Osela

Data processing terms (for agents)

Last updated: Oct 2026

These terms are a data processing agreement under Art. 28 GDPR between the agent (the controller) and Serhii Fursenko, JDG, NIP 5252941609, ul. Jerzego Holzera 4/227, 02-972 Warszawa (the processor, the "Operator"). They apply once the agent ticks their acceptance in the agent profile, and run until the account is deleted.

1. Subject and purpose

The Operator provides the Osela service, including the enquiry form in client links and the list of enquiries in the agent's account. The Operator processes data only to receive clients' enquiries, store them and make them available to the agent.

2. Data and people concerned

People: the agent's clients who send an enquiry from the agent's link. Data: name, phone number, e-mail address, the flat's address and size, the consent text and the time of the enquiry.

3. The agent's instructions

The Operator processes data only on the agent's documented instructions; using the service as it works is the instruction. If the Operator believes an instruction breaks data protection law it will say so without delay.

4. Confidentiality

The Operator ensures that the people authorised to process the data are bound by confidentiality.

5. Security (Art. 32 GDPR)

  • traffic between users and the service is encrypted (HTTPS);
  • the database is not reachable from the internet;
  • enquiries can be read only by the account holder (the account's secret), not by other agents;
  • enquiries are deleted automatically after 12 months.

6. Sub-processors

The agent agrees to the Operator using Hetzner Online GmbH (hosting, Germany) and Cloudflare, Inc. (DNS, content delivery and attack protection). The Operator uses no other sub-processors. Changes will be announced on this page; the agent may object by deleting the account. The Operator is responsible for its sub-processors as for itself.

7. Data subjects' rights

Requests from people (access, correction, erasure, restriction, portability, objection, withdrawing consent) are handled by the agent as controller. The Operator will pass on any request it receives and help to fulfil it. The agent can view, export (CSV) and delete enquiries in their account.

8. Breaches

The Operator will report a personal data breach to the agent without undue delay and within 48 hours of establishing it, with the information needed to notify the supervisory authority.

9. Deletion and audit

When the account is deleted the Operator deletes the account, agent card, client links and enquiries; enquiries older than 12 months are deleted automatically. On request the Operator provides the information needed to show compliance with Art. 28 GDPR and allows audits in an agreed way.

10. Transfers outside the EEA

The Operator does not transfer the data outside the European Economic Area, except as the sub-processors above do under the safeguards they publish.

11. Contact

For these terms write to [email protected].

Data processing terms (for agents) | Osela