This data processing agreement (the “Agreement”) governs the processing of personal data carried out by RentDari on behalf of its customer in connection with use of the service.
It is entered into automatically with every customer subscribing to the service: it is incorporated by reference into our terms of use and forms an integral part of them. No signature is required for it to take effect. A customer whose procurement process requires a signed counterpart may request one at [email protected].
1. Parties and definitions
The Agreement is entered into between the customer — the natural or legal person holding a RentDari workspace — and El Mehdi Bouhou, sole trader operating under the trade name RentDari, whose registered office is at 1 Allée Gisèle Borde, 33520 Bruges (France), registered with the Bordeaux Trade and Companies Register under number 932 014 863.
The terms “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in Article 4 of the GDPR.
The customer acts as the controller. RentDari acts as the processor and processes the data only on the customer's documented instructions.
2. Subject matter, duration, nature and purpose
Subject matter and purpose. The provision of a short-term rental management platform: management of properties, reservations and guests, distribution to booking platforms, messaging, online check-in and contract signature, owner accounting, and field-operations management.
Nature of the processing. Collection, recording, organisation, storage, retrieval, disclosure by transmission, matching and erasure, by automated means.
Duration. The Agreement takes effect when the workspace is opened and remains in force for as long as RentDari processes data on the customer's behalf, and thereafter until the data is returned or deleted in accordance with Article 10.
3. Categories of data subjects and data
Data subjects: users of the customer's workspace (directors, employees, collaborators); guests and their companions; owners of the managed properties; service providers; the customer's business contacts.
Categories of data:
- Identification data: surname, first name, email address, telephone number, language, nationality, date of birth, postal address.
- Stay data: dates, property, amounts, booking channel, payment status, message exchanges, reviews.
- Check-in data: identity document type and number, image of the identity document, digitised handwritten signature, signed contract, IP address and browser at the time of signature.
- Owner data: identity, bank details for settlement, statements and accounting documents.
- Connection and technical data: account identifiers, access logs, IP addresses, device identifiers.
Special categories. The service is not intended for the processing of special categories of data within the meaning of Article 9 of the GDPR. The customer refrains from entering such data in free-text fields. An identity document may nonetheless, by its nature, reveal its holder's nationality or place of birth: it is handled with the reinforced measures described in Article 6.
4. Documented instructions
RentDari processes personal data only on the customer's documented instructions. The following constitute such instructions: the terms of use, this Agreement, and the actions the customer performs using the features of the service.
RentDari informs the customer if it considers that an instruction infringes the GDPR or another applicable data protection provision, and may suspend the instruction concerned until it is confirmed or amended.
Where Union or Member State law requires RentDari to process data beyond the customer's instructions, RentDari informs the customer before the processing, unless that law prohibits it on important grounds of public interest.
5. Sub-processors
The customer gives RentDari a general authorisation to engage sub-processors, subject to this Article.
The up-to-date list of sub-processors, with their purpose, the data concerned and where it is processed, is published and maintained on the Sub-processors page.
RentDari contractually imposes on each sub-processor data protection obligations at least equivalent to those of this Agreement, and remains fully liable to the customer for the performance of their obligations.
RentDari gives advance notice, on request sent to [email protected], to any customer who wishes to receive it of the addition or replacement of a sub-processor. The customer has thirty days from the notification to raise a reasoned objection on data protection grounds. Failing a reasonable solution, the customer may terminate the affected part of the service without penalty.
6. Security of processing
RentDari implements the appropriate technical and organisational measures required by Article 32 of the GDPR. Those measures are described in detail, and kept up to date, on the Data security page, which forms an integral part of this Agreement.
They include encryption of data in transit, server-side workspace isolation, two-factor authentication, restricted access to production systems, and reinforced handling of guest identity documents — private storage and access through signed links of limited validity.
RentDari ensures that persons authorised to process the data are bound by an obligation of confidentiality.
7. Assistance to the customer
Taking into account the nature of the processing, RentDari assists the customer, insofar as this is possible:
- in responding to requests from data subjects exercising their rights (Articles 12 to 23 of the GDPR). The service provides the export, rectification and deletion functions that allow the customer to respond directly; failing that, RentDari intervenes on request.
- in ensuring compliance with the obligations of Articles 32 to 36 of the GDPR, including carrying out a data protection impact assessment and, where applicable, prior consultation of the supervisory authority.
If a data subject contacts RentDari directly, RentDari refrains from responding on the merits and forwards the request to the customer without delay.
8. Personal data breach
RentDari notifies the customer of any personal data breach without undue delay after becoming aware of it, at the contact address recorded in the workspace.
The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects.
It is for the customer to assess whether the supervisory authority and the data subjects must be notified, and to carry out that notification.
9. Transfers outside the European Union
RentDari's application infrastructure — compute, database and file storage — is located in the European Union.
Certain sub-processors are established outside the European Union; they are identified as such on the Sub-processors page. Those transfers are governed by the standard contractual clauses adopted by the European Commission under Article 46 of the GDPR, supplemented where necessary by additional measures, or are based on an adequacy decision where one exists.
Where the customer themselves activates an integration whose provider is established outside the European Union, the corresponding transfer results from their own choice and from the contractual relationship they hold with that provider.
10. Deletion and return
The customer may at any time export the data in their workspace using the service's export functions.
On termination of the service, the customer has thirty days to carry out that export. On expiry of that period, and on request, RentDari deletes the personal data processed on their behalf, except where retention is required by Union or Member State law — in particular accounting and invoicing records, retained for ten years.
The customer may also request at any time the deletion of specific data, in particular the identity documents and check-in information of a completed stay, by writing to [email protected]. RentDari acts on it within thirty days.
11. Audit
RentDari makes available to the customer all information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR. The Data security and Sub-processors pages, kept up to date, constitute the first level of that documentation. RentDari also answers the security questionnaires sent to it.
The customer may request an audit, limited to the processing carried out on their behalf, on reasonable notice of at least thirty days, no more than once a year unless there has been a confirmed incident or a supervisory authority so requests, during working hours and without disrupting operation of the service. The appointed auditor must not be a competitor of RentDari and is bound by confidentiality. Costs are borne by the customer, unless the audit reveals a material failure.
12. Customer responsibilities
The customer warrants that it has a legal basis for the processing it entrusts to RentDari, that it has informed the data subjects in accordance with Articles 13 and 14 of the GDPR, and that it has obtained their consent where required.
The customer is solely responsible for the accuracy of the data it enters into the service, for configuring its members' access, and for determining its own retention periods.
13. Law 09-08 (Morocco)
For processing governed by Moroccan law, the customer remains responsible for the prior declarations and authorisations with the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP) required by Law No. 09-08. RentDari acts as a processor and provides, on request, the technical information needed for those formalities.
14. Order of precedence and amendments
In the event of a conflict between this Agreement and the terms of use on a data protection matter, this Agreement prevails.
RentDari may amend this Agreement to reflect a legislative, regulatory or case-law development, or a change to the service. Any material amendment is published on this page, with the date at the top updated, and notified to customers who have asked to be notified.
15. Governing law and contact
This Agreement is governed by French law and, in all matters of personal data protection, by the GDPR.
Point of contact for any data protection question, including the exercise of rights, a request for a signed counterpart of this Agreement, or the submission of a security questionnaire: [email protected].