OwnerstatData processing agreement
The agreement is made between the management company (controller) and Max M Company Limited (processor) under Article 28 GDPR and runs for as long as the Ownerstat services agreement.
Subject matter and data
- Purpose: owner statements, expenses and invoices, booking calendar and sync, direct bookings and guest pages, cleaning and tasks, storage of documents and photos.
- Data subjects: owners, management company staff, guests, cleaners and contractors.
- Data: names and contacts; property and DMoT registration details; bookings, payouts and deposits; guest requests with IP address; check-in details (door code, Wi-Fi); expenses, invoices, the owner's billing address and tax number, last 4 digits of IBAN; photos, receipts and documents; sign-in and activity logs.
- No special categories of data are processed.
Processor obligations
- Process data only on documented instructions of the controller (settings and actions in the portal are instructions too) and only for the purpose of the agreement.
- Ensure confidentiality: access only for people who need it for the work and are bound by confidentiality.
- Apply security measures: EU server, HTTPS, one-time-code sign-in, roles and access separation, activity log, daily backups, security updates, retention periods with automatic deletion.
- Use only the sub-processors listed below, under contracts with the same obligations, and give at least 30 days' notice of changes; the controller may object.
- Assist the controller with data subject requests: the portal provides export and erasure of owner data.
- Notify a personal data breach without undue delay and no later than 48 hours after discovery, with a description and the measures taken.
- At the end of the agreement return the data (export) and delete it within 30 days unless the law requires retention; backups are overwritten within 14 days.
- Make available the information needed to demonstrate compliance and allow audits on reasonable prior notice.
Retention
| What | How long |
|---|---|
| Portal data: properties, statements, expenses, documents, photos | While the contract with the management company lasts; deleted within 30 days after it ends |
| Statements, invoices and the bookings in them | As long as the management company keeps them for its accounts (in Cyprus usually 6 years) |
| Booking request that did not become a stay | 180 days after the requested dates, then the name and contacts are deleted |
| Contacts of a direct-booking guest | 2 years after check-out, then deleted; dates and amounts stay in the statement |
| IP address of a booking request | 180 days |
| Guest page (door code, Wi-Fi) | The link is deleted 30 days after check-out |
| Guest names in the booking calendar | 90 days after check-out |
| Ownerstat chat conversations | 12 months after the last message; IP address 180 days |
| Addresses for business emails | 12 months after the last email; an opt-out is kept so we never write again |
| Sign-in codes and links | 30 days |
| Portal activity log | 3 years |
| Server log | 30 days |
| Backups | Overwritten after 14 days |
Sub-processors
| Who | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | Server hosting, files and backups | Germany, EU |
| Google Ireland Limited (Google Workspace) | Sending email: sign-in codes, notifications, statements, guest emails | EU; transfers to the US possible under the EU Standard Contractual Clauses |
This text will be refined after legal review. The English version prevails over translations.