Data Processing Agreement

1. Parties

This agreement is concluded under Article 28(3) of Regulation (EU) 2016/679 (“GDPR”) between:

• Controller — the condominium (етажна собственост) or owners’ association that uses BlockBooks (the “Customer”), represented by its manager, chair of the management board or another duly authorised representative; and
• Processor — Ivan Martinov Dimitrov, freelancer, with permanent address: Mladen Stoyanov 31, Pernik 2303, Bulgaria, email [email protected] (the “Provider”).

This agreement forms an integral part of the BlockBooks contract concluded under the Terms of Service and is accepted together with them. In case of conflict on data protection matters, this agreement prevails.

2. Subject matter, duration, nature and purpose

• Subject matter: processing of personal data entered by the Customer into the BlockBooks application.
• Duration: for the term of the service contract, plus the return and deletion period under section 11.
• Nature: storage, organisation, display, search, aggregation, export, archiving in backups, sending authentication emails and erasure.
• Purpose: providing the building finance record-keeping service and giving residents access to the information that concerns them.

3. Data subjects and types of data

Categories of data subjects: owners, occupants and residents of the building; members of its management bodies; contact persons of suppliers and service companies; users of the application.

Types of data: names; apartment number and association with it; email address and phone; amounts received from an apartment and their dates; expected monthly amounts; paid expenses with description; notes and correction reasons; role and account data; technical change-history data (date, time, user).

The service is not intended for processing special categories of data under Article 9 GDPR or data on convictions and offences. The Customer does not enter such data in notes or descriptions.

4. The Customer’s instructions

The Provider processes personal data only on documented instructions from the Customer — these terms, the settings and actions of Administrators in the application, and written instructions by email — including with regard to transfers to a third country, unless required to do so by Union or Member State law. In that case, the Provider informs the Customer before processing unless the law prohibits it. The Provider immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

5. Confidentiality

The Provider ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Only persons who need access to operate and support the service have access to Customer data, and only to the extent necessary.

6. Security measures

The Provider takes the technical and organisational measures required by Article 32 GDPR, appropriate to the risk, including:

• encrypted connections (HTTPS/TLS) and server access only through a secure tunnel with no open inbound ports;
• a separate database schema for each building and permission checks on every request;
• role-based access (Administrator, Viewer), with viewers seeing details only for their own apartments;
• passwords and personal access tokens stored only as one-way cryptographic hashes; sign-in attempt limits; time-limited sessions;
• an encrypted queue for authentication emails, with content deleted after sending;
• a full change history for financial records, with reversal instead of deletion;
• encrypted backups stored off the server in the EU, with periodic restore checks;
• restricted, key-based administrative access, timely security updates and automated software checks before every release.

7. Sub-processors

The Customer gives the Provider general authorisation to engage sub-processors. The current list is published on the Sub-processors page.

• The Provider notifies the Customer’s Administrators by email at least 30 days before adding or replacing a sub-processor.
• The Customer may object on reasonable grounds within that period. If the parties find no solution, the Customer may terminate the contract without penalty before the change takes effect.
• The Provider imposes the same data protection obligations on each sub-processor by contract and remains fully liable to the Customer for their performance.

8. Assistance with data subject requests

Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures in fulfilling its obligation to respond to requests to exercise data subject rights under Chapter III GDPR. The application lets Administrators review, correct and export data. If the Provider receives a request directly from a data subject, it forwards it to the Customer without undue delay and does not respond on the merits without the Customer’s instruction.

9. Assistance under Articles 32–36 GDPR

The Provider assists the Customer in ensuring compliance with its obligations on security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with the supervisory authority, taking into account the nature of processing and the information available to the Provider.

10. Personal data breaches

The Provider notifies the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data. The notification is sent by email to the Administrators and contains, as far as known:

• a description of the breach, the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address the breach and mitigate its effects;
• a contact point for more information.

Where not all information is available at once, it is provided in phases. The Customer, as controller, decides whether to notify the supervisory authority and the data subjects; the Provider assists.

11. Return and deletion of data

When the contract ends, the Customer may export its data within 30 days, and on request the Provider supplies a complete copy in a commonly used machine-readable format. After that period, the Provider deletes the Customer’s personal data from the live system, and from backups as they rotate, no later than 90 days, unless Union or Member State law requires storage. On request, the Provider confirms the deletion in writing.

12. Information and audits

The Provider makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by it and bound by confidentiality. Audits are requested in writing at least 30 days in advance, take place during business hours, no more than once a year (except after a data breach or at a supervisory authority’s request), and without access to other customers’ data. Each party bears its own costs.

13. Transfers outside the EEA

Customer data is stored in the EU. Any transfer to a third country takes place only through a listed sub-processor and with appropriate safeguards under Chapter V GDPR — an adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

14. Liability and final provisions

The parties’ liability is governed by Article 82 GDPR and the Terms of Service. This agreement applies for as long as the Provider processes personal data on behalf of the Customer. Bulgarian law applies. In case of discrepancy between the Bulgarian and English texts, the Bulgarian text prevails.