Data processing terms

1. Who these terms are for

When you run a building or let homes on Moradot - as a building manager, a management company, an owners’ board or a landlord - you keep personal data about the people involved. For that data you are the controller, and Moradot PSA (Moradot prosta spółka akcyjna), [registered address - to be completed], KRS [KRS - to be completed], NIP [NIP - to be completed] (“Moradot”, “we”) processes it on your behalf.

These terms are the data processing agreement required by Article 28 of the GDPR. They’re part of our terms of service and apply for as long as you use Moradot to run a building or to let homes. If your organisation needs a signed copy, write to [email protected].

If you use Moradot only for your own home - as an owner, a tenant or a resident - these terms don’t apply to you. For your own data we are the controller, as our privacy policy explains.

2. What it covers, and for how long

• Subject matter: the personal data that you, your team and the people you invite keep in Moradot to run a building or to let homes.
• Duration: for as long as you use Moradot for that building or those homes, and then until we’ve handed back or deleted the data, as section 9 says.

3. What we do with the data, and why

• Purpose: providing Moradot to you - budgets and fees, payments, leases and rent, bills and contracts, meters, repairs, votes, communication with the people involved, reminders, and the other features you use.
• What we do: we store the data, organise it and show each person the part that concerns them; we send emails and reminders; and, when you or your team use those features, we have documents read and bank statement lines matched with the help of AI (section 7).
• AI only suggests. What AI reads off a document, or proposes for a bank statement line, waits for someone on your side to check it. Nothing is saved until they do.
• Nothing else: we don’t use the data for any other purpose, we don’t sell it, and we don’t use it for advertising.

4. Whose data, and which

• People concerned: owners, co-owners, tenants, residents, members of your team, suppliers and their contacts.
• Data: names and contact details; tax numbers; the homes people own, rent or live in, and their shares; fees, rent, deposits, payments, proofs of payment, bank account details and bank statement lines; bills, contracts, insurance policies and loan agreements; meter readings; votes; documents and photos; messages, comments and repair reports.
• No special categories: Moradot is not designed for health data or other special categories of personal data. Please don’t enter them.

5. What we commit to

We will:

• process the data only to provide Moradot, following your documented instructions - which are these terms and how you use Moradot - unless the law requires otherwise, in which case we’ll tell you first if the law allows;
• tell you straight away if we think an instruction of yours breaks data protection law;
• make sure everyone at Moradot who can access the data is bound to keep it confidential;
• protect it with the measures in section 6;
• help you answer requests from the people concerned - to see, correct, delete or export their data - and pass on any request we receive directly;
• help you with security, with reporting data breaches, with data protection impact assessments and with consulting the supervisory authority, as far as they concern Moradot;
• tell you without undue delay if we become aware of a personal data breach affecting your data, with the information you need to assess and report it;
• give you the information you need to show that these terms are being met, and allow audits - with reasonable notice, at reasonable intervals, in a way that protects other customers’ data.

6. How we keep it safe

• Encrypted: personal details such as tax numbers, bank accounts, bank statement lines, notes, comments and messages are stored encrypted.
• Private files: documents and photos are kept in private storage. Each link to one works for 2 hours only.
• No passwords: people sign in with a one-time code sent to their email or phone.
• Need to know: each person sees only what concerns them, and access at Moradot is limited to what each person needs.
• In the EU: the data is stored in Google Cloud data centres in Belgium, in the European Union.

7. Sub-processors

You authorise us to use the providers below. We bind each of them, by contract, to the same data protection obligations as these terms, and we remain responsible to you for what they do. The AI providers receive data only when someone uses the feature that needs them.

Provider	What for	Which data	Where
Google Cloud	Running Moradot: servers, database and file storage	All the data kept in Moradot	European Union (Belgium)
Firebase (Google)	Signing in, texting sign-in codes, serving the web app	Email address or phone number, the sign-in code, technical details of each visit to the app	May be outside the EU (section 8)
Google Maps Platform (Google)	Suggesting addresses while one is typed	The address being typed, and nothing about who types it	May be outside the EU (section 8)
Scaleway	Sending emails: sign-in codes, reminders and notices	The name and email address of the person written to, and the email itself	France (EU)
Mistral AI	Reading the documents someone asks Moradot to read: invoices, utility and meter bills, meter reading reports, insurance policies, home loan agreements and statements, PDF bank statements	The whole document, with whatever is printed on it: names, addresses, tax numbers, account numbers, amounts	France (EU); may be outside the EU (section 8)
TypeSafe AI	Suggesting what a bank statement line pays, what kind of document was uploaded, which home a bill is for, and whether a payment looks like a loan instalment or an insurance premium	Bank statement lines (date, amount, description, the other party’s name and account, reference); the records a line may match (names of who pays or is owed, homes, amounts, due dates); the opening text of an uploaded document; the address on a bill and the addresses of your homes	May be outside the EU (section 8)
Sentry (Functional Software, Inc.)	Error reports	Technical details of an error, set up to leave personal details out as far as possible	United States

AI assistants that you connect yourself (such as Claude or ChatGPT), and public authorities you ask Moradot to send something to (such as a tax authority, for rent receipts), aren’t our sub-processors: you choose them, and they receive only what you ask for.

We’ll tell you by email, and publish it here, at least 30 days before any change to this list applies. If you object to a change on reasonable data protection grounds, tell us. If we can’t resolve it, you can stop using Moradot for the data concerned.

8. Outside the European Union

The data is stored in the European Union. Some of the providers above may process part of it elsewhere:

• Sentry is based in the United States.
• Firebase and Google Maps Platform are Google services that may run in data centres outside the EU.
• Mistral AI is based in France, but may read documents on servers outside the EU.
• TypeSafe AI may process the data it receives outside the EU.

Wherever a provider processes data outside the EU or the European Economic Area, we use it only with a safeguard in place: an EU adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses. Write to us for a copy.

9. When you stop

When you stop using Moradot for a building or for your rentals, you can download its records first, or ask us to hand them over to whoever takes over. After that, we delete the personal data we hold on your behalf within 90 days, unless the law requires us to keep it.

10. Liability and law

Liability under these terms follows our terms of service and the GDPR. These terms are governed by Polish law.

11. Contact

Questions about these terms, or a request for a signed copy: [email protected].