Data Processing Agreement

DRAFT - not legally reviewed, not executed. This template must be reviewed by qualified counsel and signed by both parties before it is relied upon. It is provided so the processing relationship is documented and reviewable, not as binding legal text.

This document is available in English only. The English text is the authoritative version; any translation is provided for convenience and does not govern.

Version 2026-08-14

This Data Processing Agreement ("DPA") forms part of the agreement between the company using MontagemHub (the Controller) and the operator of MontagemHub (the Processor) for the processing of personal data under Regulation (EU) 2016/679 (GDPR).

1. Subject matter and duration

The Processor processes personal data on the Controller's behalf for as long as the Controller uses the service, and for the retention periods set out in the Privacy Policy.

2. Nature and purpose

Processing is limited to hosting and operating the Controller's real-estate management data (properties, leases, invoices, partners, and the accounts of the Controller's users) so the Controller can use the service.

3. Categories of data and data subjects

Contact and identification data of the Controller's team members and business partners, and the business records the Controller enters. No special-category data is required by the service.

4. Processor obligations

Process personal data only on the Controller's documented instructions.
Ensure persons authorised to process the data are bound by confidentiality.
Implement appropriate technical and organisational measures (GDPR Art. 32): tenant isolation, encryption of secrets, access control, audit logging, and backups.
Assist the Controller in responding to data-subject requests (access, export, erasure).
Notify the Controller without undue delay after becoming aware of a personal-data breach.
At the end of the service, delete or return the personal data, subject to retention the law requires (for example invoices).

5. Sub-processors

The Processor may engage sub-processors (for example a hosting provider or an email-delivery provider) under a written agreement imposing equivalent obligations. The current list is provided on request; the deployment platform is not yet finalised.

6. International transfers

Personal data is processed within the EU. Any transfer outside the EU would rely on an approved transfer mechanism.

7. Audit

The Processor makes available information necessary to demonstrate compliance and allows for audits by the Controller or a mandated auditor, on reasonable notice.

8. Duration and termination

This DPA lasts as long as the Processor processes personal data on the Controller's behalf. On termination, the Processor deletes or returns the personal data per clause 4, subject to retention the law requires.

9. Liability

Each party's liability under this DPA is subject to the limitations agreed in the underlying service agreement, to the extent permitted by the GDPR and applicable law.

Signatures

To be completed on execution - this draft is not signed.