This Data Processing Agreement ("DPA") forms part of the Subscription Terms between the Customer (the "Controller") and Eproma Software Ltd, Pavlou Valdaseridi Street no. 6, #402, 6018 Larnaca, Cyprus, registration number HE 495427 (the "Processor"). It is accepted together with the Subscription Terms and is intended to meet the requirements of Article 28 GDPR and Law 125(I)/2018.
1. Subject matter and duration
1.1 The Processor processes personal data on behalf of the Controller to provide the Service under the Subscription Terms. The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Schedule A.
1.2 This DPA applies for as long as the Processor processes personal data on behalf of the Controller, and ends when all Customer Data have been deleted under clause 10.
2. Instructions
2.1 The Processor processes personal data only on documented instructions of the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case the Processor will inform the Controller of the legal requirement before processing, unless the law prohibits this.
2.2 The Subscription Terms, this DPA and the Controller's use and configuration of the Service are the Controller's documented instructions. Further instructions must be given in writing or by email to info@eproma.io.
2.3 The Processor will inform the Controller immediately if, in its opinion, an instruction infringes data protection law.
3. Responsibilities of the Controller
The Controller is responsible for the lawfulness of the processing, in particular for having a legal basis, informing data subjects (including visitors of its agency website), and obtaining any required consents, including for emails, newsletters, SMS and WhatsApp messages sent through the Service.
4. Confidentiality
The Processor ensures that all persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5. Security
5.1 The Processor implements the technical and organisational measures in Schedule B to ensure a level of security appropriate to the risk (Article 32 GDPR).
5.2 The Processor may adapt these measures to technical progress, provided the level of protection is not reduced.
6. Sub-processors
6.1 The Controller gives the Processor general authorisation to engage sub-processors. The sub-processors listed in Schedule C are approved.
6.2 The Processor will inform the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If no solution is found, the Controller may terminate the affected services with effect from the date of the change.
6.3 The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, and remains liable to the Controller for the performance of its sub-processors' obligations.
7. International transfers
7.1 The Service and Customer Data are hosted in Germany (European Union), including file storage and backups.
7.2 Personal data are transferred outside the European Economic Area only where needed for functions the Controller uses (in particular AI Features, see Schedule C), and only where Articles 44 to 49 GDPR are met, in particular on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
8. Assistance
8.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. The Service provides functions to access, correct, export and delete data. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay.
8.2 The Processor assists the Controller in complying with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to it.
9. Personal data breaches
The Processor notifies the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information required by Article 33(3) GDPR as far as available. The Processor takes the necessary measures to secure the data and mitigate possible adverse effects.
10. Deletion and return
After the subscription ends, the Controller may export its Customer Data for 30 days. The Processor then deletes all Customer Data, including copies, within 90 days, unless Union or Member State law requires storage. Backups are overwritten in the regular backup cycle within that period.
11. Audits
11.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, in particular this DPA, Schedule B and, where available, certificates or audit reports.
11.2 If that information is not sufficient, the Controller may carry out an audit itself or through an independent auditor bound by confidentiality, on at least 30 days' notice, during normal business hours, without disrupting operations, and not more than once a year unless there is a specific reason (for example a data breach). The Controller bears its own costs.
12. Liability, precedence and law
12.1 Liability is governed by the Subscription Terms, without prejudice to Article 82 GDPR.
12.2 In the event of conflict regarding the protection of personal data, this DPA prevails over the Subscription Terms.
12.3 This DPA is governed by the laws of the Republic of Cyprus. The courts of the Republic of Cyprus, in particular the District Court of Larnaca, have exclusive jurisdiction.
Schedule A: Details of the processing
Nature and purpose: provision of a cloud-based real estate CRM, website and marketing platform, including storage and management of contacts, properties and transactions; communication with clients by email, newsletter, SMS and messaging; agency websites and publication of properties on portals; matching of buyers and properties; document and contract management; calendar synchronisation; electronic signature of documents; and AI Features (assistant, AI search, text generation and translation, reading of uploaded documents).
Categories of data subjects: clients, prospective buyers and tenants, property owners and sellers, leads and website visitors of the Controller; employees and users of the Controller; business partners of the Controller (for example other agents, developers, lawyers and notaries).
Types of personal data: identification and contact data (name, address, email, telephone, language, nationality); search profiles and property preferences; property and ownership data; communication content and history (emails, messages, notes, call logs); appointments and viewings; contract and transaction data; documents uploaded by the Controller; usage and log data of users; newsletter interaction data (opens, clicks); where the Controller uses identity verification functions, identity document data and verification results.
Special categories of data (Article 9 GDPR): not intended. The Controller must not store such data in the Service unless strictly necessary and lawful.
Duration: the subscription term and until deletion under clause 10.
Schedule B: Technical and organisational measures
Hosting and physical security: ISO/IEC 27001-certified data centre of Hetzner Online GmbH in Falkenstein, Germany, for servers, load balancer, file storage and backups, with access control, video surveillance and 24/7 security.
Encryption: TLS encryption of all data in transit; encryption of the database, file storage and backups at rest; secrets (for example access credentials for connected services) stored encrypted.
Tenant isolation: separation of customer data, enforced in every database query.
Access control: role-based permissions; optional two-factor authentication and optional IP allowlist for each customer account; staff access only where necessary for support or operations, on a need-to-know basis.
Logging and integrity: append-only audit log of relevant actions; server and application logs kept for 14 days.
Availability and resilience: daily encrypted backups, kept for 30 days, plus monthly copies; restores tested; monitoring and alerting of all systems; documented recovery procedures.
Organisational measures: confidentiality obligations for all staff and contractors; regular security updates; incident response procedure; privacy by design and by default.
Schedule C: Approved sub-processors
| Sub-processor | Service | Location and transfer safeguard |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the platform, database, file storage, backups and agency websites | Germany (Falkenstein) |
| Neue Medien Münnich (ALL-INKL.COM), Hauptstraße 68, 02742 Friedersdorf, Germany | Sending of system emails, mailboxes, DNS | Germany |
| OpenAI Ireland Limited, Dublin, Ireland, under the OpenAI Data Processing Addendum | AI models for AI Features: assistant, AI search, text generation and translation, reading of uploaded documents (only when AI Features are used) | EU/USA; processing through OpenAI's global API, with transfers to OpenAI, L.L.C. under the Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework; no use of Customer Data for training; API inputs and outputs kept for up to 30 days for abuse monitoring, then deleted |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Maps Platform (address geocoding and maps); Google Calendar synchronisation for users who connect it | EU/USA; EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Bird B.V., Amsterdam, the Netherlands | SMS and WhatsApp messaging (only when used) | EU region |
| INWX GmbH, Prinzessinnenstraße 30, 10969 Berlin, Germany (Amtsgericht Charlottenburg, HRB 237141 B) | Domain registration for agency websites (only when ordered) | Germany; registrant data passed to the relevant domain registry |
| Paperless GmbH, Große Friedberger Straße 13-17, 60313 Frankfurt am Main, Germany (Amtsgericht Frankfurt am Main, HRB 118617 B) | Electronic signature of documents (only when a user sends a document for signature): the document, each signer's name and email address, the subject and message, the signer's language; the provider keeps its own audit trail of the signature (IP address, timestamps, browser) | Germany (ISO/IEC 27001-certified); documents and signature audit trail are stored in Germany and kept for the provider's standard retention period |
Further sub-processors for optional modules (for example identity verification or additional portal connections) will be added under clause 6.2 before they are used.