Data Processing Terms

These Data Processing Terms (“DPT”) are between you (the “Customer”) and Natanzi Group Ltd, a company registered in England and Wales, trading as MyRentals360 (“we”, “us”). They form part of, and are incorporated into, our Terms of Service (the “Terms”), which you accept when you create an account and use the service. There is no separate signature process; acceptance of the Terms constitutes acceptance of this DPT.

Where this DPT conflicts with the Terms specifically in relation to the processing of personal data covered by it, this DPT prevails. In all other respects the Terms apply. Terms defined in UK data protection law (including the UK GDPR and the Data Protection Act 2018) have the same meaning here.

Where you upload or enter personal information about other individuals, you act as controller and we act as processor for that information. We are controller for our own account, billing, support and security information, which is covered by the Privacy Policy. The correct characterisation in a particular case depends on the facts; take your own advice if you need certainty for your compliance records.

• Subject matter: provision of the MyRentals360 property management software service.
• Duration: for as long as your account is active, plus any short period needed to complete deletion or to meet a legal retention requirement.
• Nature and purpose: hosting, storage, organisation, retrieval, display, reminder generation, export and deletion of the records you enter, so that we can provide the service to you.

• Types of personal data: names, contact details, tenancy and occupancy details, rent and payment records you enter, compliance records, tasks and notes, and the contents of documents you upload.
• Categories of data subjects: your tenants, occupants, guarantors, contractors and other contacts you choose to record.
• You control what you enter. Do not upload special category data or criminal offence data unless you have established an appropriate lawful basis and condition for doing so.

We will:

• process personal data only on your documented instructions, which are given through your configured use of the service's features and any written instructions you send us, unless we are required to process it by law (in which case we will tell you first, unless the law prohibits it);
• tell you if, in our opinion, an instruction infringes UK data protection law;
• implement appropriate technical and organisational measures as described in section 7;
• not engage a subprocessor except as set out in section 8;
• assist you as described in sections 10 and 11;
• make available information reasonably necessary to demonstrate compliance with these terms, as described in section 13; and
• delete or return personal data at the end of the service as described in section 12.

People authorised by us to process personal data are subject to a duty of confidentiality, and access is limited to what is necessary to operate, secure and support the service.

We implement technical and organisational measures appropriate to the risk. At a level appropriate to describe publicly, these include per-account database access controls so an account can only reach its own records, private document storage accessible only through short-lived signed links issued to the owning account, authentication on all application areas containing customer data, server-side handling of secrets and payment credentials, and encryption in transit.

We do not claim certifications, formal external audits or penetration testing, because none are currently in place. No online service can be guaranteed completely secure.

You give us general written authorisation to engage subprocessors. The subprocessors we currently use, and what each does, are listed on our Subprocessors page, which we maintain.

We aim to give at least 30 days' notice before a new subprocessor begins processing customer personal data, by updating that page and, where the change is material, notifying account holders. You may raise a legitimate data protection objection to a new subprocessor by writing to support@myrentals360.co.uk. We will consider it in good faith and try to offer a reasonable alternative; if we cannot, your remedy is to terminate the affected subscription. This is not an absolute veto over providers that are integral to the service. We impose data protection obligations on our subprocessors and remain responsible to you for their processing.

Our database, authentication and document storage run in the AWS eu-central-1 region (Frankfurt, Germany). Other providers involved in payments, hosting, email, error reporting, content delivery and fonts may process personal data outside the UK. Where a transfer outside the UK takes place, an appropriate safeguard recognised under UK data protection law must be in place.

We do not state a specific transfer mechanism for each provider here, because that detail comes from provider documentation and contracts rather than from our own systems. If you need it for your records, contact us and we will point you to the relevant provider terms.

The service lets you access, correct, export and delete records yourself. Taking into account the nature of the processing, we will provide reasonable assistance with data subject requests you receive that relate to personal data we process for you. If a data subject contacts us directly about information you control, we will refer them to you where appropriate.

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and provide the information reasonably available to us to help you meet your own notification duties.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultation with the Information Commissioner's Office, where these are required of you and relate to this processing.

You can delete or archive records at any time within the service, and you can delete your account from Settings → Privacy & Data. Account deletion removes your account records and your uploaded document files from the active service.

Two practical limits apply, and we would rather state them plainly:

• The in-app export produces structured data about your records, including document details, but not the contents of the uploaded files. Download the files you need from the Documents area before closing your account.
• We cannot delete records that our payment provider retains independently for its own legal and financial purposes, or edit routine infrastructure backups operated by our providers, which age out on their own schedules. We also retain information where the law requires it.

We retain a minimal internal record of an account deletion for audit and security purposes, containing only an internal identifier, timestamps, the outcome and cleanup counts — no names, contact details or customer content.

On reasonable written request, and no more than once in any 12-month period unless a regulator requires otherwise or following a personal data breach, we will make available the information reasonably necessary to demonstrate compliance with these terms. Where an audit is genuinely required, it will be at your cost, on reasonable notice, during business hours, subject to confidentiality, and conducted so as not to disrupt the service or affect other customers' security. We may satisfy an audit request by providing existing documentation from us or our subprocessors.

The limitations and exclusions of liability in the Terms apply to this DPT, to the extent permitted by law. This DPT is governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction, consistent with the Terms.

Data protection queries: support@myrentals360.co.uk.