Skip to Content

Data processing annex

Last update: 13 October 2026

Purpose and parties

This annex forms part of the Spot on Loc subscription contract between A Zesty Solution SRL, Rue Prairie Coppée 23, 7110 La Louvière, Belgium (company number 1017434384), the "processor", and each subscribed lessor, the "controller". This contract is governed by Part B of the general terms of A Zesty Solution (https://www.azestysolution.com/terms).

It is the contract required by article 28 of the General Data Protection Regulation (GDPR). For data protection, it prevails over the other contract documents.

Duration

The annex applies for the whole duration of the subscription, then until the deletion of the lessor's data provided in the section "End of the contract".

Nature and purposes of the processing

The processor hosts the Spot on Loc platform and processes the lessor's data only to provide the service to the lessor:

  • management of units, leases, indexation, rents, rental deposits and inventories of fixtures;
  • sending the platform's emails in the name of the lessor (rent calls, reminders, documents) and receiving the replies;
  • tenant portal;
  • publication of units on the marketplace of spotonloc.com and receipt of rental requests;
  • bank reconciliation, if the lessor has linked its accounts with its own bank connection;
  • migration and set-up, support, backups and security.

The operations are: collection through the forms, recording, organisation, storage, consultation by support, transmission by email, publication of listings, export and erasure.

Data subjects

  • The lessor and its users.
  • Tenants and co-tenants.
  • Candidates who send a rental request.
  • Guarantors and the other persons the lessor enters (for example its suppliers or contact persons).

Categories of data

  • Identification: name, title, civil status, date and place of birth, language.
  • Contact details: address, email, phone.
  • Lease: rented unit, dates, rent, charges, indexation, type and amount of the rental deposit, inventory of fixtures.
  • Financial data: invoices, payments, reminders; bank transactions (counterparty name, IBAN, reference) if the lessor uses the bank connection.
  • Documents and messages: documents added by the lessor or the tenant (for example proof of income or an identity document), emails and requests exchanged.
  • Account: username, password kept in protected form, login dates; IP addresses in the server logs.

The platform is not designed for sensitive data within the meaning of article 9 of the GDPR. The lessor does not enter such data without a legal basis.

Instructions of the lessor

The processor processes the data only on documented instructions of the lessor. The instructions are: the subscription contract and this annex, the lessor's settings and actions in the platform, and its written requests (email or support ticket).

If an instruction seems to infringe the GDPR, the processor informs the lessor without delay. If European Union or Belgian law requires it to process data, it informs the lessor before the processing, unless the law forbids it.

Obligations of the processor

  • Confidentiality: only the persons authorised by the processor access the data, and they are bound to confidentiality.
  • Support access: only at the lessor's request, for the migration and set-up, to solve an incident or when the law requires it. Each access is recorded with its date, the person and the reason.
  • The processor does not use the data for its own purposes, does not sell it and does not disclose it to third parties, except to the sub-processors listed below or when the law requires it.
  • It keeps the record of the processing carried out on behalf of the lessors (article 30.2 of the GDPR).
  • It informs the lessor of any request from an authority concerning its data, unless the law forbids it.

Sub-processors

The lessor authorises the following sub-processors:

  • Contabo GmbH: hosting of the platform's server, in the European Union.
  • Hetzner Online GmbH: storage of the backups, encrypted before they are sent, in the European Union.
  • Zoho Corporation B.V. (Amsterdam, the Netherlands): sending and receiving the platform's emails; data centres in the Netherlands and Ireland.

The following are not sub-processors of the processor:

  • Enable Banking Oy: a lessor who uses the bank connection registers its own application with this provider, under a contract it concludes itself; the platform only hosts the connector.
  • The vendor of the platform's base software: the platform is installed on the processor's server and the lessor's data is not hosted by that vendor.

The processor informs the lessor by email at least 30 days before adding or replacing a sub-processor. The lessor may object for a reason related to data protection. If no solution is found, it may cancel its subscription free of charge before the change. The processor imposes on its sub-processors data protection obligations equivalent to those of this annex and remains liable for their compliance.

Transfers outside the European Union

The data is hosted and processed in the European Union. The processor does not transfer it outside the European Union. If a transfer became necessary, it would inform the lessor in advance and rely on the safeguards of chapter V of the GDPR.

Security measures

The processor applies the following measures. It holds no security certification.

  • Encrypted connections: the website, the management space and the portal are available over HTTPS only; exchanges with the mail server are encrypted.
  • Separation of lessors: each lessor is a separate company in the database; access rules limit its users to the data of its company.
  • Access control: personal accounts; passwords kept in protected form; the lessors' users have no administration rights; the server is administered by SSH key only.
  • Backups: one backup per day, encrypted before it is sent to another provider; 7 daily, 4 weekly and 4 monthly backups kept; documented restore procedure.
  • Updates: updates are first installed on a test environment, on the same server, built from a copy of the production data in which sending emails and bank connections are turned off.
  • Logs: the server records connections and requests, for security and to solve incidents.

The processor reviews these measures when the platform or the risks change.

Assistance to the lessor

  • Data subject rights: the processor forwards to the lessor, within 5 working days, any request to exercise rights that it receives about the lessor's data. The platform lets the lessor consult, correct, export and delete the data. The processor helps the lessor to answer when the platform is not enough.
  • Security, impact assessments and consultation of the authority: the processor gives the lessor the information it has.

Data breach

The processor informs the lessor without undue delay, and at the latest 48 hours after becoming aware of it, of any data breach concerning the lessor. It gives the information listed in article 33.3 of the GDPR as soon as it has it: nature of the breach, categories and approximate number of people and records concerned, likely consequences, measures taken or proposed. It takes the measures needed to limit the effects of the breach. Notifying the Data Protection Authority and the people concerned is the lessor's task, which has 72 hours for this from the moment it becomes aware of the breach.

End of the contract

When the subscription is closed, the lessor's space is suspended and its data is kept for 6 months. During that period, the lessor can export its data or request a full export. Then the processor deletes it from the platform; backup copies are erased as they rotate, at the latest 4 months later. The processor confirms the deletion in writing on request. These rules do not apply to data that European Union or Belgian law requires it to keep.

Audits

The processor makes available to the lessor the information needed to demonstrate compliance with this annex. The lessor may have an audit carried out, by itself or by an auditor bound to confidentiality, with 30 days' notice, at most once a year except after a data breach, at its own cost. The audit starts with a written questionnaire. It gives no access to the data of other lessors.

Liability

Each party is liable for its obligations under article 82 of the GDPR and under the subscription contract.

Contact

For any question about this annex, write to contact@spotonloc.com. The processor has not appointed a data protection officer: this address is the point of contact.