Data Processing Agreement (DPA)
Draft. Version 2026-10. Last updated 28 October 2026.
Parties and scope
This agreement is between the person or business using DwellCase for professional or business purposes, such as a landlord, property manager or short-term host (the “Customer”, the data controller), and CODE PRECISION spółka z ograniczoną odpowiedzialnością, os. Piastowskie 109/14, 61-165 Poznań, Polska (KRS 0000605845, NIP 7822611928, REGON 363886956) (“DwellCase”, the processor). It supplements the Terms of use and is a processing agreement under Article 28 GDPR.
It covers only personal data of third parties contained in the content the Customer uploads or syncs in DwellCase, such as tenants, guests, co-occupants and people visible in photos (“Content”). It does not cover private users, for example a tenant with a Renter Pass, or the Customer’s own account data (Apple identifier, email, purchases). For those DwellCase is the controller, as the Privacy policy explains.
Subject matter, nature and duration
DwellCase stores, syncs, backs up, exports (ZIP, download links) and deletes the Customer’s Content in order to provide the service. Processing lasts while the Customer has an account with cloud backup turned on and ends as set out in section 11.
Data and people concerned
People: tenants, guests, co-occupants and other people named or visible in the Content. Data: photos, documents, notes and descriptions the Customer uploads, including names, contact details and likenesses the Customer puts in them; file metadata (size, SHA‑256 hash, dates); optionally the location of a photo.
DwellCase does not expect special categories of data (Article 9 GDPR) or data about criminal convictions. The Customer does not upload them without a clear need and a legal basis.
Customer’s instructions
DwellCase processes Content only on the Customer’s documented instructions: this agreement, the Terms of use and the Customer’s use of the app’s features (upload, export, share, delete). If an instruction would infringe data protection law, DwellCase will tell the Customer without delay. DwellCase does not use Content for its own purposes, does not sell it and does not use it for advertising or to train models.
Confidentiality
People authorised by DwellCase to access Content are bound by confidentiality and have access only as needed. DwellCase does not look at Content unless that is necessary for security or to carry out the Customer’s instruction, for example a support request the Customer made.
Security measures
DwellCase applies measures under Article 32 GDPR, including the following. It describes its current measures in more detail on request.
- encryption in transit (TLS);
- private file storage in the EU with no public access, reached only through short-lived links;
- encryption at rest provided by the infrastructure providers;
- sign-in with Apple and short-lived access tokens;
- separate test and production environments;
- a log of sharing and export events;
- daily backups;
- redaction of sensitive data in logs and error reports.
Sub-processors
The Customer gives general authorisation to use sub-processors. Content is accessible to Hetzner and Cloudflare. DwellCase has contracts with sub-processors that impose equivalent obligations and remains responsible to the Customer for them. DwellCase tells the Customer by email or in the app at least 30 days before adding or replacing a sub-processor that has access to Content. The Customer may object in writing to support@dwellcase.com within that period. If the parties cannot agree, the Customer may delete the account and end this agreement. DwellCase provides the current list on request.
The sub-processors as of version 2026-10 are:
- Hetzner: hosting of the server and database (Nuremberg, Germany);
- Cloudflare: private file storage (R2, EU jurisdiction), backups and the website;
- Sentry: error reports (EU region, no Content);
- Resend: account emails (EU region);
- Apple: sign-in and purchases;
- Google (Gmail): support mailbox, receiving through Cloudflare Email Routing (USA, EU-US Data Privacy Framework and SCC).
Transfers outside the EEA
Content is stored in the EU (Germany; EU jurisdiction in Cloudflare R2). Some sub-processors are US companies (Cloudflare, Sentry, Resend, Google). Transfers rely on the adequacy decision for the EU-US Data Privacy Framework and, where it does not apply, on standard contractual clauses. DwellCase does not move Content elsewhere without meeting Chapter V GDPR.
Helping the Customer
The Customer can export and delete Content in the app, which supports requests from people exercising their rights (Articles 15 to 20). If a person contacts DwellCase directly, DwellCase passes the request to the Customer where the Customer can be identified. DwellCase helps the Customer, to a reasonable extent, with obligations under Articles 32 to 36 GDPR (security, breaches, impact assessments, consulting the authority).
Personal data breaches
DwellCase notifies the Customer of a confirmed breach affecting Content without undue delay and no later than 72 hours after confirming it, by email to the account address (or Apple private relay) and by a message in the app. The notice gives the information available: the nature of the breach, the categories and approximate number of people and records, likely consequences and measures taken. Further information follows in stages. The Customer is responsible for assessing whether to notify the supervisory authority and the people concerned.
Deletion and return of data
Before ending, the Customer can export all Content in the app. When the account is deleted, DwellCase removes Content from its database and storage immediately (through a job queue). Encrypted backups expire within 30 days. Files created for sharing and exports are deleted after 24 hours, and unfinished uploads after 24 hours. A Starter account that has been inactive for 24 months is deleted after an email sent 30 days in advance (paid accounts are not affected). Data stored on the Customer’s device stays under the Customer’s control. DwellCase keeps data longer only where the law requires it. Details are in the Privacy policy.
Audit and proof of compliance
On request DwellCase gives the Customer the information needed to show compliance with Article 28 GDPR. The Customer may carry out an audit (itself or through an independent auditor bound by confidentiality) no more than once a year, with at least 30 days’ notice, during business hours, at its own cost and without access to other customers’ data. Where sufficient, DwellCase may provide questionnaire answers or provider reports instead of an on-site audit.
Customer’s responsibilities
The Customer is responsible for having a legal basis to upload the Content, for informing the people concerned (for example tenants and guests) that the property is documented, for documenting places and people lawfully, and for not uploading data it has no right to. DwellCase is a documentation tool and does not provide legal advice.
Liability, governing law and versions
Each party’s liability is governed by the Terms of use and by mandatory law. This agreement is governed by Polish law. The supervisory authority is the President of the Polish Personal Data Protection Office (UODO). It applies for as long as DwellCase processes the Customer’s Content.
Version 2026-10 is accepted by a click in the app at purchase, and the acceptance (date, version) is recorded on the device. If DwellCase makes a material change it will publish a new version and notify the Customer at least 30 days ahead. The new version takes effect when that period ends, and a Customer who does not accept it may delete the account. For personal data in Content, this agreement prevails over the Terms of use in case of conflict.
Contact: support@dwellcase.com