Privacy Policy

1. Who is responsible for your data

DOMORDO is operated by the company named below, which is the controller for your account data (your name, email address, password, device and login records).

For the information inside a building — units, residents, notices, events, alerts, visitor and parcel records, documents — the management company that runs that building decides how the data is used. They are the controller for that data and we process it on their behalf as their service provider. If you want your building's data corrected or deleted, contact the management company first; we will help them act on your request.

• DOMORDO — Building Management Solutions
• Musterstraße 123
• 12345 Berlin
• Germany
• Email: info@residenzmanager.com
• Phone: +49 30 12345678

2. Data we collect

Depending on how you use the service, we process:

• Account details: name, email address, telephone number, role (owner, tenant, staff, security, management), password (stored only as a hash), and profile photo if you add one.
• Building membership: the building, floor and unit you belong to, invitation codes sent to you, the date you joined, and the permissions granted to you.
• Content you create or receive in the app: alerts, notices, events, meetings, messages, visitor and parcel entries, documents and their attachments.
• Device and usage data: device model, operating system, app version, language, time zone, push notification token, and records of when you signed in or opened an invitation link.
• Technical logs: IP address, request times and error information, kept for security and troubleshooting.
• Correspondence: messages you send to support, and enquiries submitted on our website.
• Billing data for management companies: company details, subscription and invoice records. Card details are handled by our payment provider and are never stored on our servers.

3. Why we process it, and on what legal basis

• To provide the service and your building's features — performance of a contract (Art. 6(1)(b) GDPR), or our and the management company's legitimate interests where you are not the contracting party (Art. 6(1)(f)).
• To send operational notifications by push and email — alerts, invitations, verification and password-reset codes — as part of providing the service.
• To keep accounts secure: rate limiting, one-time codes, fraud and abuse prevention — legitimate interests (Art. 6(1)(f)).
• To improve reliability, diagnose faults and maintain backups — legitimate interests (Art. 6(1)(f)).
• To meet accounting, tax and other legal duties — legal obligation (Art. 6(1)(c)).
• For anything optional, such as marketing email, we ask for your consent (Art. 6(1)(a)) and you can withdraw it at any time.

4. Notifications

The app sends push notifications for building activity such as critical alerts, events and messages. These are delivered through Apple Push Notification service and Firebase Cloud Messaging, which receive a device token and the notification content. You can turn notifications off in your device settings or in the app's notification settings; safety-critical alerts may still be delivered by other means, such as email.

5. Cookies and local storage

The web panel uses strictly necessary cookies and browser storage only. We do not use advertising cookies, and we do not use analytics cookies unless you opt in.

• Session cookie (rm_session): keeps you signed in. It holds your sign-in token, is marked httpOnly so no script on the page can read it, is restricted to our own site, is sent over HTTPS only, and expires after 30 days or when you log out.
• Browser storage: your cookie choice, the building you last selected, and the details needed to draw the interface before the first request answers, such as your name, email address and role. No sign-in token is kept here.
• Mobile app: the app keeps your sign-in token and the same interface details in the app's own storage on your device.

6. Who your data is shared with

We do not sell personal data and we do not share it for advertising.

• Other people in your building, to the extent the features require it: management staff can see the residents and units they administer; notices and events you publish are visible to the people they are addressed to.
• Service providers who work for us under contract: hosting and database providers, email delivery, push notification services, error monitoring and payment processing.
• Authorities, if we are legally required to disclose data, or to establish or defend legal claims.
• A buyer or successor, if the business is transferred — you will be told in advance.

7. Where your data is stored

Data is hosted in the European Union. Where a provider processes data outside the EU or UK, we rely on an adequacy decision or the European Commission's standard contractual clauses together with appropriate technical safeguards.

8. How long we keep it

• Account data: while your account exists, and up to 90 days after deletion in backups.
• Building content: as decided by your management company, and at most as long as they use the service.
• One-time codes and invitation links: minutes to 30 days, depending on their purpose.
• Technical logs: typically 30 days; longer where a security incident is being investigated.
• Invoices and tax records: for the retention period required by law (in Germany, up to 10 years).

9. How we protect it

Traffic is encrypted in transit (HTTPS). Passwords are hashed, one-time codes are stored hashed and expire quickly, and repeated wrong attempts invalidate them. Access to production systems is restricted to the people who need it, and permissions inside a building are limited by role.

Your web sign-in token is held in an httpOnly cookie rather than in browser storage, so it cannot be read by scripts running on the page, and logging out removes it on our side as well as in your browser.

10. Your rights

Under the GDPR you can ask for access to your data, correction of inaccurate data, erasure, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting past processing.

To exercise any of these, write to info@residenzmanager.com. You also have the right to complain to a data protection supervisory authority in your country of residence or workplace, or in Germany.

11. Children

The service is intended for adults. We do not knowingly create accounts for children under 16. If you believe a child has an account, contact us and we will remove it.

12. Changes to this policy

If we change this policy we will update the date above and, for significant changes, notify you in the app or by email before the change takes effect.

13. Contact

Questions about this policy or your data:

• DOMORDO — Building Management Solutions
• Musterstraße 123
• 12345 Berlin
• Germany
• Email: info@residenzmanager.com
• Phone: +49 30 12345678