Data processing agreement (Rental, Realty, Tours)

Version 2026-11-04

This agreement is between the business that subscribes to RENTAL ENTERPRISE 360, REALTY ENTERPRISE 360 or TOURS ENTERPRISE 360 (the "Client"), which is the controller of the personal data it keeps in the software, and TeamByte SHPK (NUIS M61810052H, Rr. Thoma Koxhaj, Tiranë, Albania), "TeamByte", which provides the software and is the processor of that data. It is part of the Client's subscription and applies under the law of the Republic of Albania on personal data protection and, where it applies, the EU General Data Protection Regulation. e-Avokati has its own agreement.

1. What TeamByte processes and why

• Purpose: only to provide the software to the Client: storing, showing, searching, printing and sending data as the Client uses the software, the Client's booking or listings website, backups and their security.
• Data subjects: the Client's customers (renters, drivers, travellers, buyers, tenants, owners), people who book or write through the Client's website, the Client's partners and staff.
• Types of data: names, contact details, identity document and driving licence numbers when the Client records them, bookings, contracts, payments and invoices, notes, messages, uploaded documents and photos, vehicle positions when the Client connects GPS, and the Client's staff accounts.
• Duration: for as long as the subscription runs, and then as described in section 9.

2. Only on the Client's instructions

TeamByte processes the data only on the Client's documented instructions: this agreement, the settings the Client chooses in the software and its staff's actions in it. TeamByte never uses the data for its own purposes, never sells it and never uses it to train artificial intelligence. If the law requires TeamByte to act otherwise, it tells the Client first, unless the law forbids that.

3. Confidentiality

Only a few TeamByte people who need the data to run, secure or support the software can reach it, and each of them is bound to confidentiality. TeamByte staff open a Client's panel only to help it, through a "support session" that is recorded with the person's email.

4. Security

TeamByte keeps appropriate technical and organisational measures, including:

• encrypted connections (HTTPS) everywhere, with browsers required to always use HTTPS; passwords stored only hashed and keys for connected services stored encrypted;
• each Client's data kept separate from every other Client's;
• a second sign-in step (email code or authenticator app) for staff with full rights, and roles that limit who sees what;
• an activity log of staff's main actions;
• nightly, encrypted backups kept away from the main server (on a disk outside the server and in Cloudflare R2), and restore tests;
• security updates and fixes applied without delay.

5. Sub-processors

The Client allows TeamByte to use the sub-processors listed below. TeamByte binds each one to data protection obligations at least as strict as these and remains responsible for them. TeamByte tells the Client about a new or replaced sub-processor at least 30 days in advance, by email, and the Client may object on reasonable grounds; if no solution is found, the Client may close the subscription and is refunded for the unused period. Services marked "only if switched on" receive data only when the Client switches them on in Settings.

6. Helping the Client

TeamByte helps the Client, as far as it can, to answer data subjects' requests (access, correction, deletion, restriction, portability), to keep the data secure, to assess data protection risks and to cooperate with the supervisory authority (the Commissioner for the Right to Information and Personal Data Protection). The Client can do most of this itself in the software.

7. Personal data breaches

If TeamByte learns of a breach that affects the Client's data, it tells the Client without undue delay and no later than 48 hours, with what is known (what happened, which data, likely consequences, what is being done), and keeps it informed. Notifying the authority and the people affected remains the Client's decision as controller; TeamByte helps.

8. Where the data is kept

The data is kept on TeamByte's server in Albania, with an encrypted backup copy in Cloudflare R2. If TeamByte ever transfers data elsewhere, it does so only with safeguards the law accepts and tells the Client first.

9. When the subscription ends

• If a payment is not made, the software keeps working for 14 more days. After that the panel shows only the subscription page, while the data is kept for 60 more days so the Client can come back.
• During that period, and on request, TeamByte gives the Client a copy of its data in a common format (Excel and the uploaded files).
• After that period, TeamByte deletes the Client's data, including from backups as they rotate (within 30 days), except where the law requires TeamByte to keep part of it. Invoices TeamByte issued to the Client are kept as tax law requires.

10. Audits

TeamByte gives the Client the information needed to show that it complies with this agreement. The Client, or an auditor bound to confidentiality, may audit it once a year with 30 days' notice, at the Client's cost, without seeing other clients' data.

11. Liability, changes and law

Liability follows the subscription terms. TeamByte may update this agreement, e.g. for a change in the law; the Client is told by email 30 days in advance. This agreement is governed by the law of the Republic of Albania and disputes are settled by the courts of Tirana.

Data protection contact: [email protected]