Data Processing Agreement

1. The parties

Processor — the operator of the Realtorz platform:

Realtorz Systems s.r.o.
Company ID: 30044618
Tax ID: CZ30044618 (not a VAT payer)
Školská 660/3, Nové Město, 110 00 Praha 1
team@realtorz.cz

Controller — the organisation (real-estate agency) that has created an account on the platform. It is identified by the details it gave when creating the organisation and in its billing settings (business name, company ID, registered office) and by the person of its owner. The controller is responsible for the users it invites into the organisation.

2. Subject matter and duration

The processor processes, on behalf of the controller, personal data that the controller and its users enter into the platform or that arises there through its use. The controller determines the purposes and means of processing; the processor provides the software and its operation.

The agreement lasts for as long as the organisation’s account exists. It ends together with the use of the platform; what happens to the data afterwards is governed by section 11.

3. Nature and purpose of the processing

The processing serves the operation of a CRM for the controller’s real-estate business, namely:

• records of clients, leads and contacts, demands, listings and deals;
• communication with data subjects over the channels the controller enables — email, SMS, Telegram, and phone calls together with their recording where that feature is switched on;
• scheduling and recording viewings, tasks and deadlines, including calendar sync;
• storing documents, contracts, photographs and attachments of a deal;
• preparing and publishing listings on the agency website, on property portals and on the Realtorz Market marketplace — to the extent the controller itself selects for publication;
• artificial-intelligence assistant features that run on a user’s instruction (draft text, summary, translation, property shortlist) and whose output the user confirms before anything is sent;
• support for client checks under Act No. 253/2008 Coll. (AML) — queries to public registers and keeping identification data separately from the rest;
• operational security: backups, audit log, incident handling and support.

The processing is automated; manual access by the processor’s staff to the organisation’s data happens only to the extent necessary for support and operations and is logged.

4. Types of data and categories of data subjects

Categories of data subjects: the agency’s clients (sellers and landlords), leads and buyers, tenants, property owners, counterparties of a transaction and cooperating agents, and the agency’s employees and contractors as users of the platform.

Types of personal data: identification data (given name and surname, date of birth and, for AML identification, identity document details), contact data (email, phone, address), property and deal data including addresses, financial data related to the transaction (price, offer, commission), the content of communication and attachments, agent notes, records of viewings and appointments and — if the controller enables the voice assistant — the audio recording of a call and its transcript.

The platform is not designed for special categories of data under Art. 9 GDPR and the controller should not enter them. If they are nevertheless entered into free-text fields (a note, an attachment), they are processed like other data and the controller bears responsibility for their legal basis.

5. Controller’s instructions

The processor processes personal data only on documented instructions from the controller. Using the platform through the controller’s users and configuring the organisation (enabled channels, publication, automations, retention settings) constitute such instructions; an instruction beyond the platform’s features is given in writing, by email from the organisation owner’s address to team@realtorz.cz.

If the processor considers that an instruction infringes GDPR or other EU or Czech law, it informs the controller immediately and may refuse to carry it out. A legal obligation of the processor under EU or Czech law prevails; we inform the controller about such a requirement unless the law forbids it.

6. Confidentiality of personnel

Only persons who need it for their tasks have access to the controller’s data. They are bound by confidentiality — contractually or by law — and that obligation survives the end of their engagement with the processor. Staff access to an organisation’s data is recorded in the audit log.

7. Security of processing

The processor has implemented technical and organisational measures under Art. 32 GDPR; they are described in Section 9 of the Privacy Policy and form part of this agreement. In short: encrypted transport (TLS), encrypted storage of access tokens, infrastructure and database inside the European Union, isolation of each organisation’s data at database row level (row-level security), role-based access control, a separate audit log and encrypted backups with tested restores.

The processor may change the measures over time as technology develops, provided the level of protection does not drop. Material changes are announced with a new version of the Privacy Policy.

8. Sub-processors

The controller gives the processor general authorisation to engage sub-processors. The current list — with each one’s role and location — is in Section 6 of the Privacy Policy; there is no second list, so the two cannot drift apart.

We announce the addition of a new sub-processor or the replacement of an existing one at least 30 days in advance — by email to the organisation owner and in the application. The controller may raise a reasoned objection within that period; if we cannot reach agreement, it may terminate its use of the platform without penalty and export its data under section 11.

Sub-processors are bound by contract to the same data protection obligations as the processor has under this agreement. The processor remains liable to the controller for their performance as for its own.

9. Assistance to the controller

• Data subject rights. The platform can find the data of a specific person, correct it, restrict its processing, export it in a machine-readable format and delete it — so the controller handles requests itself without waiting for us. If a data subject’s request reaches us, we do not answer it on the merits: we pass it to the controller without undue delay and give it the assistance it needs.
• Incidents. We notify the controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, by email to the organisation owner. The notice states the nature of the breach, the categories and approximate volume of data concerned, the likely consequences, the measures taken and proposed, and a contact point. Notification to the supervisory authority under Art. 33 GDPR is made by the controller; we give it everything we have.
• Impact assessment (DPIA) and prior consultation. At the controller’s request we provide the information about the nature of the processing, security, sub-processors and data flows that it needs for an assessment under Art. 35 and 36 GDPR.

10. Transfers outside the European Union

Servers, the database and file storage are operated inside the European Union. The only content that leaves the EU is what has to be passed to an artificial-intelligence model: the Anthropic PBC language model (USA) and Google Gemini models (USA) — today for image generation, and, once the voice assistant is enabled, also call audio and its transcript.

Both transfers rely on the European Commission’s Standard Contractual Clauses and are accompanied by technical measures: we send only the text or audio necessary for the task at hand and choose service modes in which the provider does not use the content to train its models. The processor makes no other transfer to a third country without the controller’s instruction.

11. Termination, export and erasure

After the use of the platform ends, the controller may request a full export of its organisation’s data in a machine-readable format; we deliver it within 48 hours of the request, free of charge (section 3 of the Terms of Use).

After the export, and in any case within 30 days of termination, we delete the personal data including copies; it disappears from encrypted backups through their regular rotation, at the latest 30 days after erasure from the live database.

Exception: data that must be retained by law — in particular identification data from client checks under Act No. 253/2008 Coll., with a ten-year retention period. The agency remains the controller of that data; the processor merely keeps it separately from the rest, uses it for no other purpose, and deletes it on the controller’s instruction once the statutory period has passed.

12. Audit

The processor makes available the information necessary to demonstrate compliance with Art. 28 GDPR. The controller may carry out an audit once a year on a request submitted at least 30 days in advance, and additionally after a security incident that affected it.

An audit takes place during business hours, without unreasonable disruption of operations, at the controller’s expense and without access to other organisations’ data. Providing documentation and answering a questionnaire comes first; an on-site inspection follows only where a doubt cannot be resolved that way.

13. Liability

Liability for damage caused by processing is governed by Art. 82 GDPR. The limitations of liability agreed in the Terms of Use do not apply to obligations under GDPR to the extent the Regulation does not allow them. The parties assist each other in proceedings before the supervisory authority and in any court dispute concerning the processing.

14. Final provisions

The agreement is concluded by acceptance when the organisation is created — by ticking the box on the sign-up form — and takes effect on the day of acceptance. Its version is the date of the edition shown at the top of this page.

We announce changes to this agreement in the same way as changes to the Terms of Use, with reasonable notice; if the controller disagrees with a change, it may end its use of the platform and export its data under section 11. The agreement is governed by Czech law; anything not covered here follows the Terms of Use and the Privacy Policy.