Data Processing Agreement

§ 1. Subject matter and duration

1. The Controller entrusts the Processor with processing the personal data that the Controller or its Users enter into the App, to the extent and for the purpose set out in this Agreement.
2. This Agreement remains in force for the duration of the service agreement under the Terms and for the period needed to return and delete the data in accordance with § 9.

§ 2. Nature and purpose of processing

The data is processed solely for the purpose of providing the services of the Klino App to the Controller: planning and settling cleanings, organising the work of the team, drivers and linen, fetching bookings from calendars, creating and sharing reports, handling issues, preparing documents for the Controller's clients, sending notifications and technical support. Processing includes collecting, recording, storing, organising, viewing, making available to the Controller's Users, creating backups and deleting data, solely by automated means in IT systems.

§ 3. Type of data and categories of persons

• The Controller's Users (owner, coordinators): first name, last name, email, phone, role, profile photo, settings, history of actions in the App.
• Employees and contractors (cleaners, drivers): first name, last name, phone, email (including a technical one), role, rates, pay and settlements, schedule and availability, absences with their type (leave, sickness, other) and a note, assigned cleanings and shifts, reports and photos from work, login data (PIN code hash, login links, shortened IP address of login attempts).
• The Controller's clients (apartment owners and managers): first and last name or company name, email, phone, address, tax ID (NIP), notes, data for pro forma documents and invoices.
• Apartment guests: arrival and departure dates, number of guests, booking identifier and description from the iCal calendar (the description may contain the guest's first name, if the portal passes it on that way), photos from reports or issues, if a guest's belongings or data were accidentally captured in them.
• Apartments (data that may relate to natural persons): address and coordinates, access codes (door, intercom, key box), equipment, notes, attachments.

The Controller does not enter into the App special categories of data (Art. 9 GDPR), other than the information that an employee's absence is due to sickness, without stating its cause or any medical documents.

§ 4. Obligations of the Processor

1. It processes the data only on documented instructions from the Controller. Instructions are the Terms, this Agreement and the actions of the Controller and its Users in the App (e.g. adding an employee, connecting a calendar, sharing a report). If the law imposes an obligation of other processing, the Processor informs the Controller of this before it begins, unless the law prohibits this.
2. It informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other provisions.
3. It gives access to the data only to authorised persons bound by confidentiality, and only to the extent necessary (e.g. to remove an error or at the Controller's request for help).
4. It applies the security measures required by Art. 32 GDPR, described in § 6.
5. It assists the Controller, as far as possible and taking into account the nature of the processing, in fulfilling the rights of data subjects (access, rectification, erasure, restriction, portability, objection). It passes on a request addressed directly to the Processor to the Controller without undue delay and does not respond to it on its own.
6. It assists the Controller in fulfilling the obligations under Arts. 32–36 GDPR (security, breach notification, impact assessment, prior consultation).
7. It maintains the record of categories of processing activities referred to in Art. 30(2) GDPR.

§ 5. Obligations of the Controller

1. The Controller is responsible for having a legal basis for processing the data entered into the App, and fulfils the information obligations under Arts. 13–14 GDPR towards data subjects.
2. The Controller assigns roles and access to Users in line with the principle of minimisation and takes care of the confidentiality of passwords, PIN codes and the report links it shares.

§ 6. Security measures

• encryption of connections (HTTPS/TLS) and encryption of the database and files at rest at the infrastructure provider;
• separation of the data of different companies at database level (row access rules, Row Level Security) and permissions depending on the User's role;
• passwords and PIN codes stored only as hashes; a limit on the number of login attempts;
• protection of login and registration forms against bots (Cloudflare Turnstile);
• report links containing a random token, stored as a hash, with a default validity of 90 days and the option of earlier deactivation;
• regular database backups at the infrastructure provider;
• administrative access to systems only for authorised persons, with multi-factor authentication;
• monitoring of errors and abnormal operation of the application.

§ 7. Further entrustment (sub-processors)

1. The Controller gives general authorisation for the Processor to use further processors. The current list is below.
2. The Processor informs the Controller by email of an intention to add or change a sub-processor at least 14 days in advance. During that time the Controller may raise a justified objection and, if the parties do not reach agreement, terminate the agreement with immediate effect, at no additional cost.
3. The Processor imposes on sub-processors data protection obligations at least equal to those in this Agreement and is liable to the Controller for their performance.
4. Data is transferred outside the European Economic Area only on the basis of a European Commission decision finding an adequate level of protection (including the EU-US Data Privacy Framework) or standard contractual clauses adopted by the Commission.

Data may also pass through entities that are not sub-processors:

• browser push notification providers (Google, Apple, Mozilla) — they deliver encrypted notifications to the device of a User who has turned notifications on;
• booking portals and systems (e.g. Airbnb, Booking.com, IdoBooking, Smoobu) — the App fetches iCal calendars from them at the addresses provided by the Controller;
• WhatsApp and other messengers — only when a User shares a link themselves (e.g. a report, an invitation with a PIN) using the “Send” button;
• Microsoft and Google as login providers (OAuth) — only when a User chooses to log in with their account.

§ 8. Personal data breaches

1. The Processor notifies the Controller of a personal data breach without undue delay, no later than within 48 hours of discovering it, by email to the Account owner's address.
2. The notification contains the information available at the time of notification, in particular that listed in Art. 33(3) GDPR, and is supplemented as new information becomes available.

§ 9. Return and deletion of data

1. After the end of the provision of the services the Processor keeps the Controller's data for 90 days. During that time the Controller may request a copy (export) of the data at kontakt@klino.pl.
2. After that period the Processor deletes the Controller's data, including photos and attachments, and from backups as part of their normal overwrite cycle, unless EU or Polish law requires its further storage. On request it confirms the deletion by email.

§ 10. Audit

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, including by answering questions and security questionnaires.
2. The Controller may carry out an audit or inspection, on its own or through an authorised auditor bound by confidentiality, after giving at least 14 days' notice, no more than once a year, unless a personal data breach has occurred. The Controller bears the costs of the audit.

§ 11. Liability and final provisions

1. The parties' liability for damage resulting from a breach of this Agreement is governed by Art. 82 GDPR. As between the parties, the limit in § 10 of the Terms applies, to the extent permitted by law.
2. In matters not regulated here, the Terms and the provisions of the GDPR apply. In the event of a conflict, this Agreement takes precedence.
3. This Agreement is governed by Polish law.