Zásady ochrany osobních údajů

Effective and Last Updated: October 21, 2026 (previous editions of October 20, 2026 and January 29, 2025 in the archive on this page)

1. Who we are and what this Policy covers

This Policy explains how Unitify Limited, a company incorporated in Hong Kong (Reg. No. 76842989), 17/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong ("Unitify", "we"), processes personal data for which we decide the purposes and means, that is, where we act as a controller:

• visitors of unitify.com and its subdomains;
• people who register an account on the Platform or are added to a customer's account as administrators or staff (name, work e-mail, phone, role);
• business contacts of customers, prospects, partners and distributors;
• people who contact support or sales, subscribe to newsletters or attend our events and webinars;
• users of the free plan.

Resident data is different. Data about residents, unit owners and other people that a property management company, homeowners' association or developer (our customer) enters into the Platform or collects through the resident app is processed by Unitify on behalf of that customer, which is the controller. That processing is governed by the Data Processing Agreement at unitify.com/legal/dpa and by the customer's own privacy notice. If you are a resident, your management company is your first point of contact; we forward requests we receive to the customer concerned (Section 8).

In the CIS, customers contract with our authorized distributor, Unitify LLC (Uzbekistan). Where the distributor is the party that collects account or business-contact data, it acts as the controller of that data under the same principles and this Policy applies to it accordingly. For resident data, the roles follow the Data Processing Agreement: under Orders contracted with Unitify LLC, Unitify LLC is the processor and Unitify Limited is its sub-processor for the functions listed in Annex III; under Orders contracted with Unitify Limited, Unitify Limited is the processor.

2. What we collect

Context	Data	Source
Website	IP address, device and browser data, pages visited, referrer; cookie identifiers for analytics (including recordings of how pages are used) and for advertising measurement, according to your cookie choices	automatically, and from your cookie banner choices
Account	name, work e-mail, phone, organisation, role, language, login and activity logs	from you or from the administrator of your organisation
Business contacts and sales	name, position, company, contact details, correspondence, meeting notes	from you, your organisation, public sources (e.g. company websites, professional networks) or our partners
Support	the content of your requests and our replies, account identifiers	from you
Payments	invoicing details of your organisation; transaction identifiers and status. Card and bank details are entered with the payment provider or merchant of record and are not stored by us	from you and from the payment provider
Events, newsletters	name, e-mail, company, attendance, interaction with our e-mails	from you

We do not ask for special categories of data in these contexts and do not perform biometric identification.

Fields marked as required at registration or in a form are necessary to create and secure the account or to answer your request; without them we cannot provide access or reply. Marketing fields are always optional.

3. Why we process it and on what basis

Purpose	Data	Legal basis (where the GDPR or UK GDPR applies)
Providing the account, the Platform and support; invoicing and collecting payment	account, support, payment data	performance of a contract with you; where your organisation is the customer and you act for it, our legitimate interest in administering the customer agreement
Security of the Platform, prevention of fraud and abuse, logs	account and technical data	legitimate interest in keeping the service secure
Sales and relationship management with business contacts	business-contact data	legitimate interest in running our business; you may object at any time
Marketing e-mails and newsletters	name, e-mail, interaction data	consent; for existing customers, legitimate interest where local e-marketing law allows it; in Hong Kong only with your consent or indication of no objection; where you have opted in or opted out through a consent form or an account setting, we honour that choice; you can unsubscribe in every e-mail
Analytics of the website and the Platform	technical data, cookie identifiers	in the EEA, the UK and Switzerland: your consent in the cookie banner; elsewhere: legitimate interest in understanding how the website is used, with the option to turn the cookies off at any time; essential cookies always on the basis of legitimate interest
Measurement of our advertising (whether an ad led to a visit or sign-up)	cookie identifiers, pixel events	the same as for analytics
Accounting, tax and legal obligations, defence of claims	invoicing and contract data	legal obligation; legitimate interest

In countries where the law requires the data subject's consent as the basis for processing (for example Kazakhstan and Uzbekistan), that consent is obtained at registration or contract signature by us, the authorized distributor or the customer, as applicable, using the templates published at unitify.com/legal/data-processing. Marketing consent is always a separate choice.

4. Who we share it with

• Service providers (processors) that host the Platform, send e-mails and SMS, provide customer-support tools and process payments. The hosting providers and the language-model providers used for customer instances are listed in Annex III of the Data Processing Agreement; the providers of our own website, e-mail and support tools are named on request.
• Analytics and advertising-measurement providers, subject to your cookie choices: Google (Google Analytics and Tag Manager), Yandex (Yandex Metrica, including recordings of how pages are used), Meta (Meta pixel) and LinkedIn (Insight Tag). The Meta pixel and the LinkedIn Insight Tag send to Meta and LinkedIn the fact that a page was visited, together with cookie identifiers, so that we can measure our advertising; Meta and LinkedIn process that data as independent controllers under their own policies.
• Merchant of record and payment providers for purchases through the online checkout.
• Authorized distributors in their territory, for the sales and support of customers located there (registry at unitify.com/legal/distributors).
• Authorities where the law requires disclosure, and professional advisers bound by confidentiality.
• A successor in the event of a merger, acquisition or sale of the business, under this Policy.

We do not sell personal data.

5. International transfers

Unitify is a Hong Kong company serving customers in the EU, Central Asia and the Caucasus. The Platform instance of a customer is hosted in the service region stated in its Order (for example the EEA for EU customers and Kazakhstan for customers in Kazakhstan). Account, business-contact and support data may be accessed by our team from Hong Kong and from the countries where our staff and distributors are located, and by service providers in the EU and the United States. Website analytics data is processed by the providers named in Section 4 on their own infrastructure, which for Google, Meta and LinkedIn includes the United States and for Yandex Metrica may include the Russian Federation; in the EEA, the UK and Switzerland these tools run only with your consent.

Where the GDPR or UK GDPR applies, transfers outside the EEA or the UK are made under an adequacy decision covering the recipient (for example the EU–US Data Privacy Framework for certified US providers) or under the EU standard contractual clauses or the UK Addendum; a copy of the clauses we rely on can be requested at [email protected]. Where the laws of Kazakhstan, Uzbekistan or another country require a specific basis for a cross-border transfer, we obtain it (for example your consent at registration) or process the data locally. We do not treat the use of the website as consent to transfers.

6. How long we keep it

Data	Retention
Account data	for the life of the account, then up to 3 years for the defence of claims
Support correspondence	3 years after the request is closed
Business-contact data	while the relationship is active and for 3 years after the last interaction, or until you object
Marketing data	until you unsubscribe or 3 years after your last interaction with our communications, whichever is earlier; after that we keep only a record of your choice so that we do not contact you again
Website analytics	according to the retention settings of each tool, at most 14 months in Google Analytics
Security and access logs	up to 12 months
Invoices and contract records	as long as accounting and tax law requires (in Hong Kong, 7 years)

Resident data is retained for the term set by the customer and the Data Processing Agreement, not by this Policy.

7. Your rights

Depending on where you live, you may have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive a copy in a portable format, to withdraw consent at any time without affecting earlier processing, and to lodge a complaint with your supervisory authority. In Hong Kong, you have the rights of access and correction under the Personal Data (Privacy) Ordinance; in Kazakhstan and Uzbekistan, the rights provided by the respective personal-data laws, including withdrawal of consent.

Write to [email protected]. We answer without undue delay and within the period set by the applicable law, and may ask you to confirm your identity. You can unsubscribe from marketing in every e-mail.

8. If you are a resident

If your management company uses Unitify, it decides what data about you is collected in the resident app and why; its privacy notice explains this. Unitify processes that data only on its instructions. You can exercise your rights with the management company; if you write to us, we will forward your request to it without undue delay and help it answer. You can delete your account in the resident app; data held for the management company (for example billing records, requests and meeting records) stays with it, and it decides under its own privacy notice and the law what it keeps and for how long.

9. Security

We protect personal data with the measures described in the Data Processing Agreement (Annex II) and in the Security and Operations overview at unitify.com/legal/security: role-based access, named accounts, multi-factor authentication for access to source-code repositories and hosting-provider consoles, encryption in transit, separated environments, backups kept in the service region, logging of administrative access. No transmission over the internet is completely secure; we notify customers and, where required, authorities and individuals of personal-data breaches as the law requires.

10. Cookies

The website uses essential cookies, which do not require consent, and analytics and advertising-measurement cookies from the providers named in Section 4. In the EEA, the UK and Switzerland those are set only if you accept them in the cookie banner; elsewhere they are on by default and the banner lets you turn them off. You can change your choice at any time through "Cookie settings" in the footer. With analytics consent we also set our own cookie (ut_ft / ut_lt, up to 90 days, readable by unitify.com subdomains) recording how you first reached the site; advertising click identifiers are kept only with advertising consent. If you register, that source is stored with your account. The Platform uses cookies and local storage needed to keep you signed in and to remember your settings.

11. Children

Accounts on the Platform and on the website are for adults acting for an organisation. We do not knowingly collect data from anyone under 18 as an account holder. Data about residents' family members, including minors, may be entered by a customer under its own responsibility and is processed under the Data Processing Agreement.

12. Changes to this Policy

We post changes on this page with a new effective date; previous editions are available in the archive on this page. We tell account administrators by e-mail about changes that materially affect how we use their data before those changes take effect.

13. Contact

Unitify Limited, 17/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong — [email protected]. In the CIS: Unitify LLC, Tashkent Region, Chirchik, Vohid Haydarov MFY, Vohid Haydarov Street 32, Republic of Uzbekistan (TIN 311849914) — the same e-mail.