App privacy notice

1. What this covers

This notice covers the BlockBooks application, which each building uses at its own address of the form building.blockbooks.org. The application is provided by Ivan Martinov Dimitrov, freelancer, with permanent address: Mladen Stoyanov 31, Pernik 2303, Bulgaria, email [email protected] (“we” below).

2. Two different roles

Depending on the data, we have a different role under Regulation (EU) 2016/679 (“GDPR”):

• Processor — for the data a building keeps in the application: apartments, residents and contacts, money received, paid expenses, notes, change history and residents’ user accounts. The controller of this data is the building’s condominium (етажна собственост) or owners’ association, represented by its manager or management board. We process this data only on its instructions, under the Data Processing Agreement.
• Controller — for data we process for our own purposes: building administrators’ accounts as representatives of our customer, the service’s security logs, sending authentication emails, and contract and invoicing data.

3. Data the building keeps

The building decides which data to enter and whom to invite. Typically this includes: apartment numbers and descriptions, names and contacts of residents or owners, amounts received from each apartment and their dates, expected monthly amounts, paid expenses with a description, corrections with a reason, and the email addresses and roles of invited users.

Residents with the “viewer” role see the building’s totals and expenses, but details only for the apartments associated with them. Contacts, notes and the audit history are available only to the building’s administrators.

Under the Bulgarian Condominium Management Act, a condominium must keep a book of income and expenses. We therefore never delete financial records automatically — corrections are made by reversal, and the original records are kept.

If you are a resident and want to exercise your rights regarding this data, please contact your building’s manager. If you contact us, we will forward the request to the building and help it respond.

4. Data we process as controller

• Administrator accounts: name, email address, role, password hash (passwords are never stored in readable form), email verification date. Purpose: providing and managing the service under the contract with the building. Basis: performance of the contract and our legitimate interest in communicating with the customer’s representatives (Art. 6(1)(b) and (f) GDPR).
• Security logs: sign-in attempts, IP address, date and time, browser type, issuing and revoking personal access tokens, invitations, password recovery and other security events, for all users. Purpose: protecting accounts, limiting password-guessing attempts, investigating incidents. Basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
• Authentication emails: invitations, verification codes and password recovery links. They are sent only in response to an action in the application; we send no newsletters or advertising. Pending messages are stored encrypted and their content is deleted once the mail server accepts them.
• Contract and invoicing: details of the building’s representative, the agreed price, periods and payments. Basis: performance of the contract and legal obligations (Art. 6(1)(b) and (c) GDPR).

5. Cookies

The application uses only strictly necessary cookies — to keep you signed in and to protect against forged requests (CSRF). They are valid only for the specific building’s address and are never shared between buildings. Your language and theme choice is stored in your browser. We use no analytics or advertising cookies. Details: Cookie notice.

6. Where the data is stored

The application and its database run on the provider’s own server in Bulgaria. Each building has a separate database schema. Internet access passes through the Cloudflare network over an encrypted connection. Backups are encrypted and stored in Cloudflare R2 in a bucket with European Union jurisdiction. Authentication emails are sent through Brevo (EU). The full list is in the list of sub-processors.

Cloudflare is headquartered in the United States. Where data is processed outside the EEA while traffic is carried, this relies on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) and, where needed, on standard contractual clauses (Implementing Decision (EU) 2021/914).

7. Retention

• Building data — for as long as the contract lasts. After termination, the building can export its data within 30 days; it is then deleted from the live system, and from backups as they rotate, at the latest within 90 days.
• Sessions expire automatically; signing out, changing or recovering a password ends sessions.
• Security logs — up to 12 months, unless they are part of the building’s audit history or needed for a specific incident.
• Authentication email content — until it is sent; links and codes expire after a short period and can be used only once.
• Contract and accounting data — for the legally required periods, up to 10 years.

8. Your rights

For data we control, you have the rights under Articles 15–21 GDPR: access, rectification, erasure, restriction, portability and objection. Write to [email protected]; we reply within one month.

For the data the building keeps, the condominium is responsible — please contact your building’s manager. We assist the building with every such request.

You can lodge a complaint with the Commission for Personal Data Protection (CPDP / КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg.

9. Security

Our measures include: encrypted connections, a separate database schema for each building, role-based access, permission checks on every request, one-way hashing of passwords and personal access tokens, sign-in attempt limits, a full change history, encrypted backups and restricted server access. A detailed description is in the Data Processing Agreement.

10. Changes

We notify building administrators by email about material changes. The current version is published on this page.