Data Processing Addendum

1. Scope & parties

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between StatGazer LLC, a New York limited liability company ("StatGazer", the processor) and the Customer, and applies automatically whenever Customer Data processed on the Customer's behalf includes personal data. For that processing the Customer acts as the controller (or business) and StatGazer as the processor (or service provider); the split of roles by processing activity is set out in the Privacy Notice's "Our roles" section. Where StatGazer acts as a controller (its own account, billing, and security processing), the Privacy Notice — not this DPA — governs.

2. Details of processing

• Subject matter & duration — operating the Customer's Workspace for the term of the Subscription, plus the retention/restore windows in the Privacy Notice.
• Nature & purpose — hosting, storing, displaying, transmitting, and backing up Workspace content; sending the notifications and generating the reports the Service's features provide.
• Data subjects — the Customer's landlords, property managers, team members, tenants, invitees, and vendors.
• Categories of data — contact details (name, email); lease and financial records (rent obligations, payments, charges); documents, messages, photos, and files; electronic-signature records.

3. Processing on instructions

StatGazer processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use and configuration of the Service's documented features constitute those instructions. If we believe an instruction infringes applicable data-protection law, we will inform the Customer (we are not obliged to monitor the Customer's compliance).

4. Confidentiality

Persons we authorize to process Customer Personal Data are bound by contractual or statutory confidentiality obligations and are given access on a least-privilege basis.

5. Security measures

We implement the technical and organizational measures described in the Privacy Notice's "Security" section — including password hashing, encryption in transit, optional two-factor authentication, session management with remote revocation, least-privilege access controls, audit and security logging, routine backups with disaster recovery, and an incident-response process — and we keep those measures current as the Service evolves.

6. Subprocessors

The Customer generally authorizes the subprocessors listed at Subprocessors. We update that list before a new subprocessor starts processing, notify business Customers, impose data-protection obligations on each subprocessor no less protective than this DPA, and remain responsible for their performance. The objection process (30 days, good-faith resolution, termination of the affected Subscription as the remedy) is described on that page.

7. Data-subject requests

The Service itself gives data subjects direct self-service: tenants see their own records in their portal, can export their data, and can delete their account. Taking that functionality into account, we will reasonably assist the Customer with data-subject requests, and if a data subject contacts us directly about Customer-controlled records, we will refer them to the Customer without undue delay.

8. Personal-data breach

We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will provide reasonable information and cooperation to support the Customer's own notification obligations as it becomes available.

9. Deletion & return

Throughout the term the Customer can export its records (CSV exports across obligations, documents, and every report). On workspace closure, data is soft-deleted for a 30-day restore window and then permanently anonymized/erased from active systems, with backups deleted on their rolling schedule — except records we must retain for legal, tax, or fraud-prevention purposes, and Shared Records another user lawfully retains, as described in the Privacy Notice and Terms.

10. International transfers

The Service is operated from the United States, and Customer Personal Data is processed in the United States and other locations where the listed subprocessors operate. For Customers whose data is subject to laws requiring a transfer mechanism, contact privacy@ruma.rent — we will put the appropriate safeguards in place before onboarding.

11. Audits & information

On request, we will make available the information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable safeguards: at most once per 12 months, on at least 30 days' notice, during business hours, without disrupting the Service or other customers' confidentiality, and at the Customer's expense. Written responses to security questionnaires satisfy this obligation where they reasonably address the Customer's concerns.

12. Liability & precedence

This DPA is subject to the limitations of liability in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

13. Contact

Privacy requests: privacy@ruma.rent. Legal notices: legal@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.