, and any person whose data appears in uploaded documents.
Categories of data: identity and contact details, date of birth if entered, address after the lease, lease and rent data (amounts, payments, arrears, indexation, final statements), rental deposit, documents (leases, inventory reports and photos, signatures, certificates, letters, invoices), identity documents if uploaded, requests and exchanges, linked e-mails and their attachments, applications, insurance claims, jobs.
Operations: hosting, consultation, organisation, document generation, simple electronic signature, sending of e-mails, text messages and notifications, reading the controller's mailbox if they connect it, calculations, assistant proposals if the controller uses it, export, erasure.
Purpose: enabling the controller to manage their lettings using Garentiz.
3. Obligations of the processor
The processor undertakes to:
process the data only on documented instructions from the controller, that is, through the features of Garentiz and the settings the controller chooses, and to inform the controller if an instruction appears to infringe the regulations;
ensure the confidentiality of the data and restrict access to authorised persons bound by confidentiality; administrative access to the account (assisted login), reserved for support and security, is limited to 30 minutes and logged;
implement appropriate technical and organisational measures: encryption of identity documents and secrets, hashed passwords, two-factor authentication, separation between accounts, encrypted connections, daily backups, chained audit log, time-stamped register, test environment reserved for the admin area (authorised network addresses), on the same hosting, which may receive a complete copy of the data to check a new version and sends no messages;
help the controller respond to requests from data subjects to exercise their rights, in particular through the export, modification and deletion features; from a tenant's or tradesperson's record, “This person's data” exports what the account keeps about them (JSON and readable summary) and erases it, except what a running lease, proof or the accounts require;
notify the controller of any data breach concerning them as soon as possible, and no later than 48 hours after becoming aware of it, with the information available;
assist the controller, to the extent of its means, with their impact assessments and their dealings with the supervisory authority;
make available the information needed to demonstrate compliance with this agreement, and allow reasonable audits, at the controller's expense and with 30 days' notice.
4. Sub-processors
The controller authorises the use of the following sub-processors, needed for the service:
OVH SAS (France, European Union): hosting, database, files, backups and sending of e-mails;
Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): sending notifications to the phones of mobile application users;
Brevo (Sendinblue SAS, France), if text messaging is enabled and included in the licence: sending text messages;
Anthropic, if the assistant is enabled and the controller uses it: reading the documents and texts the controller submits to it;
OpenStreetMap Foundation (United Kingdom): geocoding of property addresses for the portfolio map.
Stripe, the payment provider, only processes the billing data of the controller themselves, not the data of their tenants.
The processor imposes equivalent data protection obligations on each of them. Any new sub-processor is announced at least 30 days in advance; the controller may object by ending their use of the service. Transfers outside the European Economic Area are governed by an adequacy decision (in particular the EU-US Data Privacy Framework for companies that participate in it, and the decision concerning the United Kingdom) or by standard contractual clauses of the European Commission.
5. Obligations of the controller
The controller warrants that they have a legal basis for the data they enter, enter only data that is adequate and limited to what is necessary, choose an appropriate retention period for applications, and inform data subjects. Garentiz provides them with an information document for tenants. When they delegate access, share a property by link or connect their mailbox, they ensure that such uses are necessary and known to the data subjects.
6. End of processing
At the end of the use of the service, the controller can export all their data from “My data”. Their deletion request takes effect 30 days later. All files are then erased, the identifying data of tenants, tradespeople and other third parties anonymised, and applications, contacts and linked e-mails deleted or emptied, as described in the Privacy Policy. In accordance with Article 28(3)(g) GDPR, portfolio data (properties, leases, tenants, due dates, payments, documents, requests, inventories, expenses) is then erased 90 days after closure, or at closure if the controller asks for it. Nayaro SRL only keeps what the law or proof requires: the append-only entries of the time-stamped register (masked at source since version 3.14.18: e-mail addresses as fingerprints, IBANs masked), and its own invoicing records. Backups are replaced over time: database 14 nights, files 7 nights, encrypted off-site copy 60 days.
7. Liability
Each party is liable for the breaches attributable to it, within the limits laid down by the GDPR and by the Terms of Use.