Data Processing Agreement

Parties and roles

The customer is the controller for customer-controlled property management records. n-Objects acts as processor where it processes personal data on behalf of the customer to provide the platform. For account administration, billing, security, and direct website use, n-Objects may act as controller.

Subject matter, nature, and purpose

• Hosting and operating the n-Objects platform.
• Providing authentication, document storage, property management workflows, notifications, support, and optional AI assistant features.
• Maintaining security, troubleshooting, backups, and service reliability.

Categories of data subjects

• Customer users and administrators.
• Tenants, owners, contacts, suppliers, management companies, assignees, and other persons entered by customer users.
• Email recipients and persons named in uploaded documents, events, tasks, contracts, or AI prompts.

Categories of personal data

• Identity and contact data, address data, company data, role and assignment data.
• Contract, event, task, calendar, property, building, location, meter reading, document, and communication data.
• Payment reference data such as account holder, IBAN, BIC, and related validity dates.
• Technical identifiers, logs, authentication metadata, and security events.
• AI prompts, responses, action drafts, tool-run summaries, and optional audio transcription data.

Processor obligations

• Process customer personal data only on documented customer instructions unless legally required otherwise.
• Use personnel subject to confidentiality obligations.
• Maintain appropriate technical and organizational measures.
• Assist the customer with data subject requests, deletion, export, breach handling, and data protection impact assessments where required.
• Delete or return customer personal data after termination according to the customer agreement and legal retention duties.

Subprocessors

The customer authorizes n-Objects to use subprocessors needed to provide the service, subject to suitable data protection commitments and transfer safeguards where required.

• Supabase
• Vercel
• Database hosting providers used by the production deployment
• Resend
• OpenAI
• Google and Microsoft identity services, where selected by users
• Google Maps, where map features are used
• OpenStreetMap Nominatim, where address search is used

Technical and organizational measures

• Role-based access and authenticated sessions.
• Transport encryption for application traffic.
• Database and storage access controls.
• Signed URLs or equivalent controls for document access where applicable.
• Logging, monitoring, backup, and recovery controls.
• Separation of customer data by application permissions and database relationships.
• Least-privilege operational access for support and maintenance.

International transfers

Where subprocessors process personal data outside the EEA, n-Objects will use appropriate transfer mechanisms such as adequacy decisions, EU Standard Contractual Clauses, and supplementary safeguards where required.