Data Processing Agreement
Version 1.0 — 6 August 2026
This data processing agreement forms an integral part of the RealGrip terms of service (Nunderdogs Software) and applies automatically to every customer. No separate signature is required. It governs how we, as processor, handle personal data that you, as controller, process in RealGrip.
1. Roles and scope
For personal data that you or your users enter in RealGrip — for example about tenants, contact persons, employees and suppliers — you are the controller and we are the processor within the meaning of the GDPR. This agreement applies for as long as we process personal data on your behalf.
2. Subject matter and instructions
We process personal data solely to provide the service: storing, displaying, processing and sending within RealGrip's features. Your instructions consist of the agreement, this data processing agreement and the settings you choose in the application. We do not process for our own purposes and never sell data.
3. Categories of data and data subjects
This concerns data you enter or have entered, such as name, address and contact details, contract, payment and file data, and inspection reports. Data subjects include tenants, tenant contacts, employees, suppliers and other relations of your organisation.
4. Confidentiality
Only people who need it for their work get access to personal data. They are bound by confidentiality. Access is limited to what is necessary and is logged.
5. Security
We take appropriate technical and organisational measures within the meaning of Article 32 GDPR: encrypted connections (TLS), encrypted storage of sensitive data, strict access restriction with logging, and daily backups. An up-to-date overview is on our security page.
6. Sub-processors
You give general authorisation for engaging sub-processors. We remain fully responsible for their work. Current sub-processors: mijn.host (hosting, data centres in the Netherlands; dedicated servers in the Netherlands or France), Stripe and Mollie (payments), SignHost (digital signing), and — only when you use an AI feature — OpenAI and Anthropic (AI processing, US, on the basis of the EU-US Data Privacy Framework and standard contractual clauses). Services you connect yourself (such as Microsoft 365 or Google) fall under your own relationship with that provider. New or changed sub-processors are announced at least 30 days in advance; in case of a substantiated objection you may terminate the agreement.
7. Transfers outside the EEA
Personal data is stored within the EU. Transfers outside the EEA only take place for the AI and payment services mentioned above, always on the basis of a valid transfer mechanism (adequacy decision or standard contractual clauses).
8. Assistance with rights and obligations
You handle data-subject requests (access, rectification, erasure, portability) primarily yourself using the export and management tools in the application. Where that is not sufficient, we assist within a reasonable term. We also provide reasonable assistance with a DPIA or supervisory-authority questions insofar as they concern our processing.
9. Data breaches
If we discover a personal-data breach affecting your data, we inform you without undue delay and at the latest within 48 hours of establishing it, with the information you need for any notification to the supervisory authority and to data subjects. Notifying the supervisory authority remains your responsibility as controller.
10. Verification and audit
We demonstrate compliance with this agreement primarily through documentation and reports. If that is not sufficient, you may have an audit performed at most once a year, after at least 14 days' notice, at your own expense, by an independent expert, under confidentiality and without unnecessary disruption of our services.
11. End of the agreement
After the agreement ends you can export your data for another 30 days. After that we delete all personal data, unless a statutory retention obligation applies. Data in backups disappears automatically through the backup rotation schedule.
12. Final provisions
The provisions of the terms of service apply to this data processing agreement, including the liability arrangement and the choice of Dutch law. In case of differences between translations, the Dutch version prevails. Questions? beheer@nunderdogs.com.