Table of contents

Personal Data Processing Agreement

(Annex No. 1 to the Terms of Service of the Rent2End Platform)

Parties to the Agreement

  1. The Personal Data Controller (hereinafter: “Controller”) is the User of the Rent2End service – an owner, tenant, or other entity that entrusts Rent2End with personal data processing within the scope of using the service.
  2. The Processor (hereinafter: “Processor”) is Robert Zdanowski, owner of the Rent2End brand, with its registered office in Wrocław, ul. Stanisława Drabika 38 lok. 24, 52-131 Wrocław, Poland, NIP: 8992843940, REGON: 380004584.
  3. This Agreement is concluded upon acceptance of the Rent2End Terms of Service by the User. This Agreement replaces all prior agreements between the parties in this regard.

§2. Subject Matter of Entrustment

  1. The Controller entrusts the Processor with the processing of personal data to the extent necessary to use the services of the Rent2End platform.
  2. Processed data include in particular: identification and contact data of contract parties (first name, last name, address, PESEL, series and number of identity document, email address, phone number), financial and billing data (rent amount, security deposit, bank account number, payment schedule, additional fees information), property data (address, area, technical condition, equipment), contract content and execution data (validity period, termination conditions, addenda, defect reports, photographic documentation), and other data provided by the Controller within the scope of using Rent2End services.
  3. Categories of data subjects: Third parties whose data are entered into the system by the Controller to carry out lease-related processes, specifically: tenants, prospective tenants, roommates, guarantors, and proxies.

§3. Purpose and Scope of Processing

  1. Personal data shall be processed solely for the purpose and duration of providing the services defined in the Rent2End Terms of Service, on the documented instructions of the Controller.
  2. Processing includes operations in IT systems such as: collecting, recording, organizing, structuring, storing, viewing, using, disclosing (solely upon explicit instruction or through functionalities initiated by the Controller), and generating documents (e.g., agreements in PDF format).

§4. Duration of Agreement

This Agreement remains in force for the duration of the agreement for the provision of services within the Rent2End platform (the period of maintaining an active account).

§5. Obligations of the Processor

The Processor undertakes to:

  1. process data solely on documented instructions from the Controller (unless required to do so by Union or Member State law to which the Processor is subject),
  2. ensure that persons authorized to process data have committed themselves to confidentiality,
  3. apply appropriate technical and organizational measures to ensure data security in accordance with Article 32 of the GDPR,
  4. notify the Controller without undue delay, and no later than within 36 hours of detection, of any confirmed personal data protection breach involving entrusted data,
  5. assist the Controller, insofar as possible, in fulfilling obligations to respond to data subjects’ requests and other obligations under Articles 32-36 of the GDPR,
  6. delete or return data after completion of service provision, in accordance with §6 of this Agreement.

§6. Data Erasure

  1. Upon expiration or termination of the agreement for the provision of Rent2End services, the Processor shall delete all personal data entrusted under this Agreement within 30 days, unless applicable statutory provisions (e.g., tax, accounting) require further storage of part of these data.
  2. During the period specified in paragraph 1, the Controller has the technical capability to export data from the Rent2End platform using dedicated tools built into the platform.

§7. Sub-processing of Data

  1. The Processor may entrust data processing to further sub-processors, in particular IT service, hosting, accounting, or legal advice providers.
  2. Currently, the Processor uses Amazon Web Services (AWS) for data hosting within the European Union.
  3. The Processor shall inform the Controller of any intended addition or replacement of sub-processors at least 14 days in advance via email or notice in the system panel. If the Controller submits a justified objection to this change within 14 days, and the parties fail to reach an agreement through negotiations, the Controller has the right to terminate the agreement for Rent2End service provision with immediate effect. Until contract termination, the Processor is entitled to process data using the existing infrastructure or suspend the provision of the specific functionality for that Controller.
  4. Sub-entrusting data to other entities requires concluding an agreement guaranteeing data protection standards in accordance with the GDPR.

§8. Rights and Obligations of the Controller

  1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.
  2. The primary form of compliance verification by the Controller is the inspection of certificates, independent audit reports, and compliance statements made available by the Processor.
  3. In justified cases, where the provided materials are insufficient, the Controller has the right to conduct an audit or inspection at the Processor’s registered office at their own expense, following prior agreement on the date (minimum 30 days prior to the planned audit), agreement on the scope of the audit, and execution of a confidentiality agreement by auditors regarding other data processed by Rent2End.

§9. Liability of the Parties

  1. Each party shall be liable for damage caused to the other party as a result of breaching the provisions of this Agreement or GDPR rules under the general principles of the Civil Code and the GDPR.
  2. The Processor’s aggregate indemnity liability towards the Controller for breach of this Agreement (excluding intentionally caused damage) shall be limited to an amount equal to the total subscription fees paid by the Controller to the Processor during the 6 months preceding the damage-causing event.

§10. Final Provisions

  1. The Agreement constitutes Annex No. 1 to the Rent2End Terms of Service.
  2. The Agreement is governed by Polish law.
  3. Any disputes arising from the implementation of the Agreement shall be settled by the court having jurisdiction over the Processor’s registered office.