Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Tenants10 Terms of Service and applies automatically whenever you ("Customer") use the Tenants10 Service to process personal data of your own occupants, tenants, staff, or other individuals ("Occupant Data") on Tenants10's platform. It is intended to meet the requirements of Art. 9 of the Swiss Federal Act on Data Protection and, where applicable, Art. 28 GDPR.

1. Roles

The Customer is the controller of Occupant Data. Tenants10 KlG is the processor, acting only on the Customer's documented instructions as given through the Service's normal configuration and use (e.g. which modules are enabled, who the Customer invites, what data the Customer enters).

2. Subject matter, nature & purpose

Tenants10 processes Occupant Data to provide the property/facility-management functions the Customer configures: tenancy and lease administration, rent and payment tracking, maintenance and work order management, compliance/inspection tracking, in-app messaging, document storage, and related AI-assisted features (document extraction, translation, and in-app assistants), for the duration of the Customer's subscription.

3. Categories of data & data subjects

Occupant Data may include: name, contact details, lease and payment records, maintenance requests, messages, and documents relating to the Customer's tenants, occupants, and building contacts. It does not include special categories of personal data (e.g. health data) unless the Customer chooses to upload such content, which the Customer warrants it has a lawful basis to do.

4. Sub-processors

The Customer authorises Tenants10 to engage the sub-processors listed in Section 8 of the Privacy Policy (as updated from time to time) to provide the Service. Tenants10 remains responsible for each sub-processor's compliance with data-protection obligations equivalent to those in this DPA, and will give the Customer reasonable notice of any new sub-processor that processes Occupant Data, so the Customer may object on reasonable data-protection grounds.

5. Security measures

Tenants10 maintains technical and organisational measures appropriate to the risk, including: encryption of data in transit; role-based and building-scoped access control within the platform; audit logging of administrative actions; hosting of core infrastructure in Microsoft Azure's Switzerland North region; and regular review of sub-processor security practices.

6. Confidentiality

Tenants10 ensures that personnel authorised to process Occupant Data are bound by an appropriate duty of confidentiality.

7. Assistance to the Customer

Taking into account the nature of the processing, Tenants10 will reasonably assist the Customer in responding to data subject requests (access, correction, deletion, export) raised by the Customer's own occupants/tenants, and in meeting any applicable data-protection impact assessment or breach-notification obligations relating to Occupant Data, insofar as the required information is available to Tenants10.

8. Personal data breach notification

Tenants10 will notify the Customer without undue delay after becoming aware of a personal data breach affecting that Customer's Occupant Data, and will provide available information to help the Customer meet its own notification obligations.

9. Return & deletion of data

On termination of the Customer's subscription, Tenants10 will make Occupant Data available for export for a reasonable period, and will then delete or anonymise it, except where Tenants10 is required by applicable law (such as Swiss financial record-keeping rules) to retain certain records for longer.

10. International transfers

Where Occupant Data is transferred outside Switzerland or the EEA by a sub-processor listed under Section 8 of the Privacy Policy, that transfer is made under standard contractual clauses and/or the EU–US / Swiss–US Data Privacy Framework, as applicable to that provider.

11. Audit

On reasonable written request, and no more than once per year absent a specific incident, Tenants10 will provide the Customer with available information demonstrating compliance with this DPA, such as a summary of security measures or relevant sub-processor certifications.

12. Precedence & contact

In the event of a conflict between this DPA and the Terms of Service regarding the processing of Occupant Data, this DPA prevails. For a signed/countersigned version of this DPA for your own records, or questions about a specific engagement (such as a larger facility-management customer with its own data-protection office), contact support@tenants10.com .