Data processing agreement
This Data Processing Agreement ("DPA") is between the customer and [ENTITY NAME], [ADDRESS] ("Nabo"). The customer is the property manager, certified administrator or owners' association that creates a building on Nabo, acting as controller. Nabo acts as processor. It applies under Article 28 of the GDPR and Law No. 124/2024 of the Republic of Albania on personal data protection. A manager accepts it in the app when creating a building, on the controller's behalf; the version and the time are recorded.
1. Subject, duration and nature
Nabo processes residents' personal data to provide the building's private community service described in the terms: membership verification, feed, announcements, events, lend & borrow, messages, moderation and notifications. Processing lasts as long as the building uses Nabo, plus the deletion period in section 9. The details are in Annex 1.
2. Instructions
Nabo processes building data only on the controller's documented instructions. These are the terms, this DPA and the controller's use of the app's settings. Nabo processes no data for its own purposes. Nabo informs the controller if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone at Nabo who can access building data is bound by confidentiality. Nabo staff can open a building only through an audited support function that records who opened it and why.
4. Security
Nabo implements the technical and organisational measures in Annex 2 and keeps them appropriate to the risk (Art. 32 GDPR).
5. Assistance
Nabo helps the controller answer requests from residents. Residents can export their own data and delete their accounts in the app, and the controller can export the roster, delivery logs, audit log and content from the Admin tab. Nabo also assists with data protection impact assessments and with consultations with the supervisory authority, where needed.
6. Personal data breaches
Nabo notifies the controller of a personal data breach affecting building data without undue delay, and at the latest within 72 hours of discovering it. The notice includes the information in Art. 33(3) GDPR as far as it is known, and Nabo sends the rest as soon as it has it.
7. Sub-processors
The controller authorises the sub-processors on the sub-processor page. Nabo announces a new or replaced sub-processor at least 30 days in advance, by email and in the app. The controller may object on reasonable data protection grounds. If no solution is found, the controller may end the service, and fees for the remaining period are refunded. Nabo imposes the same data protection obligations on each sub-processor and remains responsible for them.
8. International transfers
Building data is stored in the European Union (Paris, France). Transfers outside the EU/EEA happen only as listed on the sub-processor page, under the European Commission's Standard Contractual Clauses. Transfers concerning Albanian buildings rely on the Commissioner's list of adequate countries or on equivalent clauses, with a documented risk assessment.
9. End of the service
When a building leaves Nabo, the controller can export its data while the building is read-only. Nabo deletes the building's content, photos and memberships 90 days after archival, and provides a deletion certificate on request. Records that Nabo must keep by law are kept only as long as required: invoices, the audit log and consent records.
10. Audits
Nabo makes available the information needed to show compliance with this DPA, including this document, Annex 2 and its sub-processors' certifications. Nabo allows audits by the controller or an auditor it appoints, at most once a year with 30 days' notice, unless a breach or a supervisory authority requires otherwise.
11. Precedence
If this DPA conflicts with the terms, this DPA prevails for the processing of personal data.
Annex 1: Details of the processing
| Data subjects | Residents, owners, tenants and household members of the building; the building's managers and moderators; people listed in the roster by the controller. |
|---|---|
| Personal data | Name, email address, optional phone number, photo and bio; building, unit, household and role; posts, comments, reactions, events, RSVPs, listings, loans and ratings; private messages; announcements, delivery and acknowledgement logs; official-notice consent; reports, moderation decisions and appeals; device tokens and language; audit log. |
| Special categories | None are intended. Residents may write such data in free text; the guidelines ask them not to. |
| Purpose | Providing the building's private community service and its administration tools. |
| Frequency | Continuous, while the building uses Nabo. |
| Retention | As set out in the privacy policy, section 6. |
Annex 2: Technical and organisational measures
- Tenant isolation: every building's data is separated by row-level security on every table. Automated tests show that a member of one building cannot read or write another building's data.
- Encryption: TLS 1.2 or newer in transit; encryption at rest by the hosting provider.
- Access: sign-in by email link, code or password; short-lived tokens (15 minutes) and session revocation; tokens in the device Keychain; least-privilege roles (resident, moderator, manager); staff access only through an audited function.
- Media: private storage; photos are served through signed links that expire and work only for members of the building.
- Logging: an append-only audit log of administrative actions, moderation decisions, exports, purges and staff access.
- Privacy by default: residents see only a first name and initial unless the person chooses otherwise; email addresses are never shown to residents; no advertising and no cross-app tracking.
- Resilience: managed database at the hosting provider, with backups [FREQUENCY AND RETENTION, per the hosting plan]; an offline cache on the phone that reconciles with the server.
- Incident response: a written runbook with notification to controllers within 72 hours.
- Deletion: scheduled retention jobs as in the privacy policy; export files expire after 7 days.