Data Controller:

Company Name: Deveeo, s.r.o.
Registered Office: Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic
Company ID No. (IČO): 23522062
Registered: under file No. C 146352/KSBR at the Regional Court in Brno
Email: info@deveeo.cz
Web: www.domee.app (hereinafter the “Provider” or “Deveeo”)

1. INTRODUCTORY PROVISIONS

1.1. This document details the conditions of personal data protection between the Provider and the users of the Domee.app application (hereinafter the “Service”) in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the “GDPR”) and Act No. 110/2019 Coll., on Personal Data Processing.

1.2. The use of the Service is governed by the Service Provision Agreement, which also includes the General Terms and Conditions (GTC) and this Personal Data Processing Policy. Both of these documents are available on the web portal at www.domee.app/obchodni-podminky.

1.3. The Provider declares that it has implemented appropriate technical and organizational measures so that the processing of personal data meets the requirements of the GDPR and ensures the protection of the rights of data subjects.

2. THE PROVIDER’S ROLE IN PERSONAL DATA PROCESSING

2.1. The Provider acts in two roles:

A) The Provider as a Data Controller

For the following personal data, the Provider is the controller within the meaning of the GDPR:

1) Registration data of organizations:

Contact persons of Homeowners’ Associations (HOAs), housing cooperatives, and professional property managers.
Data necessary for the operation of the Service and performance of the contract.
Payment and billing data of organizations.

2) Registration data of individual users:

First name, last name, and email address of apartment owners and tenants using the Free or Premium version for their own needs.
Payment data for the Premium version.

Individual users, Trial and Free version users:

Personal data: First name, last name, email, phone, password hash, system activity logs, IP address.
Purpose:
- Providing access to the application during the Trial period and the Free version.
- Communication regarding the end of the trial period and offering an upgrade to the paid version (legitimate interest).
- Enforcing service limits (e.g., checking the 500 MB data limit).
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and Legitimate Interest (Art. 6(1)(f) GDPR).
Retention period:
- For the duration of the user account.
- For Free versions: Data is kept for a maximum of 6 months from the last login. If the account is inactive for longer, it is automatically deleted in accordance with the GTC.
- For unpaid accounts after the Trial: If there is no upgrade to the Premium or Free version, data is deleted 30 days after the end of the Trial (protective period for export).

B) The Provider as a Data Processor

For the following personal data, the Provider is a processor within the meaning of the GDPR, where the controller is:

1) HOAs/Housing cooperatives – for the personal data of apartment owners, committee members, and tenants that they enter into the Service.

2) Professional property managers – for the personal data of individuals within the managed properties.

3) Individual users – for the personal data they enter into the Service themselves regarding their properties, finances, and other data for their own records (beyond the mandatory registration data).

3. THE PROVIDER AS A DATA CONTROLLER

3.1. What personal data we process and why

A) Registration and contact details of users:

A1) Contact persons of HOAs, housing cooperatives, and property managers:
- Data: First name and last name, email address, phone number, organization’s Company ID No. (IČO), HOA/manager’s address.
- Purpose: Creation and management of the organization’s user account, communication, performance of the contract.
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
- Retention period: For the duration of the contractual relationship + 3 years after its termination.
A2) Individual users (apartment owners and tenants) – Free and Premium versions:
- Data: First name and last name, email address.
- Purpose: Creation of a personal user account, record-keeping of personal property, communication with the user, provision of Service functions for personal property management.
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
- Retention period: For the duration of active account usage + 3 years after the last login (the Free version may be deleted after 6 months of inactivity).
- Note: This data is processed by the Provider as a controller. Any other data entered by the user into the Service for their own needs (e.g., data about their properties, finances) is processed solely by the user themselves, and the Provider only accesses it as a processor to the extent necessary for technical support.

B) Payment and billing data:

Data: Billing address, Company ID No. (IČO), Tax ID (DIČ), bank details (optional), payment information.
Purpose: Issuing invoices, recording payments, fulfilling tax obligations.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR).
Retention period: 10 years from the end of the tax period (according to the Accounting Act).
Note: Applies only to paid packages (HOA packages Řadovka, Činžák, Panelák, Komplex, Sídliště, and the Premium version for owners). The Free version does not require payment details.

C) Data entered by users for their own needs:

Data: Any data entered by the user into the Service for their own records (data on properties, finances, documents, etc.).
Purpose: Provision of Service functions to the user.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
Provider’s role: Processor – the Provider merely stores this data and makes it available to the user; the controller is the user themselves.
Retention period: For the duration of active account usage + 30 days after account termination (to allow for export).

D) Operational and technical data:

Data: IP address, device information, log files, cookies.
Purpose: Ensuring the security and functionality of the Service, fraud prevention, technical support.
Legal basis: Legitimate interest of the Provider (Art. 6(1)(f) GDPR) – protection of system security.
Retention period: 12 months.

E) Communication and support:

Data: Content of email communication, support records, complaints.
Purpose: Providing technical support, handling complaints, improving services.
Legal basis: Performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR).
Retention period: 3 years after the request is resolved.

F) Affiliate and referral program participants:

Personal data: Partner identification (Name/Company Name), assigned unique promo code, information about referred Users (only to the extent necessary for commission attribution), history of paid rewards.
Purpose: Record-keeping of referrals, calculation and payment of commissions, fraud prevention in the affiliate program.
Legal basis: Performance of a contract for cooperation / Agreement to Complete a Job (Art. 6(1)(b) GDPR) and compliance with statutory obligations (accounting and tax regulations).
Retention period: For the duration of the cooperation and subsequently for 10 years due to the Accounting Act (for paid commissions).

3.2. Transfer of personal data to third parties

The Provider may transfer personal data to the following categories of recipients:

A) IT infrastructure providers:

Hosting services (servers, databases)
Cloud storage
Current providers: [TO BE COMPLETED – e.g., Microsoft Azure, AWS, etc.] B) Payment services:
Payment gateways for payment processing
Current providers: [TO BE COMPLETED] C) Accounting and legal services:
External accountants for bookkeeping
Legal representatives (in case of disputes) D) State authorities:
Based on a legal obligation (courts, tax office, Office for Personal Data Protection)

All processors are bound by contractual provisions on personal data protection in accordance with the GDPR.

3.3. Transfer of personal data to third countries

The Provider does not transfer personal data to third countries outside the European Union, except when using services of providers from the USA who are certified under the EU-US Data Privacy Framework or with whom standard contractual clauses under the GDPR have been concluded.

4. THE PROVIDER AS A DATA PROCESSOR

4.1. Subject matter and scope of processing

The Provider processes personal data as a processor for HOAs, housing cooperatives, professional property managers, and apartment owners (hereinafter the “Controller”), who are data controllers within the meaning of the GDPR. Processed personal data:

Identification data of apartment owners (first name, last name, unit address)
Contact details (email, phone)
Ownership data (unit number, share in common areas)
Financial data (advances, payments, billing)
Voting data
Content of communication within the Service
Documents uploaded to the Service

4.2. Purpose of processing

The Provider processes personal data exclusively to enable the Controller to use the Service for:

Management of the apartment building and HOA
Communication with apartment owners
Online voting
Financial management and billing
Document record-keeping
Fault and maintenance management

4.3. Instructions of the Controller

The Provider processes personal data only on the basis of written instructions from the Controller, which are:

This Personal Data Processing Policy
General Terms and Conditions
Specific instructions entered by the Controller through the Service or via email

4.4. Security measures

The Provider undertakes to adopt appropriate technical and organizational measures: Technical measures:

Data encryption in transit (SSL/TLS)
Data encryption at rest
Regular data backups
Secure access to systems (authentication, authorization)
Firewall and antivirus protection
Monitoring and access logging Organizational measures:
Restricting access to personal data only to authorized employees
Employee training on personal data protection
Non-disclosure agreements (NDAs) with all employees
Access rights management
Security incident response plan

4.5. Access to personal data by the Provider’s employees

The Provider’s employees are authorized to access personal data processed by the Service only: A) When resolving technical issues:

Based on a request for technical support from the Controller
Exclusively for the purpose of fixing a defect or providing support
To the minimum necessary extent B) During system maintenance:
As part of regular maintenance and updates
Without access to the content side of the personal data (only technical parameters)

The Provider has internal processes in place minimizing the risk of unauthorized access to personal data.

4.6. Data disposal after contract termination:

In accordance with the GTC, the following disposal rules apply to data entered by the User (in particular HOA documents, lists of owners, voting history):

Contract termination: Upon termination of the Contract (by notice, non-payment, expiration of the term), the account switches to a “Read-only” mode for a 30-day protective period.
Obligation to export: During this period, the User (Controller) is obliged to export their data.
Definitive deletion: After 30 days from the termination of the Contract, all operational data of the User is automatically and irreversibly deleted from the Provider’s servers.
Exception: The Provider retains only billing data and basic User identification for the period stipulated by law (10 years) for the purposes of tax records and protection of legal claims.

4.7. Notification obligation in case of a security breach

In the event of a personal data breach, the Provider undertakes to:

Notify the Controller without undue delay (no later than 24 hours after discovery)
Provide all available information about the nature of the breach
Cooperate in minimizing impacts and taking remedial measures

4.8. Sub-processors

The Provider has general written authorization from the Controller to engage sub-processors: The Provider uses the following categories of processors:

Hosting and cloud services: Amazon Web Services, servers located in the EU.
Accounting and tax services: UOL a.s., ID No.: 28956870 (processing of invoices and commissions).
Emailing services: Ecomail
Analytical tools: Google Analytics, Microsoft Clarity, Google Tag Manager
AI technology providers: Google Ireland Limited (Google Gemini API service – paid version) – query processing and text generation. OpenAI Ireland Ltd (OpenAI API service – Enterprise/Paid) – advanced language models and speech-to-text conversion (Whisper). Anthropic, PBC (Claude API service – Commercial) – document analysis and text assistance.

The Provider informs the Controller of any intended changes concerning other processors at least 30 days in advance via email or within the user interface.

4.9. Obligations of the Controller

The Controller (HOA, property manager, apartment owner) undertakes to: A) Have a legal basis:

Process only personal data for which they have a valid legal basis (Art. 6 GDPR)
Obtain the consent of data subjects if necessary
Comply with all processing principles under Art. 5 GDPR B) Inform data subjects:
Inform apartment owners about the processing of their personal data through the Service
Notify them of the possibility of access by the Provider’s employees during technical support
Provide information pursuant to Art. 13 and 14 GDPR C) Be responsible for data accuracy:
Ensure that the entered personal data is up-to-date and accurate
Update data when it changes
Bear responsibility for damages caused by incorrect data D) Secure access:
Protect login credentials to the Service
Designate only authorized persons to access personal data
Ensure that email addresses entered for voting belong to authorized persons E) Request the fulfillment of data subjects’ rights:
In the event of a request from a data subject (apartment owner), contact the Provider
The Provider will provide assistance in fulfilling the rights of data subjects

5. RIGHTS OF DATA SUBJECTS

Every data subject (Service user, apartment owner, committee member) has the following rights:

Confirmation as to whether or not their personal data is being processed
Access to this personal data
Information about the purpose of the processing, categories of data, recipients

Correction of inaccurate personal data
Completion of incomplete personal data

Erasure of personal data if it is no longer necessary for the purpose of processing
If consent has been withdrawn and there is no other legal basis
If the data has been processed unlawfully

Restriction of processing in case of disputes over data accuracy
If the processing is unlawful but the data subject opposes erasure

To receive personal data in a structured, commonly used format
To transmit this data to another controller

Objection to processing based on legitimate interest
Objection to processing for direct marketing purposes

The Provider does not carry out automated decision-making or profiling.

5.8. Right to lodge a complaint with a supervisory authority

In case of doubt regarding the lawfulness of the processing, the data subject has the right to lodge a complaint with the: Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Pplk. Sochora 27 170 00 Prague 7 Czech Republic Web: www.uoou.cz Email: podnety@uoou.cz

6. HOW TO EXERCISE YOUR RIGHTS

For contact persons of HOAs, property managers, and individual users (owners/tenants with their own account):

Email: gdpr@domee.app
In writing to: Deveeo s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic

For apartment owners whose data was entered into the Service by the HOA:

Primarily contact the HOA/manager who entered your data into the Service.
Subsidiarily, you can contact the Provider at: info@deveeo.cz

Processing time limit:

The Provider will respond to the request no later than 30 days after receiving it.
In complex cases, the deadline may be extended by another 2 months with justification.

7. COOKIES AND TRACKING TECHNOLOGIES

Detailed information about the use of cookies and tracking technologies is available in a separate document “Cookie Policy” at: www.domee.app/obchodni-podminky/zasady-cookies/

8. CHANGES TO THE PERSONAL DATA PROCESSING POLICY

8.1. The Provider reserves the right to change and update this Personal Data Processing Policy. 8.2. The Provider will inform users of any changes at least 15 days in advance via email or within the user interface. 8.3. The current version of this Policy is always available at: www.domee.app/obchodni-podminky/zpracovani-osobnich-udaju/

9. CONTACT DETAILS

For questions regarding the processing of personal data, please contact: Deveeo s.r.o. Email: gdpr@domee.app Address: Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic

10. FINAL PROVISIONS

10.1. This Personal Data Processing Policy is an integral part of the General Terms and Conditions for using the Domee.app Service. 10.2. This Policy comes into effect on the date specified in the header. 10.3. By using the Domee.app Service, you agree to this Personal Data Processing Policy.

Deveeo s.r.o.

Effective Date: January 1, 2026

Processing of Personal Data for the Domee.app Application