Acuerdo de encargo de tratamiento de datos (DPA)

Version dated 20 October 2026.

1. Scope, parties and precedence

1.1. This DPA forms part of the Master Subscription Agreement and of the Regional Public Offer (CIS) (each a "principal agreement") and applies to every Order under them that involves the processing of personal data. It also forms part of the Terms of Use and applies to processing of personal data on behalf of a Customer that uses the Platform under the Terms of Use without an Order, including on the free plan; in that case the Terms of Use are the principal agreement and, for the purposes of this DPA, "Order" means the Terms of Use together with the selected plan, the account settings, the Customer's registration details and the service region, and the date of acceptance of the Order is the date on which the Customer accepted the Terms of Use.
1.2. "Processor" means the Unitify entity that is party to the principal agreement and, where one exists, to the Order: Unitify Limited (Hong Kong, company no. 76842989) for Orders under the Master Subscription Agreement, or the authorised distributor for Orders under the Regional Public Offer, in which case Unitify Limited participates as a sub-processor to the extent stated in Annex III. "Customer" means the party to the principal agreement and, where one exists, to the Order, acting as controller or, where it processes personal data for a third party, as processor, as applicable. Where the Customer is a processor, the Processor is a sub-processor, and the Customer warrants that it holds the controller's general written authorisation for the engagement of the Processor and its sub-processors, that its instructions reflect the controller's instructions and that it forwards the notices under 5.2 to the controller.
1.3. "Customer Data" means any personal data processed by the Processor on behalf of the Customer in connection with an Order, whether submitted by the Customer, a data subject or an integration or generated through use of the Platform. "Data Protection Law" means the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018 and the data-protection laws of the Customer's service region (including Kazakhstan Law No. 94-V and Uzbekistan Law No. ZRU-547), as applicable.
1.4. For personal-data matters the order of precedence is: (1) the Standard Contractual Clauses and the UK Addendum where incorporated under Section 7; (2) this DPA; (3) more specific lawful instructions in the Order; (4) the principal agreement. An Order may supplement but not disapply mandatory provisions of this DPA. For all other matters the precedence provisions of the principal agreement apply.
1.5. This DPA does not create joint and several liability between Unitify entities. Each party's liability under this DPA is subject to the exclusions and the aggregate cap of the principal agreement, except to the extent such a limitation is not permitted by Data Protection Law or by the Standard Contractual Clauses for the transfer they govern. The Customer may not recover twice for the same event.

2. Subject matter, duration, nature and purpose

2.1. The subject matter is the hosting, operation, support and provision of Platform features under the Order. The duration is the term of the Order plus the return-or-deletion period in Section 11. The nature and purposes of processing, the categories of data subjects and of personal data are described in Annex I.
2.2. The Processor acts on behalf of the Customer and does not determine the purposes or means of processing Customer Data, except for the technical means inherent in operating the Platform.

3. Instructions

3.1. The Processor processes Customer Data only on the Customer's documented instructions, including with regard to international transfers. Documented instructions are the Order, this DPA and the settings that an authorised administrator of the Customer applies in the Platform's administration interface, which are logged.
3.2. Where processing other than instructed is required by Union or Member State law, or by other law applicable to the Processor, the Processor informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
3.3. The Processor informs the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law. An instruction, including enabling a feature in the interface, determines the purpose of processing but does not by itself replace data-subject consent or a transfer mechanism required by law; the Customer is responsible for the lawful basis of processing and for the information it gives to data subjects.

4. Processor obligations

4.1. Confidentiality. Persons authorised to process Customer Data are bound by a contractual or statutory obligation of confidentiality and receive data-protection training appropriate to their role.
4.2. Security. The Processor implements the technical and organisational measures in Annex II and keeps them under review, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing and the risks for data subjects, as required by Article 32 GDPR.
4.3. Assistance. Taking into account the nature of processing and the information available to it, the Processor assists the Customer by appropriate technical and organisational measures in responding to data-subject requests (Section 9) and in meeting its obligations under Articles 32 to 36 GDPR, including security, breach notification, data-protection impact assessments and prior consultation of a supervisory authority. Assistance beyond the Platform's standard functions may be charged at the Processor's then-current rates.
4.4. Information and audit. The Processor makes available the information necessary to demonstrate compliance with this DPA, primarily through existing documentation and reports and, where these are insufficient, a reasonable additional questionnaire, no more than once per twelve months. Where the GDPR or the UK GDPR applies to the Customer's processing, the Processor also allows for and contributes to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer and bound by confidentiality. Unless an audit is prompted by a personal-data breach, a requirement of a supervisory authority or reasonable evidence of non-compliance, audits are limited to once per twelve months, start with a review of the documentation, reports and questionnaire responses the Processor makes available, take place on at least 30 days' notice during business hours, at the Customer's cost, and without access to other customers' data or to information protected by law. These limits do not apply to the extent they would prevent an audit required by Data Protection Law.
4.5. Records. The Processor maintains the records of processing required by Article 30(2) GDPR.

5. Sub-processors

5.1. The Customer gives general written authorisation to the engagement of the sub-processors listed in Annex III. The current list is published at unitify.com/legal/dpa and provided on request at [email protected].
5.2. The Processor informs the Customer by e-mail of any intended addition or replacement of a sub-processor at least 10 calendar days before that sub-processor begins processing Customer Data. The Customer may object within that period on documented data-protection grounds. If the objection is not resolved, the Processor may refrain from using the sub-processor for the Customer, disable the affected optional feature or terminate the affected service.
5.3. The Processor imposes on each sub-processor, by written contract, data-protection obligations providing at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures, and remains fully liable to the Customer for the performance of the sub-processor's obligations.

6. Location of processing

6.1. The hosting region of the Customer's production instance, primary database and backups is stated in the Order. Mandatory localisation applies to the extent required by the law of the relevant country or expressly agreed in the Order.
6.2. Remote access by personnel of the Processor and Unitify Limited is permitted to the extent necessary to provide, secure, diagnose, support and update the Platform, with role-based control, named accounts and logging of administrative actions; databases are not bulk-copied outside the service region. Remote access from another country is a transfer for the purposes of Section 7.
6.3. AI features (Section 8), push notifications and other ancillary processing listed in Annex III take place in the countries stated there.

7. International transfers

7.1. The Processor transfers Customer Data outside the service region, the EEA or the United Kingdom only to the recipients and for the purposes stated in Annex III or in the Customer's documented instructions, and only where a transfer mechanism required by Data Protection Law is in place.
7.2. EU Standard Contractual Clauses. Where the GDPR applies to the Customer's processing and Customer Data is transferred by the Customer to the Processor in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the "SCCs") are incorporated into this DPA by reference and are concluded between the Customer as data exporter and the Processor as data importer on acceptance of the Order, with the following options: Module Two (controller to processor) applies where the Customer is a controller and Module Three (processor to processor) where the Customer is a processor; Clause 7 (docking) applies; Clause 9(a) Option 2 (general written authorisation) with the notice period in 5.2, the agreed list being Annex III; the optional language in Clause 11(a) does not apply; Clause 13 and Annex I.C: where the Customer is established in the EEA, the supervisory authority competent for the Customer; where the Customer is not established in the EEA but is subject to Article 3(2) GDPR, the supervisory authority of the Member State in which its representative under Article 27 GDPR is established or, if no representative must be appointed, of the Member State in which the data subjects concerned are located; Clause 17: the law of Ireland; Clause 18: the courts of Ireland. Annex I of the SCCs is completed by Annex I of this DPA and Annex II of the SCCs by Annex II. The date of acceptance of the Order is the date of the SCCs, and electronic acceptance of the Order constitutes signature of the SCCs by both parties. Onward transfers by the Processor to sub-processors are governed by 7.3.
7.3. Onward transfers. Where the Processor engages a sub-processor outside the EEA, it ensures that the onward transfer is covered by an applicable mechanism: an adequacy decision covering the recipient and service (for example the EU–US Data Privacy Framework for certified US recipients) or the SCCs, Module Three, at the relevant link of the contractual chain.
7.4. United Kingdom. For transfers subject to the UK GDPR, the parties conclude on acceptance of the Order the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner, version B1.0, which is incorporated by reference and completed as follows. Table 1: the parties are the Customer (exporter) and the Processor (importer) with the key contacts and details in the Order and Annex I.A; the start date is the date of acceptance of the Order. Table 2: the Approved EU SCCs are the SCCs under 7.2, with the modules and options selected there. Table 3: Annex 1A and 1B are Annex I of this DPA, Annex II is Annex II of this DPA, and the list of sub-processors is Annex III. Table 4: the Importer may end the Addendum as set out in Section 19 of the Addendum. The Mandatory Clauses are incorporated as follows: "Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses."
7.5. Transfer assessment and supplementary measures. The Processor documents a transfer impact assessment for each transfer under the SCCs and applies the supplementary measures in Annex II. If a competent authority or a change in law renders a mechanism invalid, the Processor informs the Customer, proposes an alternative mechanism and suspends the affected transfer until one is in place; the Customer may disable the affected feature.
7.6. Service regions outside the EEA. For Customers subject to the laws of Kazakhstan, Uzbekistan or another service-region country, cross-border transfers to the recipients in Annex III are made on the basis provided by that law, which the Customer as controller ensures (including, where required, data-subject consent or notification of the authority), and the Processor provides the information needed for that purpose.

8. AI features

8.1. AI features of the Platform (ticket classification, AI concierge, document analysis, AI reports) are performed with the external language-model providers in Annex III in the countries stated there. AI features are switched off by default and are switched on by an authorised administrator of the Customer in the account settings; switching them on is a documented instruction under Section 3, subject to 3.3.
8.2. An AI operation may transmit the text, attachments and Platform-selected context of the specific operation, the generated output, request identifiers and necessary technical metadata. Recipients may be the aggregator and the provider serving the selected model. The Platform does not transmit the production database as part of an AI operation; the data in each operation depends on the enabled feature and the documented instruction.
8.3. Model providers are used through APIs on terms that exclude the use of transmitted data for model training. A zero-data-retention mode (no storage of prompts and outputs by the provider) applies to the routes (aggregator, provider, model) expressly identified in the Order; for those routes the Processor enforces an allowlist and routing controls so that a request fails rather than being routed to a provider without that mode. No-retention and no-training apply only to the identified route and do not cover technical metadata, Platform logs, tools or caching unless the relevant entry states otherwise. Route details are available on request at [email protected].

9. Data-subject rights

9.1. Requests from data subjects received by the Processor are forwarded to the Customer without undue delay and without being answered on the merits, unless the Customer has instructed otherwise. The Processor assists the Customer through the Platform's functions (access, rectification, export and deletion of resident data) and, where those are insufficient, through reasonable additional assistance under 4.3.

10. Personal-data breaches

10.1. The Processor notifies the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data, that is, after it has a reasonable degree of certainty that such a breach has occurred. The initial notice contains the information available at that time (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, contact point) and further information is provided in phases. Investigation of an unsubstantiated alert does not constitute awareness; internal classification or an incomplete investigation does not delay notice once reasonable certainty is reached.
10.2. Notification of supervisory authorities and of data subjects is made by the Customer; the Processor provides the information and cooperation required for it and does not notify authorities or data subjects on the Customer's behalf unless instructed or required by law.

11. Return and deletion

11.1. Post-termination access and export are governed by the Order or, if the Order is silent, by the principal agreement. Before that period expires the Customer communicates whether Customer Data is to be returned (exported) or deleted; absent a timely choice, the Processor deletes Customer Data. Where return is chosen, the Processor provides the export in a machine-readable format and then deletes Customer Data from active systems and deletes existing copies, unless Union, Member State or other applicable law requires storage, in which case the data is isolated and protected until that requirement ends. Backups are not restored for ordinary processing and are deleted under the documented rotation cycle, no later than 6 months after deletion from active systems.
11.2. After deletion under 11.1 the Processor confirms it to the Customer in its standard form; for transfers under the SCCs the confirmation is given in accordance with Clause 8.5 of the SCCs.

12. Use of data; anonymised statistics

12.1. The Processor does not use Customer Data for advertising, profiling or transfer to third parties other than the sub-processors and recipients in Annex III and the Customer's instructions. Payment service providers, billing centres and other services that the Customer selects and connects in its account act as independent controllers of the data they receive; the Platform transmits payment and account data to them on the Customer's instruction and they are not sub-processors of the Processor. For clarity, the data licence in the principal agreement permits processing personal data to provide, secure, troubleshoot and optimise the services for the Customer in accordance with its instructions; aggregated or de-identified data that cannot reasonably identify an individual may be used for general product development, and the Processor does not attempt re-identification.

Annex I. Description of the processing (Annex I to the SCCs)

A. Parties. Data exporter: the Customer, in the role stated in 1.2, with its name, address, registration details, contact person and activities as stated in the Order and the principal agreement. Data importer: the Processor identified in 1.2, with its registered address as stated in the principal agreement, contact person: Data Protection contact, [email protected], activities: provision of the Platform as a processor (or sub-processor where 1.2 so provides). Date and signature: the date of acceptance of the Order; electronic acceptance of the Order constitutes signature by both parties.
B. Description. Data subjects: residents and unit owners, their family members and representatives; the Customer's staff and contractors; counterparties; visitors where access-control features are used. Categories of data: identification and contact data (name, phone, e-mail), address and unit, billing account, charges and payments, meter readings, content of tickets, messages and documents, meeting and poll records, audio and video material where equipment is connected, device tokens, network and technical identifiers, access and audit logs. Special categories: not intended; content submitted by residents may incidentally include health or similar information, which is processed only as part of the relevant ticket or message, is not used for any other purpose, is accessible only to the Customer's authorised users and, to the extent strictly necessary for support or the operation of the relevant feature, to the authorised personnel of the Processor and its sub-processors, and is deleted with the ticket or message; the Customer instructs its users not to submit such data where not necessary. The Platform does not perform biometric identification by default; any external biometric feature must be separately identified in the Order. Frequency: continuous for the term of the Order. Nature and purpose: hosting and storage; provision of the CRM, resident and staff apps, notifications, charges and payment acceptance, tickets, meetings and polls, integrations; support; backups; AI features when enabled. Retention: for the term of the Order and the return-or-deletion period in Section 11. Sub-processor transfers: as in Annex III.
C. Competent supervisory authority. As stated in the Order; if not stated, as determined under the rule in 7.2.

Annex II. Technical and organisational measures (Annex II to the SCCs)

• Access control: role-based access for the Customer's users with per-organisation isolation; named accounts for Unitify engineers with multi-factor authentication required for access to source-code repositories and hosting-provider consoles; access to production systems and hosting consoles restricted to personnel who need it for their role and granted through the hosting provider's access management; administrative access to production systems and third-line support actions are logged and the logs are retained for at least 90 days; access rights are reviewed at least every 6 months and when roles change, and revoked on departure.
• Transmission and storage: encryption in transit (TLS) for all user and API traffic; uploaded files and backups stored in object storage with server-side encryption provided by the storage provider; backup archives additionally encrypted before upload; database volumes are not encrypted at rest, and databases are protected by network isolation and the access controls above; hosting in the service region in data centres with physical access control operated by the hosting providers in Annex III.
• Environment separation: development, test and production environments are separated; production personal data is not used in development or test environments except where necessary to resolve a specific incident, documented, access-restricted and permitted by applicable law.
• Availability and resilience: backups of databases and uploaded files retained in the service region under the Processor's operational schedule; restore procedures tested at least once per quarter; specific RPO, RTO and retention commitments only where stated in the Order.
• Patch and vulnerability management: security updates for the Platform and its runtime are applied under a documented internal procedure with priority handling of critical vulnerabilities; dependencies are monitored for known vulnerabilities.
• Incident management: an internal procedure for detecting, assessing, containing and documenting security incidents and for notifying the Customer under Section 10.
• Vendor management: sub-processors engaged under written data-protection terms (5.3); onward transfers under Section 7.
• Data minimisation and deletion: AI operations transmit only the content of the specific operation (8.2); return and deletion under Section 11.
• Applicability to transfers: the measures above apply to the Customer's instance and, to the extent appropriate to the recipient's role, to transfers under Annex III; sub-processors apply their own equivalent measures. For the Unitify Limited support route, access takes place through logged, named-account remote sessions without bulk copying of databases outside the service region. For AI routes, only the content of the specific operation is transmitted (8.2) under the providers' no-training API terms and, where stated in the Order, zero data retention. For push notifications, only the device token and the notification text are transmitted. Sub-processors are bound to equivalent measures under 5.3.
• Supplementary measures for transfers: transport encryption, encrypted backup archives, named-account logged access, no bulk copying of databases outside the service region, contractual no-training terms with model providers, and a documented procedure for handling government access requests (notify the Customer where legally permitted, challenge unlawful requests, disclose the minimum required).

Annex III. Sub-processors

Category	Sub-processor	Country	Purpose	Data	Transfer mechanism
Unitify group	Unitify Limited, Hong Kong, company no. 76842989 (for Orders issued by a distributor)	Hong Kong	support, diagnostics and Platform updates under 6.2	logged access to the instance, no bulk copying of databases	SCCs Module Three between the distributor and Unitify Limited, or the mechanism in 7.6
Hosting, Kazakhstan	Modern Server Solutions LLP (Servercore), BIN 221140046930	Kazakhstan	hosting of the instance, databases and backups	all Customer Data	within the service region
Hosting, Uzbekistan	FE LLC "Servercore"	Uzbekistan	same	all Customer Data	within the service region
Hosting, EU	data centre operator in Germany, named in the EU Order	Germany	same	all Customer Data	within the EEA
Language models	OpenRouter, Inc. (aggregator) and the model providers it engages for the selected model: Google LLC, Anthropic PBC, OpenAI OpCo, LLC	USA	AI features under Section 8 (off by default)	content of the AI operation	on the Customer's instruction; SCCs Module Three with the UK Addendum where applicable, or the EU–US DPF and its UK Extension where the recipient is certified; no training on data under the providers' API terms; zero data retention per the Order (8.3)
Push notifications	Apple Inc.; Google LLC (Firebase Cloud Messaging)	USA	delivery of app notifications	device token, notification text	EU–US DPF and its UK Extension where the recipient is certified; otherwise SCCs Module Three with the UK Addendum
SMS and e-mail	regional providers named in the Order for the service region	service region / EU	login codes, notifications, invoices	phone, e-mail, message text	on the Customer's instruction; mechanism stated in the Order

This Annex is the agreed list of sub-processors for the purposes of Clause 9(a), Option 2 of the SCCs. The Processor updates it under 5.2. Entities marked "named in the Order" are identified for the Customer's service region in the Order or on request at [email protected]. Payment service providers and billing centres connected by the Customer are independent controllers (12.1) and are not listed here.