Trust
GDPR, from the operator's side.
Draft. Not yet in force
This summary is a working draft, written to be reviewed rather than relied on. It has not been checked by a lawyer and does not bind anyone. It must not go live before legal review.
Who is who
For your tenants' personal data you are the controller and we are your processor. You decide what is collected and why. We process it on your instructions and for no other purpose. That is set out in the data processing agreement, which is part of your contract from the moment you open an account. You do not have to request it or sign anything separate.
For your own account data (your name, your colleagues' logins, your billing details) we are the controller, and the privacy policy covers it.
The questions your clients ask
Corporate and relocation clients increasingly ask these in writing before signing. Here are the answers.
- Where is the data? With the services named on the sub-processors page, each with where it is established and what it touches. A transfer out of the EU relies on Standard Contractual Clauses.
- Is it used for anything else? No. It is not sold, analysed for our own purposes or used to train machine-learning models.
- Who can see it? The people in your organisation you have given access to, at the role you gave them. Our staff do not browse customer data. Support access happens only on request, by exception.
- What happens at the end? Deleted or returned at your choice after the 90-day export window.
Subject requests
If a tenant asks you for a copy of their data, or asks you to delete it, that request is yours to answer, because you are the controller. We provide the means. Export gives you everything held about a person, and you can delete data yourself.
If a tenant writes to us instead, we will tell them we are a processor, point them to you and let you know. We will not act on a request about your data without your instruction.
Retention
Two rules pull in opposite directions. Data protection pushes toward deleting what you no longer need. Dutch fiscal law requires financial records to be kept for seven years, and tenancy records with money attached fall under it.
Two records are never pruned, because both are evidence. One is the log of automated email, since "did we send that?" gets asked about last year. The other is the record of each signing.
Breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, with what we know and what we are doing. Notifying the Autoriteit Persoonsgegevens and, where required, the people affected is your duty as controller. We give you what you need to do it within the 72 hours.
Contact
james@quarters.live. There is no formally appointed Data Protection Officer. At our size one is not required, and the address reaches someone who can answer.