Estata Data Processing Addendum

Last updated: 4 November 2026

Version 2026-10-18

This Data Processing Addendum (the "DPA") forms part of the Estata Terms of Service, or any other written agreement for the Estata service (together, the "Terms"), between KMT TECHNOLOGIES FZCO ("KMT") and the customer that has agreed to the Terms (the "Customer"). It applies whenever KMT processes Customer Personal Data on behalf of the Customer.

1. Parties and incorporation

1.1 KMT. KMT TECHNOLOGIES FZCO is a Free Zone Company registered in the Dubai Multi Commodities Centre (DMCC), licence number DMCC 821264, registration number DMCC190245, with its registered address at Unit 3298, DMCC Business Centre, Level 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates. Contact for data protection matters: support@estata.app.

1.2 Incorporation. This DPA is incorporated into the Terms by reference and is accepted when the Customer accepts the Terms. It needs no separate signature, but KMT will provide a countersigned copy on request.

1.3 Precedence. If there is a conflict: (a) the Standard Contractual Clauses and the UK Addendum, where they apply, prevail over this DPA and the Terms; (b) this DPA prevails over the Terms on matters of data protection; and (c) otherwise the Terms apply. Terms not defined in this DPA have the meaning given in the Terms.

2. Definitions

In this DPA:

"Applicable Data Protection Law" means all laws on privacy and the protection of personal data that apply to the processing of Customer Personal Data, which may include the EU GDPR, the UK GDPR, the Swiss FADP, the Israel Privacy Law and Data Security Regulations, the UAE PDPL and US State Privacy Laws.
"Customer Personal Data" means personal data within Customer Data, as defined in the Terms, that KMT processes on behalf of the Customer in providing the Service.
"Data Security Regulations" means the Israel Protection of Privacy (Data Security) Regulations, 5777 (2017).
"EU GDPR" means Regulation (EU) 2016/679, the General Data Protection Regulation.
"Israel Privacy Law" means the Israel Protection of Privacy Law, 5741 (1981), as amended, including by Amendment 13 (2025), and its regulations.
"Israel Transfer Regulations" means the Israel Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761 (2001).
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by KMT or its Subprocessors, and includes a "security incident" within the meaning of the Data Security Regulations.
"Restricted Transfer" means a transfer of Customer Personal Data that would be prohibited by Applicable Data Protection Law without an approved transfer mechanism.
"SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Subprocessor" means any third party engaged by KMT to process Customer Personal Data.
"Swiss FADP" means the Swiss Federal Act on Data Protection of 25 September 2020.
"UAE PDPL" means UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data and its Executive Regulations once issued.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, as revised from time to time.
"UK GDPR" means the EU GDPR as it forms part of the law of the United Kingdom, together with the Data Protection Act 2018, as amended.
"US State Privacy Laws" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and the comparable comprehensive privacy laws of other US states.

"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the EU GDPR or, where another law applies, the equivalent terms in that law, including "database controller" (also referred to as "database owner") and "holder" under the Israel Privacy Law, "controller" and "processor" under the UAE PDPL, and "business", "service provider" and "contractor" under US State Privacy Laws.

3. Scope

3.1 This DPA applies to the processing of Customer Personal Data by KMT as processor in providing the Service. The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

3.2 This DPA does not apply to Account Data, meaning personal data of the Customer's Authorised Users and billing contacts that KMT processes as an independent controller to manage accounts, authentication, security, billing and its relationship with the Customer. KMT processes Account Data as described in its Privacy Policy.

4. Roles of the parties

4.1 Customer as controller. The Customer is the controller of Customer Personal Data, and KMT is its processor. For the Israel Privacy Law, the Customer is the database controller and KMT is a holder. For the UAE PDPL, the Customer is the controller and KMT is the processor. For US State Privacy Laws, the Customer is the business and KMT is its service provider.

4.2 Customer as processor. Where the Customer processes Customer Personal Data as a processor on behalf of a third party controller (for example, a property manager acting for property owners), the Customer confirms that its instructions to KMT, including the appointment of KMT and its Subprocessors, have been authorised by that controller. KMT then acts as the Customer's subprocessor, and the Customer is the single point of contact for KMT and is responsible for passing information and notices to the relevant controller.

4.3 Customer obligations. The Customer is responsible for:

having a lawful basis for all processing of Customer Personal Data and for its instructions to KMT;
giving data subjects the notices, and obtaining any consents, required by Applicable Data Protection Law, including notice that their data is processed by service providers and hosted in the United States;
recording government identification numbers, passport numbers, copies of identity documents and other sensitive data only where required or permitted by law, and limiting Customer Personal Data to what is necessary;
the accuracy of Customer Personal Data and deciding how long to keep it;
configuring and using the Service securely, including assigning appropriate roles, removing Authorised Users promptly, protecting credentials, and keeping calendar export links confidential; and
for Customers subject to the Israel Privacy Law, determining the security level of each database under the Data Security Regulations, carrying out the risk assessment required before outsourcing processing under Regulation 15, and performing its other duties as database controller.

5. Processing instructions

5.1 Documented instructions. KMT will process Customer Personal Data only on the Customer's documented instructions, including with regard to Restricted Transfers, unless required to do so by a law to which KMT is subject. In that case KMT will inform the Customer of the legal requirement before processing, unless that law prohibits it on important grounds of public interest.

5.2 What counts as instructions. The Customer instructs KMT to process Customer Personal Data: (a) to provide, secure, support and maintain the Service in accordance with the Terms and the Documentation; (b) as initiated by Authorised Users through their use of the Service, including importing calendar feeds, sending emails and notifications, and generating exports and reports; and (c) as set out in any other reasonable written instruction from the Customer that is consistent with the Terms. The Terms and this DPA are the Customer's complete instructions at the time of acceptance. Additional instructions that change the scope of the Service require written agreement and may involve additional fees.

5.3 Unlawful instructions. KMT will promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. KMT may suspend the affected processing until the Customer confirms or changes the instruction.

6. Confidentiality of personnel

KMT will ensure that every person it authorises to process Customer Personal Data, including employees, contractors and Subprocessor personnel, is bound by a written duty of confidentiality or a statutory duty of confidentiality, receives appropriate data protection and security training, and accesses Customer Personal Data only to the extent needed to provide the Service, provide support requested by the Customer, or address security and technical issues. These duties continue after the end of the person's engagement.

7. Security

7.1 Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to data subjects, KMT will implement and maintain the technical and organisational measures described in Annex 2 to protect Customer Personal Data against Personal Data Breaches, in accordance with GDPR Article 32 and the equivalent provisions of Applicable Data Protection Law.

7.2 Updates. KMT may update the measures in Annex 2 as technology and threats evolve, provided that the updates do not materially reduce the overall level of protection of Customer Personal Data.

7.3 Customer's part. The Customer is responsible for its own security choices within the Service, as described in Section 4.3, and for the security of the devices and networks its Authorised Users use to access the Service.

7.4 Israel security levels. KMT has designed the measures in Annex 2 to support Customers in meeting the Data Security Regulations. Where a Customer's database is subject to the high security level, or the Customer requires specific measures beyond Annex 2, the parties will agree those measures in writing.

8. Subprocessors

8.1 General authorisation. The Customer gives KMT general written authorisation to engage Subprocessors. The Subprocessors in Annex 3 are authorised as at the date of this DPA.

8.2 Subprocessor terms. KMT will engage each Subprocessor under a written contract that imposes data protection obligations no less protective of Customer Personal Data than this DPA, to the extent applicable to the service provided by that Subprocessor. KMT remains fully responsible to the Customer for the performance of each Subprocessor's obligations.

8.3 Notice of changes. KMT will notify the Customer of any intended addition or replacement of a Subprocessor at least 30 days before the new Subprocessor begins processing Customer Personal Data, by email to the Customer's Workspace admins, by notice within the Service, or by updating the subprocessor list and notifying Customers who have asked to receive updates. Where a replacement is urgently needed to protect the security or continuity of the Service, KMT may give shorter notice, and will explain the reasons.

8.4 Objection. The Customer may object to a new Subprocessor on reasonable grounds relating to data protection by writing to support@estata.app within 30 days after the notice. The parties will discuss the objection in good faith. If KMT cannot offer a reasonable alternative that addresses the objection, the Customer may terminate the affected part of the Service by written notice before the new Subprocessor begins processing, and KMT will refund prepaid Fees for the remainder of the Subscription Term after termination. This is the Customer's sole remedy for an objection.

8.5 Copies. On request, KMT will provide the Customer with a summary of the data protection terms of its Subprocessor contracts, which may be redacted to remove confidential commercial information.

9. International transfers

9.1 Location. Customer Personal Data is hosted on Google Cloud in its Iowa region in the United States. KMT is established in the United Arab Emirates, and KMT and its Subprocessors may access or process Customer Personal Data from the countries listed in Annex 3. KMT will not change the hosting region of Customer Personal Data to another country without notice under Section 8.3.

9.2 EEA transfers. To the extent that the Customer's use of the Service involves a Restricted Transfer of Customer Personal Data subject to the EU GDPR to KMT, the SCCs are incorporated into this DPA and apply as follows:

Module 2 (controller to processor) applies where the Customer is a controller, and Module 3 (processor to processor) applies where the Customer is a processor;
the Customer is the data exporter and KMT is the data importer;
the optional docking clause in Clause 7 applies;
in Clause 9, Option 2 (general written authorisation) applies, with the time period for prior notice of Subprocessor changes being 30 days, as set out in Section 8;
the optional language in Clause 11 does not apply;
in Clause 13, the competent supervisory authority is determined as set out in Annex 1, Part C;
in Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
in Clause 18(b), disputes are resolved before the courts of Ireland; and
Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA.

9.3 UK transfers. To the extent that the Customer's use of the Service involves a Restricted Transfer of Customer Personal Data subject to the UK GDPR, the UK Addendum is incorporated into this DPA and applies to the SCCs as completed under Section 9.2. Table 1 of the UK Addendum is completed with the details of the parties in Annex 1; Table 2 with the modules and options in Section 9.2; Table 3 with Annexes 1 to 3; and in Table 4 either party may end the UK Addendum as permitted by its Section 19.

9.4 Swiss transfers. To the extent that a Restricted Transfer is subject to the Swiss FADP, the SCCs apply as completed under Section 9.2 with these changes: references to the EU GDPR are read as references to the Swiss FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; the term "member state" does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence; and the SCCs also protect the data of legal entities until the relevant provisions of earlier Swiss law cease to apply, to the extent that they still apply.

9.5 Israel transfers. For Customer Personal Data subject to the Israel Privacy Law, KMT undertakes in writing, for the purposes of Regulations 2 and 3 of the Israel Transfer Regulations, to take adequate measures to protect the privacy of the data subjects, to comply with the conditions for the maintenance and use of data that apply to a database in Israel with the necessary changes, and not to transfer the data to any further person except under terms that provide the same protection and in accordance with this DPA. KMT will ensure that its Subprocessors give equivalent written undertakings.

9.6 UAE transfers. For Customer Personal Data subject to the UAE PDPL, the parties agree that this DPA, including Sections 5 to 15 and Annex 2, constitutes the contractual safeguards required for cross border transfers under Articles 22 and 23 of the UAE PDPL, and KMT will not transfer such data to a country or recipient except in accordance with those Articles.

9.7 Onward transfers. KMT will ensure that any onward transfer of Customer Personal Data to a Subprocessor outside the country of origin is made under a valid transfer mechanism, such as the SCCs, the UK Addendum, or the recipient's certification under the EU and US Data Privacy Framework and its UK and Swiss extensions.

9.8 Transfer assessments. KMT will provide reasonable information to help the Customer assess the laws and practices of the destination countries, including information about government access requests KMT has received. KMT has received no such request for Customer Personal Data as at the date of this DPA.

9.9 Alternative mechanisms. If a transfer mechanism relied on in this Section is replaced, amended or invalidated, the parties will cooperate in good faith to put in place an appropriate alternative, and KMT may implement an updated mechanism by notice to the Customer.

10. Requests from data subjects and authorities

10.1 Tools. The Service lets the Customer access, correct, export and delete Customer Personal Data, which the Customer can use to respond to requests from data subjects.

10.2 Requests to KMT. If KMT receives a request from a data subject relating to Customer Personal Data, it will forward the request to the Customer without undue delay where it can identify the Customer from the request, and will not respond to the data subject directly except to direct them to the Customer, unless the Customer instructs otherwise or the law requires.

10.3 Assistance. Taking into account the nature of the processing, KMT will assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil its obligations to respond to requests to exercise data subject rights under Applicable Data Protection Law, where the Customer cannot fulfil the request using the Service on its own.

10.4 Requests from authorities. If KMT receives a legally binding request from a public authority for access to Customer Personal Data, KMT will, unless prohibited by law: (a) notify the Customer promptly; (b) review the legality of the request and challenge it where there are reasonable grounds to consider it unlawful; and (c) disclose only the minimum data required to comply. KMT will try to redirect the authority to request the data directly from the Customer.

11. Data protection impact assessments and consultation

KMT will provide reasonable assistance to the Customer, taking into account the nature of the processing and the information available to KMT, with any data protection impact assessment, risk assessment under the Data Security Regulations, or prior consultation with a supervisory authority that the Customer is required to carry out in relation to its use of the Service. KMT will first provide the Documentation, Annex 2 and its standard security information, and may charge reasonable fees, agreed in advance, for assistance that goes materially beyond that information.

12. Personal Data Breach

12.1 Notification. KMT will notify the Customer of a Personal Data Breach without undue delay and in any case within 72 hours after becoming aware of it. Notice will be sent to the Customer's Workspace admins by email, and to any security contact the Customer has given KMT.

12.2 Content. The notice will describe, as far as the information is available: the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its possible adverse effects; and a contact point for more information. Where not all information is available at once, KMT will provide it in phases without undue further delay.

12.3 Response. KMT will promptly take reasonable steps to contain, investigate and remedy the Personal Data Breach, keep the Customer informed of material developments, and provide reasonable cooperation to enable the Customer to meet its own obligations to notify supervisory authorities and data subjects, including the Israel Privacy Protection Authority in case of a serious security incident and the UAE Data Office.

12.4 Customer notifications. The Customer is responsible for deciding whether to notify supervisory authorities, data subjects and other third parties, and for making those notifications. KMT will not notify the Customer's data subjects or authorities about a Personal Data Breach concerning Customer Personal Data on the Customer's behalf without the Customer's prior agreement, unless required by law.

12.5 No admission. KMT's notification of or response to a Personal Data Breach is not an acknowledgement of fault or liability.

12.6 Unsuccessful attempts. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as blocked sign in attempts, port scans or denial of service attacks that are mitigated, are not Personal Data Breaches.

13. Audits and compliance information

13.1 Information. KMT will make available to the Customer, on request, the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, including a description of its security measures, its records of processing carried out on the Customer's behalf, and, where available, summaries of security assessments and the certifications and audit reports of its hosting providers, such as Google Cloud's ISO 27001 certificate and SOC 2 report.

13.2 Questionnaires. KMT will respond, once in any 12 month period, to a reasonable written security or data protection questionnaire from the Customer, and additionally after a Personal Data Breach or where a supervisory authority requires it.

13.3 Onsite audits. Where the information in Sections 13.1 and 13.2 is not sufficient to demonstrate compliance, the Customer, or an independent auditor it appoints who is not a competitor of KMT and who is bound by confidentiality, may carry out an onsite audit of KMT's processing of Customer Personal Data, once in any 12 month period, on the following conditions:

the Customer gives at least 30 days written notice and a proposed audit plan, which the parties agree in good faith;
the audit takes place during normal business hours, lasts no more than 2 business days, and does not unreasonably disrupt KMT's operations;
the audit does not give access to data of other customers, to KMT's confidential commercial information unrelated to the processing, or to the facilities of Subprocessors, whose compliance is shown through their own reports and certifications;
the Customer bears its own costs and the costs of its auditor, and reimburses KMT's reasonable costs for time spent on the audit at rates agreed in advance; and
the Customer gives KMT a copy of the audit report, which is KMT's Confidential Information.

13.4 Authorities. Nothing in this Section limits an audit or inspection by a competent supervisory authority, which KMT will support as required by law.

13.5 Annual report for Israeli Customers. For Customers subject to the Data Security Regulations, KMT will, on request and at least once a year, provide a written report on how it meets its obligations under the Data Security Regulations and this DPA.

14. Deletion and return

14.1 During the subscription. The Customer can export and delete Customer Personal Data at any time using the Service.

14.2 At the end of the subscription. When the subscription ends, the Customer may export Customer Personal Data during the 30 day export window described in the Terms. After that window, KMT will delete Customer Personal Data from the Service's active systems within 90 days after the end of the subscription, and residual copies in backups will be removed in the normal backup cycle within 28 days after that deletion. Database backups are kept for 14 days, and daily disk snapshots, which contain those backups, are kept for 14 days.

14.3 Retention required by law. KMT may keep Customer Personal Data where required by law. In that case KMT will continue to protect it in accordance with this DPA, process it only for the purposes required by that law, and delete it when no longer required.

14.4 Certification. On written request, KMT will confirm in writing that deletion has been completed.

15. US State Privacy Laws

15.1 To the extent that US State Privacy Laws apply to Customer Personal Data, KMT acts as a service provider or contractor and will not:

sell or share Customer Personal Data, as those terms are defined in US State Privacy Laws;
retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in the Terms and this DPA, or outside the direct business relationship between KMT and the Customer; or
combine Customer Personal Data with personal data it receives from or on behalf of another person, or collects from its own interactions with individuals, except as permitted by US State Privacy Laws.

15.2 KMT will comply with the obligations that apply to it under US State Privacy Laws, provide the same level of privacy protection they require, and notify the Customer if it determines that it can no longer meet its obligations. The Customer may take reasonable and appropriate steps to stop and remedy any unauthorised use of Customer Personal Data.

15.3 KMT certifies that it understands and will comply with the restrictions in this Section.

16. Israel specific provisions

For Customers subject to the Israel Privacy Law and the Data Security Regulations, this DPA constitutes the agreement required by Regulation 15 of the Data Security Regulations, and the parties agree that:

the data KMT may process and the permitted purposes are those described in Annex 1;
the systems KMT may access are the production systems of the Service and its Subprocessors listed in Annex 3;
the types of processing permitted are those described in Annex 1 and Section 5;
the duration of the processing, and the return and deletion of the data at its end, are governed by Sections 14 and 18;
KMT will implement the security obligations described in Section 7 and Annex 2, and any additional security instructions agreed in writing under Section 7.4;
KMT will require every person with access to Customer Personal Data to sign a confidentiality undertaking, to use the data only in accordance with this DPA, and to comply with the security measures in Annex 2;
where KMT engages a Subprocessor, it will include equivalent terms in its contract with that Subprocessor, as set out in Section 8.2; and
KMT will report to the Customer at least once a year on request, as set out in Section 13.5, and will notify the Customer of any security incident as set out in Section 12.

17. UAE specific provisions

For Customer Personal Data subject to the UAE PDPL, KMT will, in accordance with Article 8 of the UAE PDPL: process Customer Personal Data only in accordance with the Customer's instructions and this DPA; apply the security measures in Annex 2; process the data only for the purposes and periods described in Annex 1; delete the data after the end of the processing as set out in Section 14; keep a record of the processing it carries out on the Customer's behalf; and provide the Customer and, where required, the UAE Data Office with the information needed to demonstrate its compliance. KMT will notify the Customer of any Personal Data Breach as set out in Section 12 so that the Customer can meet its notification obligations under Article 9 of the UAE PDPL.

18. Liability, term and general

18.1 Liability. Each party's liability arising out of or in connection with this DPA, including the SCCs to the extent permitted by them, is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA limits the rights of data subjects under the SCCs or Applicable Data Protection Law, or any liability that cannot be limited by law.

18.2 Term. This DPA applies for as long as KMT processes Customer Personal Data on behalf of the Customer, including after the end of the Terms until deletion under Section 14 is complete.

18.3 Governing law. Except where the SCCs or another mandatory transfer mechanism requires otherwise, this DPA is governed by the law, and disputes are resolved under the dispute resolution provisions, set out in the Terms.

18.4 Changes. KMT may update this DPA by notice under the change provisions of the Terms, provided that an update does not reduce the protection of Customer Personal Data, or is required by Applicable Data Protection Law or by a supervisory authority.

18.5 Severability. If any provision of this DPA is invalid or unenforceable, the rest of the DPA remains in effect, and the invalid provision is replaced by the valid provision that best reflects the parties' intent.

Annex 1: Description of the processing

Part A: List of parties

Data exporter

Name: the Customer, as identified in its Estata account.
Address and contact person: as set out in the Customer's account and billing details.
Activities relevant to the data transferred: property management, short term and long term rental management, and related operations.
Role: controller, or processor on behalf of a third party controller (see Section 4.2).
Signature and date: by accepting the Terms, which incorporate this DPA.

Data importer

Name: KMT TECHNOLOGIES FZCO.
Address: Unit 3298, DMCC Business Centre, Level 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates.
Contact: support@estata.app.
Activities relevant to the data transferred: provision of the Estata software as a service platform for property management.
Role: processor, or subprocessor where the Customer is a processor.
Signature and date: by making the Service available under the Terms, which incorporate this DPA.

Part B: Description of the transfer and processing

Categories of data subjects

Renters and tenants of the Customer, including prospective renters, co tenants, guarantors and emergency contacts the Customer records.
Guests staying in short term rentals, including other persons in the guest party whose details the Customer records.
Property owners whose properties the Customer manages, including owners who are invited to the owner portal.
The Customer's staff and Authorised Users, such as administrators, property managers, cleaners and maintenance staff, in their capacity as records within the Service (for example as assignees of tasks).
Contractors and service providers of the Customer, such as maintenance professionals, cleaning companies and suppliers.
Any other individuals mentioned in messages, notes, receipts or files the Customer uploads.

Categories of personal data

Identity data: names, and, where the Customer chooses to record them, government identification numbers, passport numbers, dates of birth, nationality and copies of identity documents.
Contact data: phone numbers, email addresses, postal addresses and preferred language.
Lease and booking data: properties and units occupied, lease terms, start and end dates, rent and deposit amounts, booking dates, booking channel, external booking references, occupancy and check in and check out details.
Payment and financial data: rent and fee amounts, payment status, payment method descriptions, transaction records, owner statements, expenses, and receipts and invoices uploaded as images or files, which may contain personal data.
Messages: content of messages and communications sent or recorded within the Service, and related metadata.
Maintenance and cleaning records: tasks, descriptions, assignees, schedules, status, notes and photographs, which may relate to renters, guests, owners, staff or contractors.
User and system data: names, roles and activity records of Authorised Users as they appear in Customer records, assignment history, the activity log (which records field names and limited values such as amounts, dates and statuses, but not contact data or free text), push notification device tokens, and calendar feed and export links.

Sensitive data

The Service is not designed for special categories of personal data or data about criminal convictions, and the Customer must not record such data unless this is necessary, lawful and appropriately safeguarded (see the Terms). Government identification numbers are recorded only at the Customer's choice and are protected by the measures in Annex 2, including role based access and the exclusion of such values from the activity log.

Frequency of the transfer

Continuous, for the duration of the Customer's use of the Service.

Nature of the processing

Collection through the Service and through calendar feed import, recording, organisation, structuring, storage, hosting, backup, retrieval, consultation, display, synchronisation, transmission by email and push notification, export, restriction, deletion and destruction, and the technical operations needed to secure and support the Service.

Purpose of the processing

To provide the Service to the Customer in accordance with the Terms, including managing properties, units, bookings, calendar synchronisation, leases, renter and owner records, finance and receipts, maintenance and cleaning tasks, messaging and the owner portal; to provide support; and to keep the Service secure and available.

Duration of the processing

For the term of the Terms and until deletion is complete under Section 14 of this DPA.

Retention

Customer Personal Data is retained as decided by the Customer during the subscription, and deleted at the end of the subscription as set out in Section 14.

Transfers to Subprocessors

As described in Annex 3, for the subject matter, nature and duration stated there.

Part C: Competent supervisory authority

Where the Customer is established in an EU member state, the supervisory authority of that member state. Where the Customer is not established in the EU but falls within Article 3(2) of the EU GDPR and has appointed a representative, the supervisory authority of the member state where its representative is established. Where the Customer is not established in the EU and has no representative, the supervisory authority of the member state in which the data subjects whose personal data is transferred are located, and where there are several, the Irish Data Protection Commission. For the UK, the Information Commissioner's Office. For Switzerland, the Federal Data Protection and Information Commissioner.

Annex 2: Technical and organisational security measures

Encryption and transport security

All traffic to the Service is encrypted using TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enforced.
A strict Content Security Policy and further security headers are applied to the web application to reduce the risk of script injection, clickjacking and similar attacks.
Data at rest in the hosting environment is encrypted by Google Cloud's default encryption.

Tenant isolation and access control

Row level tenant isolation: every record carries a workspace identifier, and every database query is filtered by the workspace of the authenticated user, as loaded from the database on each request rather than trusted from the client.
Role based access control with the roles admin, property manager, property owner and staff, enforced on the server for every request, with property owners limited to the properties linked to them.
Platform administrators are separated from customer workspaces and cannot use workspace functions.

Authentication and session security

Passwords are hashed with bcrypt and never stored in readable form; a password policy requires a minimum length and character mix.
Multi factor authentication is required for platform administrators.
Short lived access tokens, and refresh tokens that rotate on every use, with reuse detection that revokes the whole session if a used token is presented again; refresh tokens are kept in a Secure, HttpOnly cookie and stored on the server only as hashes.
Per account login lockout after repeated failures, together with rate limits on authentication and other sensitive endpoints.

Storage of receipts and files

Receipts and similar files are kept in private storage that is not publicly accessible, and are served only through signed URLs that expire after 10 minutes.

Logging and monitoring

An activity log records every change made in a workspace, including who made it and when, without recording personal data values such as contact details, guest details or free text.
Uptime monitoring with alerts when the Service is unavailable.

Backup and recovery

Daily database backups, kept for 14 days.
Daily snapshots of the server disk, which include those backups, kept for 14 days in Google Cloud multi regional storage within the United States.

Infrastructure and least privilege

The application runs under a dedicated, least privilege cloud service account with access limited to the storage resources it needs.
Production systems are hosted on Google Cloud, which maintains physical and environmental security for its data centres.

Secure development

Automated dependency vulnerability scanning in the continuous integration pipeline.
Secure code review of changes, with regression tests written for every security fix and run before each deployment.

Organisational measures

Access to production systems and Customer Personal Data is limited to authorised personnel who need it, bound by confidentiality obligations (see Section 6).
Subprocessors are bound by written data protection terms (see Section 8).
A documented process for handling and notifying Personal Data Breaches (see Section 12).

Annex 3: Subprocessors

Google Cloud (Google LLC, or the Google Cloud affiliate that contracts with KMT)

Service: hosting of the application, databases, file storage and backups.
Data: all categories of Customer Personal Data.
Location: United States (Iowa region for primary hosting; multi regional storage within the United States for disk snapshots).
Duration: for the term of the Terms and until deletion under Section 14.

Google Workspace (Google LLC, or the Google affiliate that contracts with KMT)

Service: sending transactional emails, such as invitations, password resets, reminders and notifications, and operating the support mailbox.
Data: recipient names and email addresses, the content of emails, which may include booking, task or message details, and messages sent to the support mailbox.
Location: United States and other locations where Google operates.
Duration: for the term of the Terms; messages in the support mailbox are retained according to its retention settings.

Google Firebase Cloud Messaging (Google LLC)

Service: delivering push notifications to devices of Authorised Users who have allowed them.
Data: device tokens and notification content, which may include short descriptions of bookings, tasks or messages.
Location: United States and other locations where Google operates.
Duration: for the term of the Terms.

Stripe (Stripe, Inc., or the Stripe affiliate that contracts with KMT)

Service: processing subscription payments for the Service.
Data: billing details of the Customer and its billing contacts. Stripe does not receive renter, guest, owner, staff or contractor data from the Service; it is listed for transparency, as most of the data it processes is Account Data for which KMT is controller and Stripe acts partly as an independent controller.
Location: United States and other locations where Stripe operates.
Duration: for the term of the Terms and as required by financial regulations.

Cloudflare Turnstile (Cloudflare, Inc.), only if enabled

Service: protecting sign in, registration and password reset pages against automated abuse.
Data: technical browser signals and IP addresses of users of those pages.
Location: Cloudflare's global network.
Duration: for the term of the Terms, while enabled.

Sentry (Functional Software, Inc.), only if enabled

Service: error monitoring of the application.
Data: technical error information, configured to remove secrets, request bodies, local variables and query strings; incidental personal data may remain in limited cases.
Location: United States, or the European Union if an EU data region is selected.
Duration: for the term of the Terms, while enabled; error data kept for up to 90 days.

Anthropic (Anthropic, PBC), only while the Customer's Workspace uses contract import or the assistant

Service: reading contracts uploaded by Authorised Users to prepare records for their review, and answering questions asked to the assistant from the Workspace's records.
Data: the content of uploaded contracts, which may include names, contact details and identification numbers of renters, owners and other parties; questions, answers and the Workspace records looked up to answer them.
Location: United States.
Duration: for the term of the Terms, while the features are used; Anthropic keeps inputs and outputs only for a limited period for safety and abuse monitoring and does not use them to train its models. A Workspace admin can switch the features off at any time.

Cookies neste site