Data processing agreement

The controller within the meaning of Art. 4(7) GDPR is the provider, that is the office using Athaus. The processor within the meaning of Art. 4(8) GDPR is Andrual Technologies UG (haftungsbeschränkt), Torstrasse 166, 10115 Berlin (Athaus).

This agreement covers all personal data of third parties that the provider processes or has processed in Athaus (no. 3). For what Athaus processes in its own name, such as the user account, billing and the search on athaus.ai, Athaus is the controller itself; that is set out in the privacy policy.

The subject is running the Athaus software for the provider: storing, organising, displaying, searching, sending and deleting the data under no. 3, importing from files and other systems, writing back to a connected system, drafting texts and reading documents with language models. The purpose is marketing the provider's properties and maintaining their contacts.

The agreement runs for as long as the provider's office exists at Athaus. Separate cancellation is neither possible nor necessary.

Data subjects are:

• interested parties, buyers and tenants, with or without an account with Athaus,
• owners, sellers, landlords and their representatives,
• all further contacts the provider adds, imports from a file or takes over from another system,
• people who get in touch through the provider's website,
• people who write to an email mailbox the provider connects with Athaus, or receive mail from it.

Processed are:

• name, email address, phone number, postal address, language,
• messages, enquiries, notes, appointments and their history,
• details from a tenant self-disclosure where the provider requests one, such as occupation, income, household size and move-in date,
• search wishes, documents and files uploaded by the provider or the data subject,
• consents and their withdrawal, the origin of a contact,
• property details insofar as they relate to a person.

Special categories of personal data (Art. 9 GDPR) are not intended. If the provider uploads them nevertheless, they need their own legal basis.

Athaus processes the data solely on documented instructions from the provider, including for a transfer to a third country, unless Union or German law requires otherwise; Athaus then informs in advance where the law permits. Instructions are this agreement, the terms of service and everything the provider sets or triggers in the service. Further instructions are given in text form to kontakt@athaus.ai.

If Athaus considers an instruction unlawful, Athaus informs the provider without delay and may suspend execution until the provider confirms it.

Every person at Athaus with access to this data is bound to confidentiality and has been informed of the relevant obligations. Athaus accesses a provider's data only as far as needed for operation, debugging or a request from the provider.

Under Art. 32 GDPR Athaus maintains in particular:

• servers, database and uploaded files in the European Union (Google Cloud, region europe-west10, Berlin); Google Cloud disks stored encrypted,
• encryption in transit (TLS) for every connection from outside,
• separation of tenants: every query is bound to the office the data belongs to,
• credentials for third-party systems stored by the provider are held encrypted and decrypted only for the duration of a call,
• sign-in without a password, with a code by email or through Google; sessions only in protected cookies (HttpOnly, Secure),
• rate limits per account and per sender against abuse,
• daily database backups with limited retention,
• separation of production and test data,
• language models only through Google Vertex AI in its EU multi-region; under its terms Google does not use the data to train models.

Athaus adapts the measures to the state of the art without lowering the level of protection.

The provider consents to the use of the following sub-processors. Athaus binds each of them by contract to the same data protection obligations as itself (Art. 28(4) GDPR).

• Google Cloud EMEA Limited, Dublin, Ireland: servers, database and files in Berlin, language models through Vertex AI in the EU multi-region.
• Plus Five Five, Inc. (Resend), San Francisco, USA: sending email, for example to interested parties. Email logs are kept in the USA.
• Vercel Inc., Covina, USA: delivering the interface and passing requests between browser and server.
• Issoudun Pte. Ltd. (UserCheck), Singapore: checking whether the domain of an email address accepts mail when someone without an account sends an enquiry. Only the part after the @ is transmitted.

To check and locate addresses, Athaus queries public geo services (Nominatim of the OpenStreetMap Foundation, Photon by komoot, OpenPLZ). Only the address is sent, without a name or other details about a person.

Athaus gives notice of a new or replaced sub-processor in text form at least four weeks in advance. The provider may object for an important data protection reason; if no equivalent way of providing the service then remains, either side may terminate extraordinarily.

Where a sub-processor processes data in a country outside the European Union, this is based on an adequacy decision of the European Commission (for certified companies in the USA the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Where both are available, the standard contractual clauses apply in addition.

If the provider connects Athaus with their own accounts or services, Athaus transfers data there on their instructions: to their calendar at Google or Microsoft, to their email mailbox at Google (Athaus reads along there and sends a reply only on their click), to their CRM (such as onOffice or Propstack), to an AI application they connect through the Athaus interface. These are services of the provider and not sub-processors of Athaus; processing there is governed by the provider's contracts with their operators.

If a data subject approaches Athaus with a request under Art. 15 to 22 GDPR, Athaus forwards it to the provider without delay. Athaus supports the provider with appropriate measures in meeting these rights and in their obligations under Art. 32 to 36 GDPR, as far as processing at Athaus is concerned.

If a breach of the protection of this data becomes known, Athaus informs the provider without delay, at the latest 48 hours after becoming aware, and supplies the information they need for their notification under Art. 33 and 34 GDPR.

On request Athaus provides the provider with the information needed to demonstrate compliance with this agreement and allows audits by the provider or an auditor they appoint. On-site audits take place after notice, during usual business hours and without disrupting operations.

If the provider closes their office, Athaus deletes the data processed on instructions unless a statutory retention obligation prevents this; on request Athaus hands it over beforehand. Backups expire after a few days.