Data Processing Agreement

This Data Processing Agreement is the Article 28 GDPR contract between RULER SMPC, Matzagriotaki 74, Kallithea 17676 GR (the processor, we) and the customer who runs a bildflow workspace (the controller, you).

It forms part of the Terms of Service and applies automatically from the moment you accept them — there is nothing separate to sign. Where it conflicts with the Terms of Service or the Privacy Policy on the processing of personal data, this agreement prevails.

Personal data, processing, controller, processor, data subject, supervisory authority and personal data breach have the meanings given to them in the GDPR (Regulation (EU) 2016/679), as applied in the Republic of Cyprus.

Customer personal data means personal data contained in your workspace that we process on your behalf: leads, buyers, their contact details and notes, viewings, documents and contracts you upload, payment schedules, messages, and the staff, agent and buyer accounts attached to your workspace.

Sub-processor means a third party we engage to process customer personal data on our behalf.

Applicable data protection law means the GDPR, the Cypriot Law 125(I)/2018, and the ePrivacy rules as implemented in Cyprus, each as amended.

You are the controller of customer personal data. You decide what goes into your workspace, on what legal basis, who may see it, and how long it stays. You are responsible for telling data subjects what you collect and why, and for having a lawful basis before you enter their data.

We are your processor for that data and process it only to provide and support the service.

Subject matter: providing the bildflow platform. Duration: for as long as your workspace exists, plus the deletion periods in the section on return and deletion. Nature and purpose: hosting, storage, retrieval, organisation, transmission, backup, export, erasure and support. Types of personal data: identification and contact details, professional details, property and transaction details, correspondence, documents you upload and technical usage records. Categories of data subject: your staff, the estate agents you work with, your leads and prospective buyers, and your buyers.

We remain the controller, not your processor, for the account and billing data described in our Privacy Policy, and for the technical logs we keep to secure and operate the platform.

We process customer personal data only on your documented instructions, including on international transfers. Your instructions are: this agreement, the Terms of Service, the configuration and actions you and your staff carry out in the product, and any further written instruction we accept.

We will tell you if, in our opinion, an instruction infringes applicable data protection law, and we may pause the processing concerned until it is resolved.

If a law of the EU or a member state requires us to process the data otherwise, we will tell you before doing so unless that law forbids the notification on important grounds of public interest.

We do not sell customer personal data, do not use it for our own purposes, and do not use it to train machine-learning models.

Everyone we let near customer personal data — employees and contractors alike — is bound by a written confidentiality obligation that survives the end of their engagement, and is trained on handling personal data.

Access to production systems is restricted to the few people who need it for operations or support, is granted individually rather than to a shared account, requires multi-factor authentication, is reviewed regularly, and is revoked on the day someone leaves.

We implement appropriate technical and organisational measures under Article 32, which currently include the following.

Tenant isolation: every table holding customer personal data is protected by database row-level security keyed to the workspace, so a query made with one workspace's credentials cannot return another workspace's rows. Isolation is enforced in the database itself, not only in application code, and is covered by automated tests.

Encryption: all traffic runs over TLS; data at rest in the database and in file storage is encrypted; uploaded documents are never public and are served through short-lived signed URLs issued per request.

Access control and logging: role-based access inside each workspace (owner, admin, sales, construction, agent, buyer), multi-factor authentication for our own production access, and an audit log recording who did what and when — written by database triggers; edited only to strip personal data on erasure and pruned after 12 months.

Resilience: managed, encrypted backups on a rolling window of up to 30 days, with restore procedures tested periodically; separate environments for development and production; dependency and vulnerability monitoring.

We may change these measures as technology moves on, but not in a way that materially lowers the level of protection.

You give us general authorisation to engage sub-processors. Each one is bound by a written contract imposing data protection obligations no less protective than this agreement, and we remain fully liable to you for their performance.

The sub-processors in use today are: Supabase (hosting, database, file storage and authentication, in the EU); Stripe (subscription billing and card payments); Anthropic (AI text generation, invoked only when someone in your workspace requests a generation); OpenAI (AI image generation and, when a workspace selects GPT-6 Astra, text generation, invoked only when someone in your workspace requests a generation); Resend (transactional and notification email); Cloudflare (content delivery, map tiles and denial-of-service protection); Google Maps Platform (map display, only once we enable Google Maps for the service as a whole, with the notice described below — the viewer's browser then fetches map tiles from Google); and Google Tag Manager and Google Analytics (measuring how the service's pages are used, only once we enable analytics for the service as a whole, with the notice described below — Google Analytics then runs only for visitors who accept analytics cookies, never in the forms you embed on your own website, and page addresses reach it with ids and link tokens replaced by placeholders).

We will give you at least 30 days' notice, by email and in the app, before adding or replacing a sub-processor. If you have a reasonable, data-protection-related objection within that period, tell us at legal@ruler.agency and we will work with you on an alternative; if we cannot offer one, you may terminate the affected part of the service and we refund any prepaid, unused fees.

We host customer personal data in the European Union and keep it there wherever we can.

Where a sub-processor or its support staff processes data outside the EEA in a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses, supplemented by the technical measures in the security section. You instruct us to make those transfers on that basis. We provide the relevant details on request to legal@ruler.agency.

The product contains the tools you need for most requests: export of everything held about a buyer or a lead, export of the whole workspace, erasure of a buyer or a lead, and a register of the requests you have received and how you answered them.

Erasure is precise about what it does, because the alternative would be to promise more than it delivers. It anonymises the buyer or lead record, replacing name, contact details and free-text notes with a marker showing that the person was erased. It deletes their messages and the files attached to them, and the notifications about them. It strips personal data out of the audit entries that mention them, leaving the entry itself so the history of the workspace is not falsified.

Two things it deliberately leaves in place. Payment records are kept in anonymised form: they are accounting records you are required by Cypriot tax law to retain, so they rest on your legal obligation (Art. 6(1)(c)) and Article 17(3)(b) permits keeping them for that reason. Documents attached to the buyer's unit — the sale contract, handover records, certificates — are kept as contract records, on the same legal obligation and on the legitimate interest in establishing or defending legal claims (Art. 6(1)(c) and (f)), and Article 17(3)(e) covers them. An erasure request does not delete either of them, and you should not tell a data subject that it does. Neither identifies anybody on its own once the record it points at has been anonymised; where a document still contains the person's name in its own text, removing it is a decision only you can take against the contract it belongs to.

If a data subject contacts us directly about data in your workspace, we will not answer on your behalf. We tell them to contact you, and we pass the request to the workspace owner without undue delay.

Where a request cannot be handled with the built-in tools, we assist you by appropriate technical and organisational measures, so far as is reasonably possible, taking the nature of the processing into account.

Taking into account what we process and what information is available to us, we assist you in meeting your obligations under Articles 32 to 36: security of processing, breach notification to the supervisory authority and to data subjects, data protection impact assessments, and prior consultation.

That assistance includes the security documentation described here, information about our sub-processors and transfers, and reasonable answers to a security questionnaire once per year.

If we become aware of a personal data breach affecting customer personal data, we will notify the workspace owner without undue delay and in any event within 48 hours of becoming aware of it.

The notification describes what we know: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for more information. If we do not have the full picture within 48 hours, we send what we have and follow up as the investigation continues.

We do not notify your supervisory authority or your data subjects on your behalf — that decision is yours as controller — but we give you what you need to make it in time.

You can export your workspace at any time while the account is open, in a machine-readable format, without asking us.

When the contract ends, or when the owner schedules deletion of the workspace, the data stays available for a 30-day grace period so it can be exported and so a deletion can be called off. At the end of that period we delete customer personal data from the live systems, and it can no longer be recovered.

Copies in encrypted backups age out of the rolling backup window within 30 days of deletion. Until they do they are isolated from live access and are not used for any other purpose.

We keep data beyond these periods only where EU or member-state law requires it, and then only for as long as that law requires.

On request, we make available the information needed to demonstrate compliance with Article 28, including a description of our technical and organisational measures and our current sub-processor list.

You may audit that compliance, yourself or through an independent auditor who is not our competitor and who is bound by confidentiality, no more than once a year — unless a personal data breach or a supervisory authority's instruction makes an additional audit necessary. Audits are arranged at least 30 days in advance, take place in business hours, and are conducted so as not to disrupt the service or to expose another customer's data. Each side bears its own costs; we may charge our reasonable costs for audits beyond the annual one.

This agreement starts when you accept the Terms of Service and runs until we have deleted or returned all customer personal data in line with the section above. The obligations on confidentiality, security and deletion survive termination.

Liability under this agreement is subject to the limitations and exclusions in the Terms of Service, except where applicable data protection law does not allow them to be limited.

If any part of this agreement is found invalid, the rest stays in force, and we will replace the invalid part with a valid one that has as close an effect as possible.

Notices under this agreement go to legal@ruler.agency on our side, and to the workspace owner's registered email address on yours.