Version 2026-10-draft · last updated: 27 October 2026
This data processing agreement ("DPA") is part of the Kot360 terms between the landlord who uses Kot360 ("you", the controller) and Ulixes Consulting BV, Elegemstraat 186, 1700 Dilbeek, enterprise number 0795.420.685 ("Kot360", the processor). It sets out the commitments required by Article 28 of the General Data Protection Regulation (GDPR). You accept it when you set up your landlord account.
1. Subject, duration and purpose
- Subject: Kot360 processes personal data on your behalf to provide the Kot360 services you use: marketplace and landlord page, visits, applications and waiting lists, student files, contracts and signatures, rent, bank connection, deposits, repairs, inspections and the student app.
- Duration: as long as you use Kot360, and afterwards for as long as needed to delete or return the data (article 9).
- Nature: storing, organising, showing, sending (email and push), generating documents, matching bank transactions with rent, and deleting data.
2. Data subjects and data
| Data subjects | Personal data |
|---|---|
| Guests and candidates | Name, email, phone, language, desired period, message, visit and application history, proof of consent |
| Students | The above, plus date of birth, home address, school and study, optional national register number (encrypted), contract, rent and payment data, deposit, repairs, inspection reports and photos |
| Parents and guarantors | Name, contact details, relation to the student, signature data |
| Payers | Name and bank account number (encrypted) of incoming transfers, when the bank connection is on |
| Your team members | Name, email, role (Kot360 is controller for their login) |
Kot360 does not process special categories of personal data (Article 9 GDPR) for you. Do not put such data (for example health data) in free-text fields.
3. Your instructions
Kot360 only processes the data on your documented instructions: these terms, this DPA and the settings and actions you take in Kot360. If Kot360 is required by law to process data otherwise, we inform you first, unless the law forbids it. We tell you if we think an instruction breaks data protection law.
4. Confidentiality
Everyone at Kot360 who has access to the data is bound to confidentiality. Staff only access your account to provide or support the service; every support session is logged.
5. Security (Article 32 GDPR)
Kot360 takes appropriate technical and organisational measures, including:
- encryption in transit (HTTPS) and encryption at rest of national register numbers, bank account numbers and bank access tokens;
- separation of landlords enforced in the database itself (row-level security);
- role-based access for your team members, and a separate login with mandatory two-factor authentication for Kot360 staff;
- an audit log of important actions, kept for 12 months;
- daily backups in the EU;
- automatic deletion of guest data that never led to a contact, 12 months after the last activity.
6. Sub-processors
You give Kot360 general authorisation to use the following sub-processors. Kot360 imposes the same data protection obligations on them by contract and remains responsible for them.
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, database, file storage, backups | Germany and Finland (EU) |
| Ploi | Server management | Netherlands (EU) |
| [EMAIL PROVIDER] | Sending emails | EU |
| Yousign SAS | Online signatures (when you use them) | France (EU) |
| Isabel NV (Ponto) | Bank connection (when you switch it on) | Belgium (EU) |
| Google (Places API) | Address suggestions while typing | EU and United States |
| Anthropic (Claude API) | Automatic translation of descriptions, when the landlord switches it on | United States |
| OpenStreetMap Foundation | Map tiles and geocoding of house addresses | United Kingdom |
| Browser push services (Google, Apple, Mozilla) | Delivering push notifications students allowed | EU and United States |
We inform you at least 30 days before we add or replace a sub-processor. You can object for reasonable data protection grounds; if we cannot find a solution, you can end the contract before the change applies.
7. Transfers outside the EEA
Kot360 only transfers personal data outside the European Economic Area when an adequacy decision applies (for example for the United Kingdom) or with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
8. Assistance
Kot360 helps you, as far as reasonably possible:
- to answer requests of data subjects (access, correction, erasure, restriction, portability, objection) — Kot360 forwards requests it receives for your data to you without delay;
- with security, data breach notifications, data protection impact assessments and prior consultation of the authority (Articles 32 to 36 GDPR).
Data breaches: Kot360 informs you without undue delay, and at the latest within 48 hours after becoming aware of a personal data breach that affects your data, with the information you need to notify the Data Protection Authority within 72 hours.
9. End of the contract
When you stop using Kot360, Kot360 deletes the personal data it processed for you within [DELETION DAYS] days, or returns it to you first if you ask before the end, unless the law requires Kot360 to keep it. Backups are overwritten on their normal cycle.
10. Audits
Kot360 makes available the information you need to show compliance with Article 28 GDPR and allows audits by you or an auditor you appoint, bound to confidentiality, with at least 30 days' notice, at most once a year unless there is a data breach or a request of the authority. You bear the costs of the audit.
11. Liability and law
The liability rules of the Kot360 terms apply. This DPA is governed by Belgian law. If this DPA and the terms contradict each other on data protection, this DPA prevails.