Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the flatnumber Terms of Service (help.flatnumber.com/terms/) (the "Agreement") between:

• the Customer: the owners' association (the "community") or the managing agent that subscribes to flatnumber on the community's behalf; and
• Flatnumber Ltd, a company registered in Malta, 28/flat 11 Nazzarenu Street, Sliema SLM 2074, Malta ("flatnumber").

1. Roles

1.1 For the personal data processed to run the community (Annex C), the community is the controller and flatnumber is its processor. Where the Customer is a managing agent acting for the community, the managing agent is the community's processor and flatnumber is the managing agent's sub-processor; the managing agent confirms that the community has authorised it to engage flatnumber on these terms.

1.2 flatnumber is a controller only for its own purposes (user accounts and sign-in, support requested from flatnumber, security of the service and billing), as described in its Privacy Policy. This DPA does not apply to that processing.

2. flatnumber's obligations (GDPR art. 28(3))

flatnumber shall:

a) process the personal data only on the Customer's documented instructions, which are this DPA, the Agreement and the Customer's use of the service's features, unless EU or Member State law requires otherwise (in which case flatnumber will inform the Customer unless that law forbids it); b) ensure that persons authorised to process the data are bound by confidentiality; c) implement the technical and organisational measures in Annex B; d) engage sub-processors only as set out in section 3; e) taking into account the nature of the processing, assist the Customer, by appropriate measures, in responding to requests from data subjects exercising their rights; f) assist the Customer with security, breach notification, data protection impact assessments and prior consultation (GDPR arts. 32-36), taking into account the information available to flatnumber; g) at the end of the service, delete the personal data (section 7); h) make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits (section 8).

flatnumber will inform the Customer immediately if, in its opinion, an instruction infringes data protection law.

3. Sub-processors

3.1 The Customer gives general authorisation for flatnumber to engage sub-processors. The current sub-processors are listed in Annex A.

3.2 flatnumber will inform the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance (by email or in the app). The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service.

3.3 flatnumber imposes on each sub-processor data protection obligations equivalent to those in this DPA and remains responsible to the Customer for their performance.

4. Artificial intelligence

4.1 Where the Customer uses AI-assisted features (reading invoices; helping draft the annual general meeting document), the data are processed by Google Vertex AI in the European Union (Annex A). Under Google Cloud's terms, the data are not used to train models.

4.2 AI output is always a draft reviewed by a person authorised by the Customer before use. Figures, tables and fee calculations are produced by flatnumber's code, not by the AI model. The Customer is responsible for the documents it adopts or distributes.

4.3 For the meeting document, flatnumber limits the data sent to the model as described in its Privacy Policy (section 5): units are identified by name, not by owner; unpaid amounts only as totals; no owners' contact details. Working material is deleted 90 days after the document is finalised.

5. International transfers

Community data and files are stored in the EU (Frankfurt, Germany). Some processing takes place in the United States (server functions, sign-in, notifications, performance measurement). These transfers rely on the European Commission's Standard Contractual Clauses and, where the recipient is certified, the EU-US Data Privacy Framework. A copy of the safeguards is available on request.

6. Personal data breaches

flatnumber will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information available at the time (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed), and will provide further information as it becomes available.

7. Deletion at the end of the service

When the Customer deletes the community in the service, or within 30 days of the end of the Agreement, flatnumber deletes the community's data and files from the live systems. Backups are overwritten automatically within 98 days. On request before deletion, flatnumber will help the Customer export its data.

8. Audits

flatnumber will provide, on request and no more than once a year (unless required by a supervisory authority or following a breach), the information reasonably necessary to demonstrate compliance, including descriptions of its measures and its sub-processors' certifications (for example Google Cloud's ISO 27001 and SOC 2 reports). On-site audits require reasonable notice, take place during business hours, are subject to confidentiality and are at the Customer's cost.

9. Term and precedence

This DPA applies for as long as flatnumber processes personal data on the Customer's behalf. If it conflicts with the Agreement, this DPA prevails as regards data protection. It is governed by the law of Malta.

Acceptance: the Customer accepts this DPA, together with the Terms of Service, when an administrator creates a community in flatnumber (or, for an existing community, when an administrator accepts it in the app). flatnumber records the version accepted, the date and the administrator who accepted it. A Customer that needs a signed copy can ask at privacy@flatnumber.com.

Annex A — Sub-processors

Sign in with Apple and Sign in with Google are used only if a user chooses them; Apple and Google act as independent controllers for that sign-in and are not sub-processors.

Annex B — Technical and organisational measures

• Encryption in transit (TLS) and at rest (Google Cloud default encryption).
• Access control by security rules: users only access the communities they belong to, and within them only what their role allows; server-side checks for administrative actions.
• Communities isolated by association and managing-agent scope in every record.
• Restricted staff access, only when necessary (for example to answer a support request).
• AI features without tools: the model receives only data prepared by the server, cannot read other data or act; output validated before it is stored (no external links or images).
• Point-in-time recovery (7 days) and automatic backups (98 days).
• Logging of server activity for security and troubleshooting (normally kept 30 days).
• Deletion of a community's data and files when the community is deleted.

Annex C — Description of the processing