Data processing agreement

Processor: Ofimática Digital Soluciones, S.L.U. (SyncroRent), tax ID (NIF) B75604488, Avenida de la Libertad, 19, 03610 Petrer (Alicante), Spain, registered with the Alicante Commercial Registry (Registro Mercantil de Alicante), sheet A-195763, 1st entry · hola@syncrorent.app.

Controller: the letting agency that accepts this agreement, with the details provided when signing up.

For applicants who end up signing up, SyncroRent is the controller of its relationship with them under its privacy policy.

The letting agency (controller) entrusts SyncroRent (processor) with processing the contact details of the applicants it receives from property portals, for the sole purpose of inviting them, on behalf of the agency, to prepare their GoldPass and, if they authorise it, returning their certified solvency to the agency.

Whatever appears in the forwarded email: name, phone number, email address where available, the person’s message, and the property reference and price. No special categories of data are processed.

SyncroRent processes the data only in accordance with these documented instructions: extracting the contact details from the email, showing them in the agency’s dashboard and, when the agency requests it from its dashboard, sending the person an invitation by email or by WhatsApp from SyncroRent’s number, identifying the agency as the sender. Only one invitation is sent per applicant, and never to anyone who has asked not to receive further messages. If SyncroRent considers that any instruction breaches data protection law, it will say so immediately.

The contact details of anyone who does not sign up are deleted 90 days after the email is received. Only the property reference, the portal and the generated link are kept, which identify nobody. If the person signs up, from that moment SyncroRent is the controller of its relationship with them, under its privacy policy.

SyncroRent ensures that the persons authorised to process this data have committed themselves to confidentiality, expressly and in writing.

The technical and organisational measures of art. 32 GDPR apply: encryption in transit and at rest, role-based access control, audit logging and backups.

SyncroRent uses the following sub-processors, under a processing contract and with equivalent safeguards: Supabase (database, Ireland), Vercel (hosting, USA), Railway (reading the forwarding mailbox, EU or USA), Google (automated reading of the email with Gemini, USA), IONOS (email, EU) and Meta Platforms Ireland (WhatsApp Business, EU and USA). Transfers to the USA rely on the EU-US Data Privacy Framework or on standard contractual clauses. Any addition or removal will be notified in advance, with a right to object.

SyncroRent will help the agency respond to requests for access, rectification, erasure, restriction, portability and objection. If the person contacts SyncroRent directly, the request will be handled and the agency informed.

SyncroRent will notify the agency without undue delay, and in any case within 24 hours of becoming aware of it, of any security breach affecting this data.

When the relationship ends, SyncroRent will delete the data processed on behalf of the agency, except for any it must keep by law, which will be duly blocked.

SyncroRent will make available to the agency the information needed to demonstrate compliance with these obligations and will allow audits, including inspections.