Data processing agreement

1. Purpose and parties

This data processing agreement is entered into between the client — the natural or legal person on whose behalf a Homono workspace is opened — and ArtFinder SRL, Rue Jules Lejeune 38, 1050 Ixelles, Belgium, company number BE 0465.541.602 (“ArtFinder”), publisher of Homono.

It implements Article 28 of the General Data Protection Regulation (GDPR). It forms part of the contract between the client and ArtFinder, alongside the terms and conditions. In case of conflict on data protection, this agreement prevails.

For the data the client enters in its workspace, the client is the controller and ArtFinder is its processor. This agreement does not cover the data for which ArtFinder is itself responsible — each user's account and the commercial relationship —, described in the privacy policy.

2. Description of the processing

• Subject matter: providing the Homono property management software, hosted by ArtFinder, and the support that comes with it.
• Nature: hosting, storage, consultation, organisation, computation, document generation, sending messages at the client's request, reading documents and assistance by artificial intelligence, backup, erasure.
• Purposes: managing properties, leases, rents, service charges, payments, maintenance requests and communication with tenants, as the client conducts it in its workspace.
• Data subjects: tenants and prospective tenants, guarantors, occupants, owners, principals, service providers and suppliers, members of the client's team, and any other person the client enters.
• Categories of data: identity and contact details; lease and property data; rents, payments, balances and bank details; meter readings; maintenance requests, photos and messages; uploaded documents, including identity documents — and therefore, where it appears on them, the national register number —, bank documents, insurance contracts and invoices. Homono is not designed to process health data or other special categories; the client refrains from entering them except where the law allows.
• Duration: the term of the contract, then the time needed for the return and erasure provided for in section 11.

3. The client's instructions

ArtFinder processes the data only on documented instructions from the client. Those instructions are this agreement, the terms and conditions, and the settings and actions the client performs in its workspace. Any other instruction is given in writing, including by email.

ArtFinder informs the client without delay if, in its opinion, an instruction infringes the GDPR or another data protection rule. If the law requires it to process data otherwise, ArtFinder informs the client beforehand, unless that law prohibits it.

4. Confidentiality and access by the Homono team

The persons ArtFinder authorises to process the data are bound by confidentiality, by contract or by law.

An authorised member of the Homono team may access the client's workspace and act on behalf of a user, solely to assist the client, fix a problem or configure a service. This access is reserved to the platform operators.

5. Security

ArtFinder implements the technical and organisational measures described below, and adapts them as risks evolve without lowering their level:

• all communications are encrypted (HTTPS enforced);
• passwords are stored hashed and cannot be read back;
• credentials for connected services are encrypted in the database;
• each workspace is isolated: the application, and as a second line of defence the database, prevent one workspace from reading another's data;
• the database is backed up daily, to separate storage; each copy is kept for a limited period, then erased;
• the browser is instructed not to load any resource from outside Homono and its storage.

The client remains responsible for the security of what depends on it: the access it grants, the confidentiality of its team's passwords, and the documents it chooses to upload or send.

6. Sub-processors

The client gives ArtFinder a general authorisation to engage the sub-processors listed in the annex. That annex is rendered from the public Subprocessors page, which is dated and authoritative.

ArtFinder informs the client of any intended addition or replacement of a sub-processor before entrusting it with data. The client may object, on reasonable data protection grounds, within thirty days. Failing a solution, it may terminate the contract for the part concerned, free of charge.

Some providers are only activated at the client's request — messaging, SMS, banking, payment, signature, address validation. Requesting them is an instruction to use them for its workspace.

ArtFinder imposes on each sub-processor data protection obligations equivalent to those of this agreement, and remains liable to the client for their performance.

The services that the list identifies as acting as independent controllers — banks, payment, identification or mapping providers — are not ArtFinder's processors: they process the data under their own terms, which the client accepts by requesting their activation.

7. Transfers outside the European Economic Area

The data is stored in the European Union. Where a sub-processor processes it outside the European Economic Area, the transfer relies on the safeguard stated for it in the annex — an adequacy decision, including the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses.

8. Assistance to the client

Taking into account the nature of the processing, ArtFinder helps the client respond to requests from data subjects — access, rectification, erasure, restriction, portability, objection. For this the client has the features of its workspace, including the export of its data. If a person contacts ArtFinder directly about workspace data, ArtFinder forwards the request to the client without answering it itself, unless instructed otherwise.

ArtFinder also helps the client comply with its obligations on security, breach notification, data protection impact assessment and prior consultation of the supervisory authority (Articles 32 to 36 GDPR), taking into account the nature of the processing and the information available to it.

9. Personal data breach

ArtFinder notifies the client of any personal data breach affecting its workspace without undue delay after becoming aware of it. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. Whatever is not yet known is provided as soon as it is.

It is for the client, as controller, to notify the supervisory authority and inform the data subjects where the law requires; ArtFinder assists it.

10. Audits

ArtFinder makes available to the client the information necessary to demonstrate compliance with this agreement. The client may have an audit carried out, by itself or by an auditor bound by confidentiality, on reasonable notice, at most once a year except after a breach or at the request of an authority, and at its own cost. The audit may not cover other clients' data nor compromise the security of the service.

11. End of the contract

During the contract and at its end, the client may export its data from its workspace. At the end of the contract, ArtFinder erases the workspace data at the client's request, and at the latest once a reasonable period left for the export has expired, unless the law requires it to be kept.

Erased data remains in backups until the last copy containing it is erased, and in the test copy — kept in the same European hosting, with the same protections — until its next refresh from production.

12. Liability, duration and governing law

Each party's liability is governed by the terms and conditions, including the limitation of liability, except where the GDPR or another mandatory rule provides otherwise. This agreement lasts as long as the main contract and the obligations of section 11.

It is governed by Belgian law; disputes fall within the jurisdiction of the courts of the judicial district of Brussels.

13. Acceptance and versions

The agreement is accepted on the client's behalf by a manager of its workspace, in Homono: the acceptance records who gave it, when, for which version, from which IP address and which browser. A client that prefers may sign the printable version and return it to hello@homono.be.

Any new version — including a change to the annex — is dated and presented to the workspace's managers. This agreement exists in French, Dutch and English; the French version prevails.

Annex — Sub-processors

List as at the date of this agreement. It covers the providers that process data on ArtFinder's behalf; the Subprocessors page also lists the services that act as independent controllers.