Data Processing Agreement (DPA)

Version DPA-2026-v3. Last updated: 6 September 2026.

Preamble

This Data Processing Agreement (“DPA”) forms an integral part of the agreement entered into between:

• The Controller: the professional Client subscribing to the SEIDO services (the “Controller” or “Client”);

and

• The Processor: UMUMENTUM SRL, Rue de Grand-Bigard 14, 1082 Berchem-Sainte-Agathe, Belgium, BCE 0775.691.974, VAT BE0775691974, publisher of the SEIDO platform (the “Processor” or “SEIDO”).

Hereinafter together the “Parties”.

This DPA governs the processing, by SEIDO as processor, of the personal data for which the Client is the controller, in the context of the use of the Platform. It complements the Terms of Use, the Terms of Sale and the Privacy Policy.

Hierarchy of contractual documents. In the event of conflict, the documents apply in the following decreasing order of priority: (1) the signed Particular Conditions; (2) the Data Processing Agreement (DPA), for everything relating to personal data; (3) the General Terms of Sale (Terms of Sale), for the commercial part; (4) the General Terms of Use (Terms of Use), for the usage part; (5) the policies (Privacy, Cookies). The same order of priority is repeated, word for word, in the three documents.

Article 1 : Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them by Article 4 of the GDPR. “GDPR” means Regulation (EU) 2016/679.

Article 2 : Subject matter, duration, nature and purpose of the processing

• Subject matter and nature: hosting and processing of personal data necessary for the provision of the Platform’s rental management and intervention orchestration services.
• Purpose: enabling the Client to manage its properties, tenants, contractors, agreements, rents, interventions and related communications through the Platform.
• Duration: the processing lasts as long as the service agreement, then for the retention periods provided for in Article 9.

The details (categories of data, categories of data subjects) are set out in Annex 1.

Article 3 : Documented instructions

SEIDO processes personal data only on the basis of the Client’s documented instructions, including for transfers outside the EEA, unless required to do so by law, in which case SEIDO informs the Client before processing, unless prohibited by law.

These terms, the agreement and the Client’s use of the Platform’s features constitute the initial documented instructions. SEIDO informs the Client if, in its opinion, an instruction infringes the GDPR or other applicable data protection provisions.

Article 4 : Confidentiality

SEIDO ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and receive the necessary data protection training.

Article 5 : Security of processing (Art. 32 GDPR)

SEIDO implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures are detailed in Annex 3.

Article 6 : Sub-processors

The Client authorises SEIDO to engage sub-processors for the performance of the services. The list of authorised sub-processors is set out in Annex 2.

SEIDO imposes on each sub-processor, by contract, data protection obligations equivalent to those of this DPA, and remains fully liable to the Client for the performance of those sub-processors’ obligations.

SEIDO informs the Client of any intended change concerning the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the Client the opportunity to raise reasoned objections. In the event of a reasoned objection, the Parties seek in good faith a reasonable alternative solution; failing that, the Client may terminate the affected service, without penalty, for the part affected by the change.

Each version of this DPA is dated and numbered; the version history, with the nature of each change, is set out at the end of the document and published online at the DPA’s reference address. The version annexed to the signed agreement remains the one binding the Parties for the current period.

Article 7 : Assistance to the Controller

Taking into account the nature of the processing, SEIDO assists the Client, by appropriate technical and organisational measures, insofar as possible, in:

• responding to requests for exercising the data subjects’ rights (Art. 12 to 23 GDPR), in particular through the Platform’s export and deletion features;
• ensuring compliance with the obligations relating to security (Art. 32), breach notification (Art. 33-34), data protection impact assessments / DPIA (Art. 35) and prior consultation (Art. 36).

Article 8 : Notification of personal data breaches

SEIDO notifies the Client of any personal data breach without undue delay after becoming aware of it, and at the latest forty-eight (48) hours after becoming aware of it, providing the information reasonably available (Art. 33.3 GDPR: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken) to enable the Client to meet its own notification obligations (Art. 33-34 GDPR).

Article 9 : Fate of the data at the end of processing

At the Client’s choice and upon expiry or termination of the agreement, SEIDO deletes or returns all personal data and destroys existing copies, unless a legal retention obligation applies. Return is made in a structured, commonly used and machine-readable format, within thirty (30) days following the end of the agreement; deletion of the data from the active systems takes place at the end of that period, and the purge of the encrypted backups within a maximum of ninety (90) days (backup rotation cycle).

Article 10 : Audits

SEIDO makes available to the Client all information necessary to demonstrate compliance with the obligations of Article 28 GDPR and allows for audits, including inspections, by the Client or an auditor mandated by the Client, under the following conditions: subject to reasonable notice (at least 30 days), at most once a year (except in the event of a proven security incident or a request from an authority), during business hours, without disrupting SEIDO’s operations and in compliance with confidentiality. SEIDO may satisfy this obligation by providing a recent independent certification or audit report (e.g. ISO 27001 / SOC 2) in lieu of an on-site audit. The costs of an on-site audit requested by the Client are borne by the Client, unless a proven breach by SEIDO is established.

Article 11 : Transfers outside the European Union

Any transfer of personal data to a third country is carried out in compliance with Chapter V of the GDPR, on the basis of an adequacy decision or appropriate safeguards (in particular the European Commission’s standard contractual clauses), accompanied where necessary by supplementary measures.

Ongoing transfers are identified in Annex 2 (columns “Country” and “Transfer basis”). Data Privacy Framework certifications are verified there against the public register of the United States Department of Commerce (dataprivacyframework.gov) as at the date of the version; SEIDO re-verifies them with each new version of the DPA and with each addition of a sub-processor.

Article 12 : Liability and governing law

The liability of the Parties under this DPA is governed by the Terms of Use / Terms of Sale and the agreement. This DPA is governed by Belgian law; any dispute falls within the jurisdiction of the courts of the judicial district of Brussels.

Annex 1 : Description of the processing

Categories of data subjects:

• Tenants and occupants of the properties managed by the Client;
• Owners (landlords);
• Service providers / contractors;
• Staff and users of the Client’s account (managers).

Categories of personal data:

• Identification data (surname, first name, address, telephone, e-mail);
• Communication data (messages, photos, documents exchanged);
• Intervention data (reports, assessments, action history);
• Geolocation data (where necessary for interventions);
• Contractual and rental data (leases, rents, inventories);
• Financial and transaction data (amounts, payment references, bank data relating to rent reconciliation).

Special categories of data (Art. 9 GDPR): the service is not intended for the processing of special categories of data. The Client (Controller) undertakes not to upload or enter, through the Platform, data falling under Article 9 GDPR (in particular health data) beyond what is strictly necessary, and remains solely responsible for identifying the appropriate legal basis (Art. 9.2 GDPR) where applicable. SEIDO processes such data, if it appears (e.g. in an intervention request), only on the Client’s documented instruction and within the scope of hosting.

Processing operations: collection, recording, organisation, structuring, storage, consultation, use, disclosure, hosting, erasure.

Annex 2 : List of sub-processors

Annex 3 : Technical and organisational security measures (Art. 32 GDPR)

Confidentiality and access control:

• Encryption of communications in transit (TLS/SSL);
• Role-based access control (RBAC) and segregation of data by organisation/team (row-level security policies in the database);
• User authentication (managed by the authentication provider, Supabase Auth); multi-factor authentication (MFA) planned, not available as at the date of this version; pending its deployment, a strengthened password policy (minimum twelve (12) characters, letters and digits) and logging of access and sensitive operations; the Client is informed when MFA becomes available;
• Staff confidentiality commitments.

Integrity and availability:

• Daily encrypted backups on external infrastructure;
• Firewall and protection against bots/abuse;
• Logging and traceability of access and sensitive operations;

Encryption at rest:

• Encryption of data at rest for the database (managed PostgreSQL) and object storage (files, encrypted backups), provided by the hosting infrastructures (Supabase / Cloudflare R2).

Incident management:

• Procedure for the detection, qualification and notification of personal data breaches (Article 8).

Organisational measures:

• Awareness and training of staff on data protection;
• Contractual framework for sub-processors;
• Periodic review of security measures.

Version history