Data Processing Agreement (DPA)
This is an English translation provided for convenience. The Romanian version at oramo.ai/dpa is the authoritative text.
1. The parties and when this agreement applies
This agreement forms part of the oramo.ai Terms and Conditions and is made between:
- the Customer — the owner, property manager or agency that uses Oramo in its rental activity (the controller, as defined in the GDPR); and
- Oramo Tech SRL, Str. Nicolae G. Caranfil 44-46, Bl. 11B, Sc 1, Et 1, Ap 7, Sector 1, postcode 014145, Bucharest, Romania, tax ID 54635355, J2026029949007 (the processor).
It applies to the personal data the Customer enters into or brings to Oramo about other people — tenants, co-owners, collaborators, tradespeople — to manage its rentals. For the data of each user's own account and for Oramo's own purposes (security, billing, improving the service), Oramo remains the controller, as described in the Privacy Policy.
This agreement applies automatically when the Terms are accepted. If you need a signed copy, write to privacy@oramo.ai. If this agreement and the Terms conflict on the processing of personal data, this agreement prevails.
2. What data we process and why
| Data subjects | The Customer's tenants (including those without an account), co-owners, collaborators and tradespeople the Customer adds |
|---|---|
| Categories of data | Name, email, phone, property address, lease details, rent, payments and payment proofs, IBAN, utility bills, repair tickets and rental-related messages. We do not ask for special categories of data (Art. 9 GDPR) and ask you not to enter them |
| Nature of the processing | Storing, organising and displaying the data, sending the notifications you set up, reading payment proofs and bills automatically, and the AI assistant's answers to your questions |
| Purpose | Providing the oramo.ai service to the Customer, under the Terms |
| Duration | While the Customer's account is active, then as described in section 9 |
3. The Customer's instructions
We process this data only on the Customer's documented instructions: the Terms, this agreement and the settings the Customer chooses in the app (for example, which notifications are sent and on which channel). We do not use the data for our own purposes and we do not sell it. If we believe an instruction breaks the GDPR, we tell you straight away.
The Customer is responsible for the legal basis for the data it enters and for telling the data subjects (for example, its tenants) that it uses Oramo.
4. Confidentiality
The people at Oramo who can access this data are bound by confidentiality and access it only as far as they need to provide the service or to fix a problem the Customer reports.
5. Security
- Data travels encrypted (HTTPS) and is stored encrypted at our database provider.
- Each account sees only its own data: the access rules are enforced in the database, not only in the app.
- The team's access to production systems is limited to the people who need it.
- The database is backed up daily, and backups are kept for 7 days.
- Application errors are monitored continuously.
6. Sub-processors
The Customer gives us general authorisation to use the sub-processors listed in the Privacy Policy, section 8, which also shows where the data is stored. Each one is bound by a contract with data-protection obligations at least as strict as these, and we remain responsible to the Customer for them.
Before we add or replace a sub-processor, we update the list and email Customers at least 14 days in advance. The Customer may object, with reasons, at privacy@oramo.ai; if we cannot find a solution, the Customer may end the contract.
7. Transfers outside the EU
Some sub-processors process data outside the European Economic Area, mainly in the United States. These transfers rely on the European Commission's Standard Contractual Clauses or on the EU-U.S. Data Privacy Framework, as applicable, as shown in section 8 of the Privacy Policy.
8. Helping the Customer
- Data subject requests: if a tenant asks us for access to, deletion or correction of data the Customer entered, we pass the request to the Customer and help it respond.
- Security incidents: if we become aware of a personal-data breach affecting the Customer, we tell the Customer without undue delay, with what we know at that point, so it can meet its obligations towards the supervisory authority and the data subjects.
- Impact assessments and consultations: we provide the information we hold that the Customer needs.
9. When the service ends
When the Customer deletes its account, the data it entered is deleted permanently after the 90 days during which it can change its mind. Deleted rows may remain in backups for up to 7 more days. Before deletion, the Customer can ask us by email for a copy of its data. We keep data longer only where the law requires it (for example, tax records).
10. Audits
On request, we give the Customer the information it needs to check compliance with this agreement and with Art. 28 GDPR. An audit (by the Customer or by an independent auditor bound by confidentiality) is announced at least 30 days in advance, takes place at most once a year (unless the supervisory authority requires it or after an incident affecting the Customer), gives no access to other customers' data, and each party bears its own costs.
11. Liability, term and governing law
The parties' liability is as set out in the Terms. This agreement lasts as long as Oramo processes data on the Customer's behalf. Romanian law applies, and the supervisory authority is Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP).
12. Contact
Questions about this agreement: privacy@oramo.ai
Oramo Tech SRL, Bucharest, Romania