Data processing agreement

Data processing agreement

This data processing agreement ("Agreement") forms part of the agreement between you ("Controller") and Label84, trading as Kamerinspectie ("Processor"), and applies as soon as you create an account and use our services in the role of controller for third-party data that you process through the platform.

Introduction

When using Kamerinspectie, you may process personal data of third parties, such as tenants, in inspection reports and the related photos. In that relationship you are the controller, and Label84 acts as processor within the meaning of the General Data Protection Regulation (GDPR). This agreement sets out the arrangements for this.

Subject and duration

This agreement applies as long as you use the services of Kamerinspectie and ends automatically when your account is terminated, subject to the provisions on the return and deletion of data.

Nature and purpose of the processing

Label84 processes personal data solely for the purpose of providing the services of Kamerinspectie, including storing, processing, synchronising and making available inspection reports, photos, signatures and other data.

Label84 does not process personal data for its own purposes outside the provision of the services.

Categories of data subjects and personal data

The processing may concern personal data of tenants, landlords, property managers and other data subjects who appear in inspection reports.

The personal data may include:

• Name and contact details;
• Address details;
• Photos of properties and contents;
• Photos in which people may be recognisable;
• Signatures;
• Other data entered by the controller.

Obligations of the processor

Label84 processes personal data only on the basis of documented instructions from the controller, including the way in which the services are used.

Label84 does not process personal data for its own purposes, does not keep personal data longer than necessary for providing the services, and takes appropriate technical and organisational measures to secure personal data.

If Label84 believes that an instruction violates the GDPR or other applicable privacy legislation, Label84 will inform the controller without delay.

Sub-processors

Label84 uses the following sub-processors:

• Leaseweb (hosting, the Netherlands)
• Mollie (payment processing, the Netherlands)
• AWS (cloud and storage services, Sweden/EEA)
• AWS (email services, Sweden/EEA)

Label84 will inform the controller in advance about changes to sub-processors. The controller has the right to object to this on reasonable grounds.

Label84 ensures that sub-processors are contractually bound to obligations at least equivalent to the obligations under this agreement. Google Analytics is not considered a sub-processor under this agreement, as this service only processes anonymised website visitor data and has no access to inspection reports or the personal data they contain.

International transfers

Personal data is in principle processed only within the European Economic Area (EEA).

If personal data is processed outside the EEA, this will only take place on the basis of a valid transfer mechanism in accordance with the GDPR, such as adequacy decisions or standard contractual clauses.

Security measures

Label84 takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access and unlawful processing.

These measures include:

• Encrypted data transfer (TLS);
• Access management and authorisations;
• Authentication and account security;
• Logging and monitoring;
• Regular security updates;
• Backup and recovery procedures;
• Periodic evaluation of security measures.

Data breach notification

If Label84 becomes aware of a security incident involving personal data processed under this agreement, Label84 will inform the controller without undue delay and no later than 48 hours after becoming aware of the incident.

Where possible, Label84 will provide information about the nature of the incident, the personal data affected, the likely consequences and the measures taken or proposed.

Assistance to the controller

On reasonable request, Label84 will assist the controller in complying with its obligations under the GDPR, including requests from data subjects for access, rectification, erasure, restriction of processing, data portability and objection.

Label84 will also provide reasonable support with data protection impact assessments (DPIAs) and consultations with supervisory authorities, to the extent required by law.

Confidentiality

Label84 ensures that persons authorised to process personal data have committed themselves to confidentiality in writing or are under an appropriate statutory obligation of confidentiality.

Requests from authorities

If Label84 receives a binding request from a competent authority concerning personal data processed under this agreement, Label84 will inform the controller, unless this is prohibited by law.

Liability

The liability of Label84 under this agreement is governed by the liability provisions in the terms of service of Kamerinspectie.

Return and deletion of data

After the account is terminated, personal data remains available for export or recovery for up to 30 days.

After this period, Label84 deletes the personal data, unless a statutory retention obligation or compelling technical necessity requires a longer retention period.

Governing law

This agreement is governed by Dutch law. Any disputes arising from this agreement will be submitted to the competent court in the Netherlands.

Contact

Questions about this data processing agreement can be sent to:

Label84
Chamber of Commerce: 88004279
Email: info@label84.com
Website: www.label84.com

This data processing agreement was last updated on 2 July 2026.