Data Processing Addendum

Last updated: October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Controller") and NERATEK, LDA (NIPC 519264800, Lisbon, Portugal) ("Processor") and governs the processing of personal data in connection with the NeraTek platform.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person processed through the Service.
• "Processing" has the meaning given in GDPR Article 4(2).
• "Data Subject" means the individual whose Personal Data is processed (i.e., your leads/contacts).
• "Sub-processor" means a third party engaged by the Processor to process Personal Data.

2. Scope & Roles

You (the account holder) are the Data Controller. NeraTek is the Data Processor acting on your behalf. NeraTek processes Personal Data solely to provide the Service as described in the Terms of Service.

Categories of Data Subjects

• Real estate leads (buyers, sellers, renters) who interact with your chatbot or landing pages

Types of Personal Data

• Contact information (phone number, email address, name)
• Property preferences (area, budget, property type, bedrooms)
• Conversation messages (WhatsApp, landing page chat)
• Booking and viewing information
• Lead scoring data (engagement signals, qualification answers)

3. Processor Obligations

NeraTek shall:

• Process Personal Data only on your documented instructions (i.e., to provide the Service)
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures (see Section 6)
• Not engage a Sub-processor without prior notification (see Section 5)
• Assist you in responding to Data Subject requests (access, erasure, portability, restriction)
• Notify you without undue delay (within 48 hours) of any Personal Data breach
• Delete or return all Personal Data upon termination, subject to legal retention obligations (see Section 11)
• Make available all information necessary to demonstrate compliance and allow audits

4. Controller Obligations

You shall:

• Ensure you have a valid legal basis for processing (legitimate interest, consent, or contract)
• Provide clear instructions to NeraTek regarding the processing of Personal Data
• Respond to Data Subject requests within GDPR timeframes (typically 30 days)
• Notify NeraTek of any changes that may affect the processing of Personal Data

5. Sub-processors

NeraTek uses the following Sub-processors:

Stripe and InvoiceXpress are not Sub-processors: they process only your own subscription, payment and invoicing data, for which NeraTek is an independent controller, and receive no lead data. To show your listings on a map, the addresses of your property listings may be sent to Google's Geocoding API (when enabled) or to OpenStreetMap's Nominatim service; no lead data is sent.

The list of Sub-processors may change. NeraTek will notify you by email at least 30 days before adding or replacing a Sub-processor. You may object within that period on reasonable data protection grounds.

6. Security Measures

NeraTek implements the following technical and organizational measures:

• AES-256-GCM encryption for sensitive tokens (OAuth, API keys)
• TLS for all data in transit
• Tenant isolation: every application query is filtered by agency, with PostgreSQL row-level security as an additional safeguard
• Role-Based Access Control (superadmin, agency_admin, agent)
• Rate limiting on authentication and API endpoints
• Audit log of data changes, exports of personal data and GDPR erasures
• Automated data retention (the periods in section 7, enforced nightly)
• Daily backups at 03:00 of the application, automation and assistant databases, kept for 35 days on the server and copied over TLS to DigitalOcean Spaces object storage in Frankfurt (EU), where copies older than 35 days are deleted daily. Backup files are encrypted on the server before upload (rclone crypt: XSalsa20-Poly1305 for the content, AES for file names) and the keys are kept separately from the storage; access to the storage is restricted. A full restore of the production database from the encrypted copies was tested in October 2026.
• Content Security Policy (CSP) with nonce-based script protection

7. Data Retention

• Leads: Anonymized after 24 months with no message in either direction and no update to the lead (the period restarts on any message or update), unless a viewing is upcoming or a deal is open; the phone number is removed
• Opted-out leads: Anonymized 30 days after the later of the lead's last activity and its last update, unless a viewing is upcoming or a deal is open; only the phone number and dates are kept, as a suppression record
• Conversation messages: Content anonymized 12 months after the conversation's last message
• Assistant short-term memory: Deleted 30 days after the conversation goes quiet; the lead's answer to the property-alerts offer is kept as a consent record
• Finder profiles, preferences and topics: Anonymized (finder profiles) or deleted (preferences and topics) after 6 months without an update
• Viewing approval requests: Deleted after 24 months
• Web-chat sessions that did not become a lead: Identifiers removed after 12 months
• Analytics (phone numbers): Removed after 12 months
• Error logs: Deleted after 90 days
• Backups: Deleted after 35 days
• Account data: Deleted within 30 days after account termination or on request (a manual process carried out by NeraTek)

8. Data Subject Rights

NeraTek provides tools in the portal to help you fulfill Data Subject requests:

• Right of access: Export lead data via CSV
• Right to erasure: GDPR deletion button in lead detail panel. The phone number is kept as a do-not-contact (suppression) record so the person is not contacted again
• Right to restriction: Processing restriction toggle per lead
• Right to portability: Full data export in machine-readable format

9. Data Breach Notification

In the event of a Personal Data breach, NeraTek will notify you within 48 hours of becoming aware, including: the nature of the breach, categories of data affected, likely consequences, and measures taken to mitigate. You remain responsible for notifying the CNPD (Portuguese DPA) within 72 hours and affected individuals where required.

10. International Transfers

Personal Data is stored in the EEA (hosting and backups in Frankfurt, Germany). Where a Sub-processor processes Personal Data outside the EEA, NeraTek ensures appropriate safeguards are in place as listed in Section 5 (EU-US Data Privacy Framework, Standard Contractual Clauses, or Binding Corporate Rules).

11. Duration & Termination

This DPA remains in effect for the duration of your use of the Service. At termination, or earlier on your request, NeraTek deletes all Personal Data within 30 days, except where retention is required by law. This deletion is carried out manually by NeraTek, not automatically. Backup copies are deleted when they reach the end of the 35-day backup cycle.

12. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service.

13. Contact

For data protection inquiries: privacy@neratek.net

Portuguese Data Protection Authority (CNPD): www.cnpd.pt