In brief

This data processing agreement (DPA) governs how Quotum, the SaaS for Belgian syndic and co-ownership (VME) offices, processes personal data on behalf of the syndic office that uses the service. It is mandatory under Article 28(3) of the General Data Protection Regulation (GDPR) and forms part of the main agreement (the subscription) between the office and Quotum.

The division of roles is as follows. For the personal data of co-owners, tenants, suppliers and the associations of co-owners (VMEs), the syndic office is the controller; Quotum, operated by Solvizen BV (in oprichting), is the processor. For the office's own account and user data of the office and its staff, Quotum, operated by Solvizen BV (in oprichting), is itself the controller. That second processing falls outside this DPA and is explained in Quotum's privacy statement.

At a glance: Quotum processes the data solely on the office's instructions, keeps it within the EU, secures it with concrete technical and organisational measures (including tenant isolation, mandatory two-factor authentication, encryption and an audit log), engages only EU sub-processors that you know in advance, reports data breaches promptly, assists you with data-subject requests, and returns or deletes the data at the end. The full, binding arrangements are set out in the blocks below plus the three annexes.

Layered reading guide

• If you only want to know what Quotum does with the data and why you can sign with confidence: read the In brief block above.
• If you want the legal substance per obligation of Article 28(3): read blocks 1 through 12.
• If you want the concrete, technical detail (which data, which security, which sub-processors): read Annex 1, Annex 2 and Annex 3 at the bottom.
• Every point where a legal or human decision is still needed is marked with. This DPA is a carefully drafted basis and not final legal advice; have it confirmed by a data protection lawyer before use with real customers.

1. Parties

The processor is Solvizen BV (in oprichting); its company number and registered office will be published after incorporation. Quotum is currently a trade and product name of Solvizen BV (in oprichting). A separate company for Quotum will be incorporated at a later stage; until then, the rights and obligations under this DPA apply towards Solvizen BV (in oprichting). In this text, the names Quotum and Solvizen BV (in oprichting) are used interchangeably and denote the same processor.

The controller is the syndic office that has concluded the main agreement (the Quotum subscription) with Solvizen BV (in oprichting), as identified in that main agreement or in the sign-up and signature process in the application.

Data protection contact point at Quotum: privacy@quotum-app.be. General contact: info@quotum-app.be. Website: quotum-web.be. Application: quotum-app.be.

2. Definitions and order of precedence

The terms personal data, processing, controller, processor, data subject, personal data breach (data leak), special categories of personal data and supervisory authority have the meaning given to them by Article 4 and following of the GDPR. The supervisory authority is the Belgian Data Protection Authority (GBA), in French Autorité de protection des données (APD).

This DPA forms an integral part of the main agreement between the parties. In the event of a conflict between this DPA and the main agreement regarding the protection of personal data, this DPA prevails. For the rest, the main agreement continues to apply. Annexes 1 to 3 form an integral part of this DPA.

3. Subject matter, duration, nature and purpose of the processing (art. 28(3), introductory sentence)

Subject matter: the hosting and processing of the syndic and VME files within the Quotum platform, for the purpose of providing services to the controller.

Duration: the processing continues for as long as the main agreement (the subscription) is in force, plus the return and deletion period after the end of the agreement as governed in block 11 and the statutory retention periods in Annex 1.

Nature: the collection, recording, organisation, structuring, storage, updating, consultation, use, linking, back-up, transmission by email, restriction, erasure and destruction of personal data, in each case solely in function of the service.

Purpose: the delivery of the Quotum services, namely the VME accounting, the settlements, the management of lots, co-owners and suppliers, the bank processing (including CODA), the general assembly, communication and the co-owner portal. Quotum processes the data solely in the service of the controller and not for its own purposes.

The categories of personal data and of data subjects are listed in Annex 1, so that a later extension of the service affects only that annex and not the main text.

4. Processing solely on documented instruction (art. 28(3)(a))

Quotum processes the personal data solely on the documented instruction of the controller, including with regard to any transfers of personal data to a third country or an international organisation, unless a provision of Union or Belgian law applicable to Quotum requires Quotum to process. In that case, Quotum informs the controller of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest.

The following constitute a documented instruction: this DPA and the main agreement, the use and configuration of the platform by the controller and its authorised users, and any additional written instruction (including in electronic form) that the controller addresses to Quotum via a designated contact point.

Quotum does not use the personal data for its own purposes. In particular, customer data is not used to train or improve products or models, nor for its own analysis beyond delivering the service, without a separate legal basis and a separate role as controller. This applies expressly to the optional AI assistant Bizzy and to visit statistics; see Annex 3.

Duty to report a conflicting instruction: if an instruction of the controller, in Quotum's opinion, infringes the GDPR or other data protection provisions of Union or Belgian law, Quotum immediately informs the controller of this.

5. Special categories of personal data (art. 9)

The platform is not intended for the processing of special categories of personal data within the meaning of Article 9 GDPR (such as health data). Such data may, however, exceptionally arise, for example in a damage file or in an accessibility file of a lot or building.

If this is the case, Quotum processes that data only on the instruction of the controller and only within that file, with the same security measures as for the other data. The controller remains responsible for the legal basis and for the assessment of whether this processing is permissible, and limits the input of such data to what is strictly necessary.

6. Confidentiality (art. 28(3)(b))

Quotum ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Concretely, this means: confidentiality clauses in the employment and subcontracting agreements of those with access, access based on the need-to-know principle and on role-based authorisation, and a confidentiality obligation that survives the end of the employment or the assignment. The access of staff and of any subcontractors is limited to what is necessary for the performance of the service.

7. Security: technical and organisational measures (art. 28(3)(c) in conjunction with art. 32)

Quotum takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of data subjects.

The concrete measures are listed in Annex 2. They include, among others, encryption of data in transit and at rest, tenant isolation at the database level (row level security) so that offices cannot see each other's data, role-based access control, mandatory two-factor authentication (TOTP), an immutable audit log, soft-delete with audited purge, back-up and recovery procedures, logging and monitoring, and EU hosting.

Quotum periodically evaluates and tests the effectiveness of these measures. In the event of a material change that may lower the level of security, Quotum informs the controller in advance, so that it can assess the appropriateness. Quotum ensures that the persons acting under its authority and having access to the personal data process it only on the instruction of the controller, unless a legal obligation provides otherwise (art. 32(4)).

8. Sub-processors (art. 28(2), 28(3)(d) and 28(4))

The controller grants Quotum a general written authorisation to engage sub-processors for the performance of the service. The current list of sub-processors, with the role, region and status per service, is set out in Annex 3.

For any intended change (addition or replacement of a sub-processor), Quotum informs the controller in advance, via the release-notes channel per portal and/or by email, so that it has the opportunity to raise a reasoned objection within 30 calendar days of the notification. In the event of a well-founded objection, the parties consult in good faith; if no solution can be found, the processing concerned may be suspended or the main agreement may be terminated for the part concerned.

Quotum imposes on each sub-processor, by agreement, the same data protection obligations as those in this DPA, with sufficient guarantees regarding appropriate technical and organisational measures. If a sub-processor fails to fulfil its obligations, Quotum remains fully liable towards the controller for the performance of that sub-processor's obligations.

9. International transfers (art. 44 to 49)

Quotum and the active sub-processors listed in Annex 3 process the personal data within the European Union or the European Economic Area.

If, for a specific function or for support, a transfer outside the EEA were nevertheless to take place, it occurs only on the documented instruction of the controller and with a valid transfer mechanism within the meaning of Chapter V GDPR, as a rule the standard contractual clauses of Implementing Decision (EU) 2021/914, supplemented where necessary by a transfer impact assessment. This transfer mechanism is separate from this DPA based on Article 28.

10. Assistance with data-subject rights (art. 28(3)(e))

Taking into account the nature of the processing, Quotum assists the controller by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to data-subject requests. This concerns the exercise of the rights of access, rectification, erasure, restriction of processing, portability and objection (art. 12 to 23 GDPR).

Concretely: the platform offers functions to consult, correct, export and delete data. If Quotum receives a request directly from a data subject, Quotum does not answer that request itself but forwards it within 5 working days to the controller, who handles the request.

In the event of an erasure request, the method of block 11 applies: deletion proceeds via soft-delete followed by a manual, audited purge, taking into account the statutory retention obligations and the immutable evidential and accounting data. No fully automated erasure is promised. Separately, Quotum, as controller of the sign-in accounts, automatically erases an account without any access after the period stated in the privacy statement; the office's own data (parties, files, accounting) is not affected.

11. Assistance with security, data breaches, DPIA and prior consultation (art. 28(3)(f))

Taking into account the nature of the processing and the information available to Quotum, Quotum assists the controller in fulfilling its obligations under Articles 32 to 36 GDPR.

Data breach (art. 33 and 34): as soon as Quotum becomes aware of a personal data breach, Quotum informs the controller thereof without undue delay and at the latest within 48 hours of detection, so that the controller can meet the 72-hour deadline towards the APD. The notification contains, insofar as available, at least: the nature of the breach, the categories and estimated number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Quotum provides reasonable assistance with any communication to the data subjects.

DPIA and prior consultation (art. 35 and 36): Quotum provides reasonable assistance in carrying out a data protection impact assessment and, where necessary, in the prior consultation of the APD, by providing the information available for that purpose on the processing and the security measures.

12. Return or deletion at the end, and retention periods (art. 28(3)(g))

After the end of the provision of the processing services, Quotum, at the choice of the controller, deletes all personal data or returns it to the controller, and deletes the existing copies, unless Union or Belgian law requires the storage of the personal data. Return takes place in a common, reusable export format within a reasonable period after the end of the agreement, followed by confirmed deletion, including from the back-ups according to the back-up rotation cycle.

Deletion proceeds technically via soft-delete (marking with deleted_at) followed by a manual, audited purge. No fully automated erasure or anonymisation is promised. Two categories are deliberately not deleted for as long as the retention obligation runs: the accounting ledger is immutable (corrections are made via reversal, not via deletion) and the evidential data upon signature is append-only.

The following retention periods apply and must be taken over by the controller in its own record of processing activities:

• Accounting and tax documents: 7 years, counting from 1 January of the year following the closure of the accounting year.
• Correspondence and messages: 7 years.
• Minutes of the general assembly, contracts and insurance policies: for as long as the VME concerned exists.
• Account and user data of the office and its staff: until the end of the agreement plus 12 months, then deleted or anonymised.
• Evidential context upon signature (IP address, user-agent, signature PNG and the generated PDF): 10 years after the end of the agreement, in line with the common-law limitation period.
• Technical and security logs: 6 to 12 months.
• Header data of incoming email (mailbox_message): 30 days, then erased automatically, and when the mailbox is unlinked at the next polling round (within five minutes).

13. Audits and inspections (art. 28(3)(h))

Quotum makes available to the controller all information necessary to demonstrate compliance with the obligations under Article 28, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor mandated by it.

In practice: an audit takes place in principle at most once a year, and in addition whenever there is a reasonable presumption of a breach or after a data breach. The controller announces an audit reasonably in advance (as a rule at least 30 calendar days), respects the confidentiality and continuity of the service, and bears its own costs, unless the audit reveals a material shortcoming of Quotum. Quotum can satisfy the audit obligation by making available independent audit reports or certifications (such as ISO 27001 or SOC 2), in order to limit repeated on-site inspections.

Quotum recalls in this context that it immediately informs the controller if an instruction is, in its opinion, contrary to the GDPR or to other data protection provisions (see block 4).

14. Liability and penalties (art. 82 and 83)

Each party is liable in accordance with Article 82 GDPR. Quotum, as processor, is liable for the damage caused by the processing where it has not complied with the obligations of the GDPR specifically directed at processors, or where it has acted outside or contrary to the lawful instructions of the controller.

Quotum indemnifies the controller against damages and administrative fines that are the direct consequence of a shortcoming attributable to Quotum or to its sub-processors under this DPA. For the shortcomings of its sub-processors, Quotum remains fully liable (art. 28(4)). The liability of the controller towards Quotum follows from its own instructions and obligations as controller.

As a reminder: infringements of the obligations of processors and controllers arising from, among others, Article 28 are subject to administrative fines of up to 10 million euros or 2 percent of the total worldwide annual turnover; the most serious infringements can rise to 20 million euros or 4 percent (art. 83).

15. Duration, amendment, termination and applicable law

This DPA enters into force at the start of the processing, in principle upon the onboarding of the office, and applies for as long as Quotum processes personal data on behalf of the controller. It does not apply retroactively; the processing may only begin after this DPA has been concluded. The DPA ends together with the main agreement, without prejudice to the provisions that by their nature continue to apply (such as the return and deletion, the retention periods, the confidentiality and the liability).

Amendments to the annexes that reflect the service (such as an updated description of the processing, of the security measures or of the sub-processor list) are communicated in accordance with block 8 and, where applicable, via the version-controlled documents in the application. Material amendments to the main text are made in writing.

This DPA is governed by Belgian law. Disputes fall within the jurisdiction of the courts as designated in the main agreement. The competent supervisory authority is the Data Protection Authority (APD) / Gegevensbeschermingsautoriteit (GBA).

This DPA is concluded in writing, including in electronic form, and is signed by both parties. Signature may take place via the signature and consent flow provided in the application, whereby the evidential context (date, time, version and signature) is recorded as described in Annex 1.

Annex 1: Description of the processing

Subject matter, nature, duration and purpose: as described in block 3. The processing concerns the provision of services of the Quotum platform to the syndic office and continues for the duration of the main agreement, plus the return, deletion and statutory retention periods.

• Categories of data subjects: co-owners; tenants; members of the council of co-ownership and the auditor of the accounts; suppliers and service providers and their contact persons; staff of the syndic office; users of the co-owner portal.
• Identification and contact data (party): salutation, first name, surname, company name, display name, language, email, telephone, mobile, full postal address (street, house number, box, postal code, municipality, country), VAT number, CBE number, foreign VAT number, customer number with the supplier and free-text notes.
• Financial and payment-behaviour data (party): among others reminder blocking, art. 30bis marking, payment-plan date and interest exemption, together with the account history, provisions and invoices relating to the data subject.
• Bank data: IBAN and BIC of parties (party_bank_account); IBAN, BIC and holder name and, from imported CODA bank statements, the name and IBAN of counterparties (banking, coda_movement); mandate and payment data (SEPA mandates, payment batches).
• Additional contact persons (party_contact): name, function, email, telephone and language.
• Lot and share data: lot, quotity and share of a unit, and the link to a data subject.
• Login and authentication data: login email of the co-owner (portal_user); email and full name of the office staff member (app_user) and, per office, their function, telephone and mobile (membership); metadata of the two-factor authentication and hashed 2FA recovery codes (mfa_recovery_code); the TOTP secret itself is kept with the authentication service.
• Device and session data (connected devices / active sessions): for each sign-in session, the IP address, the browser and operating system derived from the user-agent, the time of first and last activity and the two-factor level, read from the sessions of the authentication service; and an approximate location (city, country) derived offline from the IP address with a local geolocation database, without an external sub-processor. Users see and end only their own sessions.
• General assembly data: proxy and contact data (proxyTargetName, proxyTargetEmail, contactEmail), the frozen snapshot of eligible voters (partyId, name, shares) and login-less voting credentials bound to a pseudonymous device identifier.
• Documents: settlements, invoices, work orders, minutes and contracts carrying personal data, stored in the document storage.
• Linked mailbox of an office staff member (user_mailbox, mailbox_message): the address of the mailbox and a reference to the access token in the vault; of messages that came in from addresses in the files, only the sender, the subject, the time and the provider's message reference, visible to the owner of the mailbox alone and not during a support impersonation. The content of messages is read live and not stored.
• Evidential data upon signature (terms_acceptance): user identification, nature and version of the signed document, moment, IP address, user-agent, the hash of the signed text, the applied signature as PNG and the generated signed PDF, kept in a private storage bucket. The signature is a simple electronic signature within the meaning of Article 25 eIDAS.
• Support and audit data: the IP address and session data of a support impersonation (support_session, time-bound) and the audit log that records per mutation who changed what and when, whereby the changed content may contain personal data.
• Optional AI assistant Bizzy: the questions typed by the staff member and the answers, kept in the database and limited to the most recent conversations; active only if Bizzy is configured. The typed question may contain personal data and falls under the no own purposes rule (block 4).
• Special categories (art. 9): in principle not intended; exceptionally possible in damage or accessibility files, and then only on instruction and within that file (block 5).

Annex 2: Technical and organisational security measures (art. 32)

• Encryption: data encrypted in transit (TLS) and at rest at the hosting service.
• Tenant isolation: strict separation between offices at the database level via row level security, supplemented by building and office scope, so that offices and buildings cannot view each other's data.
• Access control: role-based authorisation, access on a need-to-know basis, and a limited circle of authorised persons under confidentiality.
• Strong authentication: mandatory two-factor authentication (TOTP) for all users, with one-time, hashed recovery codes.
• Immutability and traceability: append-only audit log with actor attribution for every mutation; immutable accounting ledger with corrections via reversal; append-only evidential data upon signature.
• Soft-delete and audited purge: data is first marked as deleted and only thereafter definitively erased via a manual, audited purge, taking into account the retention periods.
• Availability and recovery: back-up and recovery procedures with a defined rotation cycle.
• Logging and monitoring: technical and security logs (kept 6 to 12 months,); an own, same-origin client-error sink that is deliberately PII-light (only audience and path, no search string, no identity).
• Network and application security: strict Content Security Policy with per-request nonce, HSTS, X-Frame-Options DENY, frame-ancestors none and a restrictive Permissions-Policy; in-memory rate limiting per process (no external service).
• EU hosting: storage and processing within the EU/EEA at the active sub-processors listed in Annex 3.
• Change management: periodic evaluation and testing of the effectiveness, and advance information to the controller in the event of a material change that may lower the level of security.
• Bounded support: a support impersonation is read-only by default, RLS-bounded and fully audited, and expires after 60 minutes of inactivity and at the latest four hours after its start. A session obtains write access only on a request with a reason and after approval by a second, duly authorised Quotum administrator, each time for at most 60 minutes. In no support session, not even with write access, can access be granted or credentials be created (inviting staff, changing a staff member's role or status, resetting two-step verification, granting or reopening portal access, connecting a mailbox or a bank). The start, request, approval or refusal and end of every session are logged with time and person.

Annex 3: List of sub-processors

All the services below are EU- and GDPR-compliant. The status is stated per service. Services with the status not yet activated carry no traffic at this time and do not yet process customer data; they are only engaged upon activation of the relevant function, and then according to the notification procedure of block 8. Changes to this list are communicated as described in block 8.

• Supabase (database, authentication including TOTP-2FA, and storage of documents and the signatures bucket): ACTIVE, EU (Ireland).
• Vercel (application hosting of the Next.js app): ACTIVE, EU (Dublin).
• Vercel Web Analytics (aggregated visit statistics): ACTIVE but cookieless and first-party; uses no tracking cookies and collects only aggregated visit statistics once Vercel Pro analytics is enabled.
• Vercel AI Gateway (relay service for the assistant): NOT YET ACTIVATED; carries traffic only upon activation of the Pro assistant Bizzy.
• Brevo (Sendinblue) (transactional email: invitations, settlement emails, support): technically configured, used for system emails.
• Mistral via Vercel AI Gateway (the optional Pro AI assistant Bizzy): NOT YET ACTIVATED.
• Google Document AI (OCR of scanned invoices): NOT YET ACTIVATED.
• Peppol access point (e-invoicing, inbound and outbound): NOT YET ACTIVATED.
• Combell (domain registrar for quotum-web.be and quotum-app.be): ACTIVE.

Version, date and signature

Version 1.3, 14 October 2026.

This data processing agreement is signed by both parties and forms an integral part of the main agreement. For the processor: Solvizen BV (in oprichting), trading under the name Quotum. For the controller: the syndic office as identified in the main agreement.

This document is a carefully drafted basis and not final legal advice. Have it validated, before use with real customers, by a data protection lawyer, with particular attention to every marking.