Data Processing Agreement

Version 2 of 12 October 2026

This is a translation; the Polish version prevails.

The DPA is Annex 1 to the Terms of Service. The Customer concludes it with LURIP by accepting the Terms when creating an Organisation. Capitalised terms have the meaning given to them in the Terms, and GDPR terms have the meaning given to them in Regulation (EU) 2016/679 of the European Parliament and of the Council.

1. Parties and subject matter

  1. The Customer, as controller, entrusts LURIP, as processor, with the processing of personal data that the Customer and Users enter into or import into the Organisation, to the extent and for the purpose described in section 2.
  2. LURIP processes the entrusted data only for the purpose of providing the Loftsplit service in accordance with the Terms, for the duration of the contract for the use of the Application and until deletion of the data has been completed in accordance with section 9.
  3. The Customer, as controller, is responsible for having a legal basis for processing the data entered into the Application, for fulfilling the information obligations towards tenants and other persons (template: tenant privacy notice), for handling their requests and for giving instructions that comply with the law.

2. Scope of processing

  1. Categories of data subjects: tenants and other lessees of the Customer; the Customer’s counterparties who are natural persons (e.g. service providers, repair contractors, senders of bank transfers); the Customer’s Users, as regards the history of changes to Organisation data.
  2. Categories of data:
    1. identification and contact data: full name or business name, e-mail address, telephone number, address, NIP (tax identification number), language of correspondence;
    2. tenancy agreement data: unit, start and end dates, rent, deposit, advance payments, number of occupants, method of settling utilities, notes;
    3. financial data: payments, balances, transactions from imported bank statements (counterparty name and account, payment reference, amount), re-invoices, history of payment reminders sent to tenants;
    4. consumption data: readings of meters and sub-meters assigned to units;
    5. documents: settlements for tenants, scans of invoices, handover reports and other files added by the Customer;
    6. tenant portal login data: e-mail address and link expiry time;
    7. change history: who changed which values and when;
    8. e-mail sending log: recipient address, subject and delivery status, for 30 days; the content of the message until it is sent;
    9. files and screenshots attached by Users to reports sent to LURIP, processed in order to handle the report and deleted together with the Organisation.
  3. The Application is not intended for processing special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). The Customer does not enter such data, including in notes fields and in files.
  4. Nature of processing: storage, organisation, settlement calculations, generation of documents, matching payments from bank statements to leases, sending e-mails on the Customer’s instruction (including reminders of overdue payments, when the Customer switches them on) and keeping a log of their sending, making data available to tenants in the portal, export, deletion and anonymisation, backups, handling reports sent by Users from the panel to LURIP’s technical support, including screenshots.

3. The Customer’s instructions

  1. LURIP processes the entrusted data only on documented instructions from the Customer. The instructions are the Terms, this DPA and the actions of the Customer and Users in the Application (e.g. sending a settlement, enabling the tenant portal, import, export, deletion, sending a report to technical support).
  2. LURIP does not use the entrusted data for its own purposes, including advertising, profiling or training artificial intelligence models, and does not combine data of different Organisations.
  3. If, in LURIP’s opinion, an instruction infringes the GDPR or other data protection provisions, LURIP informs the Customer without delay and may suspend carrying it out until the matter is clarified.
  4. If the law requires LURIP to process the entrusted data in another way, LURIP informs the Customer before processing begins, unless that law prohibits such information on important grounds of public interest.

4. Confidentiality

LURIP gives access to the entrusted data only to persons who have written authorisation, have committed themselves to confidentiality and need access to fix a failure, ensure security or carry out the Customer’s instruction, for example a support request. Staff handling subscriptions work in the operator panel, which does not show data on tenants, contracts, costs or settlements, except for the content and attachments of reports that a User sends from the panel to technical support; sending a report is an instruction of the Customer within the meaning of section 3(1). Before a report is sent, the panel warns that a screenshot may contain tenant data and asks the User to cover data that LURIP does not need.

5. Security

LURIP applies the technical and organisational measures described in section 12, appropriate to the risk (Article 32 GDPR). LURIP may change them provided that it does not lower the level of protection.

6. Subprocessing

  1. The Customer gives LURIP general authorisation to engage the entities on the list of subprocessors for further processing.
  2. LURIP informs the Owners by e-mail at least 30 days in advance of an intended addition or replacement of a subprocessor. Where a subprocessor has to be replaced urgently to maintain the continuity or security of the service (e.g. after its failure or insolvency), LURIP may give shorter notice, but always before the change. The Customer may object within 30 days of the notice, preferably giving reasons, by writing to [email protected]. If the parties do not find a solution, the Customer may terminate the contract for the use of the Application before the change is made, without charges for the period after termination, and, where an urgent change was made before termination, with a refund of the fees for the period from the change.
  3. LURIP imposes on each subprocessor data protection obligations no less strict than those in this DPA and is liable to the Customer for the subprocessor’s actions as for its own.
  4. LURIP stores the entrusted data in the European Economic Area. Traffic between the browser and the Application passes through the Cloudflare network (list of subprocessors), which may process the data in transit in the United States; the basis is the European Commission’s decision on the EU–US Data Privacy Framework, in which Cloudflare participates, and, additionally, standard contractual clauses. Any other transfer of data outside the European Economic Area requires the procedure in paragraph 2 and the safeguards in Chapter V of the GDPR.

7. Assistance with data subject rights

  1. The Application allows the Customer to handle data subject requests on its own: to view and export a tenant’s data (CSV, XLSX, ZIP), correct it, anonymise it or delete the tenant. Anonymisation removes the tenant’s identification data also from the change history and from settlement documents, leaving the amounts.
  2. If a data subject submits a request directly to LURIP, LURIP passes it on to the Customer without undue delay and does not respond to it on its own, unless the Customer instructs it to do so.
  3. LURIP assists the Customer, where possible and taking into account the information available to LURIP, in fulfilling the obligations under Articles 32 to 36 GDPR, including in data protection impact assessments.

8. Personal data breaches

  1. LURIP notifies the Customer of a detected breach of the security of the entrusted data without undue delay, and no later than 48 hours after detecting it, by e-mail to the addresses of the Organisation’s Owners, including where the breach occurred at a subprocessor.
  2. The notification contains the information available to LURIP at the time it is sent: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and proposed, and contact details of a person who will provide further information. LURIP provides the remaining information in phases as it becomes available.
  3. LURIP documents breaches and the actions taken, and cooperates with the Customer in notifying the supervisory authority and informing the data subjects.
  4. LURIP informs the Customer without delay of any inspection, proceedings or request by the supervisory authority or another authority concerning the Customer’s entrusted data, unless the law prohibits this.

9. Deletion of data after the end of the contract

  1. Before the contract ends, the Customer may at any time export all entrusted data from the Application. This constitutes the return of data within the meaning of Article 28(3)(g) GDPR.
  2. In every case in which the contract for the use of the Application ends, including its termination by LURIP, LURIP deletes the entrusted data 30 days after it ends. Once deletion of the Organisation has been ordered and 30 days have passed, LURIP deletes all entrusted data from the Application. LURIP does the same 30 days after the end of a trial period in which no subscription was ordered. Until deletion, the entrusted data is read-only and available for export. Data in backups is deleted in the cycle in which the backups expire, no later than after 14 days. At the Customer’s request, LURIP confirms the deletion of the data.
  3. LURIP may keep the entrusted data for longer only where Union law or Polish law requires it, and informs the Customer of this.

10. Information and audits

  1. LURIP makes available to the Customer the information needed to demonstrate compliance with the obligations under Article 28 GDPR, and in particular answers security questions and questionnaires within 14 days.
  2. If the answers under paragraph 1 are not sufficient, the Customer, or an auditor authorised by the Customer, bound by confidentiality and not a competitor of LURIP, may carry out an audit, remotely in the first place (review of documents and interviews), announced at least 30 days in advance, on working days, no more than once a year. An audit after a personal data breach or at the request of the supervisory authority may take place without these limits, announced at least 5 days in advance. The audit may not infringe LURIP’s trade secrets, the security of the Application or the data of other Customers. The Customer bears the costs of the audit, unless the audit shows a material breach of this DPA by LURIP.

11. Liability and final provisions

  1. The liability of the parties for breach of this DPA is governed by the GDPR and § 10 of the Terms, except where the law does not allow it to be limited.
  2. The DPA remains in force for the duration of the contract for the use of the Application and until the entrusted data has been deleted. Matters not covered by it are governed by the Terms and the GDPR.
  3. A Customer who needs a DPA signed in documentary or written form may request one by writing to [email protected].

12. Technical and organisational measures

Infrastructure

Data separation and permissions

Authentication

Accountability and data minimisation

Organisation