Data processing agreement

This agreement is between you, the workspace owner (the controller), and CODECRETE (the processor). It forms part of our terms of service, and you accept it when you create your workspace. Changes to it are announced, and accepted by continuing to use Assetly, as the terms of service describe.

It covers only the personal data you and your members enter into your workspace. For account, subscription and payment data we are the controller, as our privacy notice explains.

By accepting this agreement, you confirm that you have the right to enter the data of the people you record in Assetly, and that you will inform them and obtain their consent where the law requires it, for example before keeping an image of someone’s national ID or entering a minor’s data (with their parent’s or guardian’s written consent).

We process your workspace’s data to run Assetly for you: to store it, and to show it to your workspace’s members according to their roles. We process it for no other purpose.

People: your co-owners, tenants, buyers, staff and other members, including people who never sign in.

Data: identity data (names, national ID numbers and ID card images), contact details, contracts, financial data (revenue, expenses, invoices, earnings and ownership splits), legal disputes, and the files you attach.

We process the data for as long as your workspace exists, then for the export period described below, then we delete it.

We process the data only on your instructions, which are your use of Assetly and its settings. If we believe an instruction breaks the law, we will tell you straight away.

Only the people at CODECRETE who need it to run and support the service can reach your data, and each of them is bound to keep it confidential.

We protect your data with encrypted connections, hashed passwords, private file storage reached only through short-lived links, role-based access, database-level separation between workspaces, a record of who opens which file, continuous threat detection and automatic deletion of what you remove.

You authorize us to use the sub-processors listed in the annex below. We will tell you before we add or replace one, and you may object or end this agreement if you do not accept the change.

Your workspace’s data is stored in Germany (Amazon Web Services, Frankfurt) under the cross-border transfer license of Egypt’s Personal Data Protection Center. We will not move it to another country without updating that license and telling you first.

Assetly gives you the tools to export, correct and delete the data in your workspace, so you can answer the requests of the people it concerns. If someone sends a request about your workspace to us directly, we will deal with it within the time the law allows and tell you.

If a breach affects your workspace’s data, we will tell you without undue delay, and within 24 hours of becoming aware of it, with the information you need to inform the people concerned. As a processor, we also report it to the Personal Data Protection Center as the law requires.

On reasonable notice, we will give you the reports and confirmations you need to show that we comply with this agreement. The Personal Data Protection Center may inspect us as the law allows.

When you delete your account, you have 30 days to download your data. After that we delete it from our database and file storage, and from our backups within 30 more days, except anything the law requires us to keep.

Each party is responsible for its own obligations under this agreement and the law. You are responsible for having a lawful basis for the data you enter. The limits in our terms of service apply.

If this agreement and our terms of service differ on a data protection matter, this agreement prevails.

Amazon Web Services: hosting, the database, file storage, email delivery and scheduled tasks, in Frankfurt, Germany.

Vercel: delivers the website’s pages; workspace data passes through it while a page is shown and is not stored there.

Our payment provider: processes the workspace owner’s subscription payments. It receives no workspace data.

Changed on 28 October 2026, applying from that date: “a record of every file opened” in the security measures above now reads “a record of who opens which file”.

Our data protection officer: privacy@assetly-app.com.