Data Processing Agreement

Last updated: 30 October 2026

1. Parties and roles

This DPA forms part of the Terms between Optimind SLU (“Processor”, Madrid, Spain, ESB16497422), operating Stanosfera, and the property manager (“Controller”) using the platform. The Controller determines the purposes and means of processing tenant personal data; the Processor processes it on the Controller’s instructions.

2. Definitions

“Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, “Sub-processor”, “Supervisory Authority” and “GDPR” have the meanings given in Regulation (EU) 2016/679.

3. Scope, nature and purpose

The Processor provides property-management software: hosting, storage, tenancy and payment records, documents, communications, identity verification (where enabled), e-signature and related support. Processing is carried out for the duration of the agreement.

4. Data types and data subjects

• Data subjects: current, former and prospective tenants; property managers and their staff.
• Data: identification and contact data, tenancy and property data, financial and payment data, documents, communications, KYC data where enabled, signatures and technical logs.

5. Processor obligations

The Processor shall process only on documented instructions; ensure confidentiality; implement appropriate technical and organisational measures; assist with data-subject requests and impact assessments; notify breaches without undue delay; and delete or return data at the end of the agreement.

6. Sub-processors

The Controller authorises the following sub-processors: Supabase (database and authentication), Vercel (hosting), Resend (email), Stripe (payments), Didit (identity verification), YouSign (e-signature), KILT (blockchain identity) and Forgejo (content management). The Processor will give notice of changes and allow objection on reasonable grounds.

7. International transfers

Transfers outside the EEA rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

8. Security

Measures include encryption in transit, access control, row-level security, audit logging, least-privilege credentials, backups and incident response.

9. Breach notification

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach, with the information needed to meet GDPR Articles 33 and 34.

10. Assistance and audits

The Processor will provide reasonable assistance for data-subject requests, DPIAs and consultations. Audits are available on reasonable notice, subject to confidentiality and security.

11. Deletion and return

On termination, the Processor will delete or return personal data as instructed, subject to legal retention obligations, and delete residual copies from backups within the backup cycle.

12. Liability and governing law

Liability is subject to the Terms. This DPA is governed by Spanish law; the courts of Madrid have jurisdiction.

Annex A — Technical and organisational measures

Access control, encryption, logging, vulnerability management, secure development, incident response, backup and restore, vendor management, and role-based permissions.