Privacy Policy

1. Data Controller

The controller of personal data relating to account holders is: [OPERATOR — legal name, registered address, NIP/KRS, contact email].

For any matter concerning your personal data you can contact us at kontakt@domflow.pl.

2. What Data We Collect

Account data: name, email address, password (stored hashed), preferred language, timezone, and date/currency formatting preferences.

Operational data you enter into the Service: apartments and addresses, leases (rent, deposit, fees, dates, payment-due day), tenants, payments (amounts, dates, method, notes), expenses, utility settlements, and organization profile (address, contact email, phone number, tax identifier).

Documents you upload (for example lease agreements and related files) together with their metadata.

Technical data: IP address, session and CSRF cookies, and an automatic audit log recording creation, modification and deletion of financial records.

3. Purposes and Legal Basis

Providing the Service and managing your account — performance of a contract (Art. 6(1)(b) GDPR).

Payment, lease-expiry and tax-related reminders and notifications — our legitimate interest and the interest of account owners (Art. 6(1)(f) GDPR).

Billing and meeting accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).

Account security and audit logging — legitimate interest in protecting data integrity (Art. 6(1)(f) GDPR).

4. Our Role: Controller and Processor

For data about your own account we act as the data controller.

For tenant and lease data that an owner or manager enters about third parties, we act as a processor on that account owner's behalf. Account owners are responsible for having a lawful basis to enter such data and, where required, for informing their tenants. A separate Data Processing Agreement is available for paid accounts.

5. Recipients and Sub-processors

We use trusted providers to run the Service: our hosting provider and our email-delivery provider. These act as sub-processors under agreements requiring appropriate safeguards.

Within an organization, data is visible only to authorized users according to their role (owner, manager, tenant). We do not sell personal data.

6. Data Retention

We retain personal data for as long as your account is active. Deleted records are held as soft-deletes and audit-log entries for a limited period to preserve financial history and meet legal obligations.

After account closure we delete or anonymize personal data within a reasonable period, except where longer retention is required by law (for example accounting records).

7. Your Rights

You have the right to access, rectify, erase, restrict and object to processing of your personal data, and the right to data portability.

You may lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe your data is processed unlawfully.

8. Data Security

Access to data is controlled by role-based permissions. Data is transmitted over encrypted connections, passwords are stored hashed, and access to blocked or expired accounts is suspended automatically.

9. Cookies and Sessions

We use strictly necessary cookies for authentication (session), security (CSRF protection) and remembering your language preference. We do not use advertising cookies.

10. International Transfers

We store and process data within the European Economic Area. If any processing takes place outside the EEA, it will be subject to appropriate safeguards required by the GDPR.

11. Changes and Contact

We may update this Policy; the version and date are shown above. For any privacy request, contact us at kontakt@domflow.pl.