PRIVACY POLICY

This Privacy Policy has been prepared on the basis of applicable law, in particular the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the "GDPR". We highly value your privacy. That is why, in order to use the Brokik Platform, we collect and process only the data necessary to ensure the proper and secure use of the application, to maintain its reliability, and to develop it so that it becomes even better. Data is processed in the application only to the extent necessary for its proper functioning, and data is not transferred to other entities without your consent, except in the cases described below. Data processing takes place on servers located in the European Union, in data centers secured in accordance with applicable data protection standards, and only persons authorized by us have access to the data. For the purposes of analyzing the use and development of the application, we use anonymized data. Data transmission along the entire path from the device to our infrastructure is encrypted in accordance with current data transmission security requirements. However, we have no influence over the security of the device from which you use the Brokik Platform or the website. To avoid data theft from your computer or mobile device, remember to configure it properly, in particular by securing it against access by unauthorized persons, setting appropriate permissions for access to the camera and microphone, not installing suspicious applications or applications from unreliable sources, and avoiding the use of unknown internet connections (e.g. unverified, publicly available hot-spots).

INFORMATION ON THE PERSONAL DATA PROCESSED

Personal data controller The controller of personal data is WebET Sp. z o.o. with its registered office in Opole, ul. 1 Maja 30A, 45-355 Opole, Poland, entered in the Register of Entrepreneurs kept by the District Court in Opole, 8th Commercial Division of the National Court Register, under KRS number 0000940072, NIP (Tax ID) 7543346806, REGON 52071749700000, share capital PLN 5,000.00, e-mail: office@brokik.com (hereinafter referred to as the "Controller"). The Controller has not appointed a Data Protection Officer. Matters concerning the protection of personal data can be addressed to: office@brokik.com Legal basis for the processing of personal data Depending on the purpose for which we obtained and process your personal data, we may process it on one or several legal bases, listed below in the description of the individual data processing activities. Rights of the data subject In connection with our processing of your personal data, you have the right to:

• obtain information about our processing of your personal data, including the purpose of the processing, the categories of data processed, the legal bases for processing, the planned period of data processing, the categories of recipients of that data, including recipients in third countries, the origin of the data, any use of profiling and automated decision-making, and your rights related to our processing of personal data;
• access to your personal data – so that you can verify what data we process, for what purposes, whether it is correct and processed in accordance with the principles of processing we have informed you about, and whether your rights related to data processing are being exercised;
• data portability – you may request that we transfer to you your personal data (but only that which we received directly from you, with your consent or as a result of the performance of a contract, and which we process in electronic systems), in a commonly used, machine-readable format, or that we send that personal data to another controller;
• rectification of your personal data – if you believe that we are processing your data which is outdated or incorrect, you may send us a statement regarding the incorrectness of your personal data;
• erasure of data – if, in your opinion, there are no grounds for us to process your data, you may request that we erase it;
• restriction of processing – you may request that we restrict the processing of your personal data if you believe that the data we process is incorrect, that we are processing it without a legal basis, but you do not want us to erase it because you need it for the protection, pursuit, or establishment of claims, or for the duration of an objection you have raised to the processing of data. Restriction of processing means that we will only store your data or will only carry out actions on it that you have agreed to;
• object – if we process personal data on the basis of our legitimate interest, or in the performance of obligations imposed by national or EU law, you may object to the processing if you believe that your rights and freedoms take precedence over those interests. Where we process data on the basis of our legitimate interest, after you lodge an objection we may no longer process your data for that purpose;
• withdraw your consent to processing at any time, if the processing is based on your consent. Processing carried out before the withdrawal of consent remains lawfully carried out.

How to download a copy of your data and delete your account in the app is described under “Your data”.

Giving consent to processing, conditions for the lawfulness of processing, and the obligation to provide personal data No one has the right to require you to give consent to the processing of personal data or to force such consent. Consent to processing is always given voluntarily. At any time, if the processing of your data is based on consent given, you may withdraw it. However, this does not affect the lawfulness of processing carried out before the withdrawal. However, in certain cases specified by law, we may be obliged to process your personal data. Providing the data is necessary to achieve the purposes of processing, e.g. creating a User account, using the Brokik application, performing a service, performing a contract, e.g. recording payments, making refunds, fulfilling obligations arising from consumer protection law, tax law, etc. Processing of children's data The Service is intended solely for adults. Before creating a User account, confirmation of the account holder's legal age is required. We do not knowingly process the personal data of minors; however, we cannot guarantee the full effectiveness of the age-verification system adopted. If we learn of a breach of the terms and conditions in this regard, or if we are informed that a User is a minor, we will block their account pending verification, and, absent a credible demonstration of legal age, the account will be deleted. Transfer of data to third countries and international organizations User data processed in connection with the use of the Brokik Platform may, in certain cases described below, be transferred to third countries, i.e. outside the European Economic Area, or to international organizations; however, it will only be transferred to places where users' rights are protected in accordance with the principles set out in the GDPR, primarily to processors supplying technologies supporting the service, which apply data protection mechanisms compliant with the GDPR, including approved standard contractual clauses. In certain cases, your data may be transferred by us, by entities providing services to us, or by entities supplying IT tools (e.g. supplying materials in electronic form, settling payments for services, embedded social media windows), to third countries or to international organizations, but only to places where your rights and freedoms are protected to a degree essentially similar to that ensured within the EEA, in accordance with the principles set out in the GDPR and other regulations concerning the protection of personal data and the rights and freedoms of data subjects. This may be related, for example, to entities that provide us with cloud computing services (e.g. as part of the Microsoft 365 or Google Suite package), when you browse our website with embedded plug-ins for, or embedded materials from, such media, especially when you have an account with those social media, when you make payments by payment card, etc. Due to the possibility of logging in using a Facebook account (SSO) and the use of Google services (including Google Tag Manager and Google Ads), User data may be transferred to the United States of America (USA). Data is also transferred to the USA in connection with the sending of e-mail messages via the Twilio SendGrid service. Data processed by the AI assistant and the document-matching function, operated by Anthropic, is also transferred to the USA — on the basis of standard contractual clauses (details in the section "AI Assistant and Processing by Anthropic"). Measurement of advertising effectiveness (offline conversions). If a User arrived at the Service from a Google Ads advertisement, the advertisement click identifier (the so-called gclid) may be saved together with the event of leaving an e-mail address in the document generator or registering an account. On this basis, the Controller transmits to Google Ads — server-side — information that such an event occurred (without the content of the documents), in order to measure the effectiveness of advertising. The basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR) consisting in measuring the effectiveness of marketing activities. The scope of the data transmitted includes only the click identifier and the type and time of the event. Google, Meta (Facebook), and Twilio ensure an adequate level of data protection on the basis of certification under the EU-U.S. Data Privacy Framework and standard contractual clauses approved by the European Commission, and in this way guarantee a level of personal data protection equivalent to that required by European Union law. Categories and scope of personal data processed In order to achieve the specific purpose for which we obtained your personal data (e.g. correspondence, access to the Service, ensuring its functioning, keeping settlements with Users, sending information), we must process data to the extent necessary to achieve that purpose ("purpose of personal data processing"). However, we always collect and process only the data that is necessary to achieve that purpose, in accordance with the principle of data minimization. Detailed information will be provided below, for each individual data processing activity. The Controller collects the following personal data:

• Registered Users of the Brokik application - Landlords: first name, contact details (e-mail, phone number), photograph or avatar, age over 18, details of the business run (name, address, NIP and REGON numbers), login, password in encrypted form, identifier assigned by the application, application settings;
• Users of the Brokik Application - Tenant: first name, last name, e-mail, phone number, photograph or avatar, age over 18, login, password in encrypted form;
• Users of the Brokik website: IP address, server date and time, information about the operating system, web browser, its version and language settings, the pages from which redirection took place, the name of the page or file called;
• Persons corresponding via the contact form: first name, e-mail address, content of the correspondence, date, time, and technical information related to the correspondence sent;
• Visitors to Brokik's social media profiles: first name, last name, nickname, e-mail address, photograph or avatar, other information about the user saved in their profile, content of the correspondence, browser type, IP address of the newsletter recipient;

The personal data listed above is processed by WebET Sp. z o.o. as the controller of the personal data of the Platform's Users, to the extent necessary to register and administer User accounts and settle accounts with them, the data of counterparties, persons visiting the website, social media profiles, or communicating with the controller via contact forms placed on the website and on the Brokik Platform, Data collected and processed on the accounts of Brokik Platform Users In connection with Users' use of the functionalities of the Brokik Platform, the following personal data is processed, depending on the specific situation: the User's name/nickname, first name, last name, photograph or avatar, details of the business run (name, address, NIP and REGON numbers), contact details – e-mail address, telephone number, data on the leased premises (addresses, area, rent amount, data from bills/invoices and other settlement documents issued by the Landlord, utility providers, property managers), data contained in uploaded copies of contracts, attached photographs, etc., the content of correspondence with tenants in chat, selected payment methods, the number of the linked bank account and/or payment card. This data is collected in the Service application, located on our servers. With regard to Users' use of the functionality of the part of the Platform made available to Users, WebET Sp. z o.o. is a processor of personal data entrusted to it for processing by Users. Users, in particular those who lease premises, if they do not benefit from the exclusion from the GDPR under Article 2(2)(c) GDPR (activities of a purely personal and private nature), are the controllers of the personal data of their Tenants and of any other persons processed in connection with information posted within their Brokik Platform account, including that contained in documents and communications. Users who, within the meaning of the GDPR, are controllers of personal data are required to enter into a personal data processing agreement with the Company. Users who are controllers of personal data are required to process the personal data made available in connection with their own and the other Parties' use of the Platform in a manner ensuring the security of the personal data processed and in accordance with applicable data protection law, in particular the GDPR, including ensuring the application of organizational, technical, and IT measures adequate and consistent with the current state of knowledge, in order to secure their own IT and telecommunications infrastructure cooperating with the Platform, including maintaining the confidentiality of the data necessary to log into the account, and admitting to processing only authorized persons who have been bound to confidentiality. These Users are also required to provide persons whose data they process using a Brokik Platform account with information about their processing of personal data and about the rights of the persons whose data they process. All Users are obliged to ensure the security of data processing while using the Platform and not to disclose such data to unauthorized persons or for purposes unrelated to the performance of the Property lease. Unless they have obtained the express, separate consent of the data subject, Users may not use the personal data of the Company's employees, associates, or subcontractors, or of other Users, which they received via the Platform, for purposes other than using the Platform and matters related to conducting the administration of the property lease and settlements between the Parties to the lease. With respect to Users using the Platform solely for personal or household purposes (the scale and scope of their activity does not exceed the ordinary personal or household use of personal data, e.g. they do not conduct leasing on a larger scale of a nature similar to business activity), the provisions of the GDPR do not apply. In such a case, the User is exempt from the obligation to conclude a data processing agreement, but remains responsible for protecting the personal data of other Users that they process in connection with the use of their User Account. For the purposes of analyzing the manner in which the Service is used, better tailoring it to needs, and its development, statistical, anonymous data not linked to a specific person is also collected, such as the number of views of individual sessions, the time and manner of using the Service, and other statistical data listed below in the description of the individual analytical plug-ins. Sharing of personal data We do not share personal data with other controllers, without your consent, for purposes unrelated to the purposes of processing for which it was collected. However, in order to achieve the purpose of processing, it is often necessary to entrust the processing of data to processors or to share data with controllers with whom we cooperate in connection with the performance of that processing purpose, or when applicable law requires it of us. The categories of such entities include, among others:

• entities providing IT services and technical support;
• entities providing legal services for us;
• entities providing cloud computing services, providing mail servers, platforms delivering materials in electronic form to readers, videos; social media platforms, etc.;
• banks in which we hold accounts, electronic payment systems, payment card issuers;
• postal operators and courier companies;
• entities providing accounting services for us;
• entities providing access to platforms used to improve the work of the controller's business, if the operation of the platform requires that personal data be transferred to them;
• supervisory and control authorities, judicial authorities, etc., but only to the extent required by law.

In order to ensure the use of the Brokik.com Platform, logging in, ensuring the efficient operation of the Service, and its development, certain personal data is transferred to our partners providing the aforementioned services:

• To entities providing us with infrastructure and technical support services ensuring the functioning of the Service, server hosting, and data transmission. These entities, or their subcontractors, meet the conditions ensuring the security of data processing and process data on the basis of agreements concluded with us and on our instructions.

Profiling and automated decision-making We do not carry out profiling or automated decision-making. The processing of data related to the use of the Service is limited to activities related to operating the Service, ensuring its functionality and security, and properly serving Users. The summaries created do not have the character of creating user profiles and assigning specific users to such profiles. The aggregate analytics conducted are aimed at understanding how the Service is used, which elements are most frequently and most willingly used, and are not linked to the possibility of identifying individual participants. We do not carry out profiling concerning specific persons, nor do we carry out processing that would result in automated decision-making. This also applies to the AI assistant: it is an artificial intelligence system whose responses are informational in nature and do not constitute legal advice, which does not save anything without approval by the User, and which does not make decisions producing legal effects (details in the section "AI Assistant and Processing by Anthropic"). Right to lodge a complaint in the event of unlawful processing of personal data If you believe that we are processing your personal data unlawfully and we are not responding properly to your requests, you may lodge a complaint with the competent supervisory authority, which in Poland is: the Personal Data Protection Office (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, Helpline: 606-950-000, e-mail: kancelaria@uodo.gov.pl

Purposes, duration, and legal basis of processing

• Brokik Platform

In order to use the Platform and its functionalities, the user must create a User account. Data provided by the user is processed in connection with the conclusion of a contract for the provision of services by electronic means with the Controller, is processed for the purpose of performing the contract – ensuring the ability to use the Platform and the services provided through it (Article 6(1)(b) GDPR) and settling accounts for services (Article 6(1)(c) GDPR) - a legal obligation arising from the provisions regulating business transactions, accounting, tax law, etc.; legitimate interest – processing data to ensure the proper functioning of the Platform, detecting and preventing abuse, the correctness of settlements, handling complaints, and pursuing and enforcing claims - Article 6(1)(f) GDPR. We process the personal data of persons who have registered with the Service. We received the data from persons registering personally in the application. Providing personal data is necessary to the extent required to complete registration, use the functionality of the Service, and carry out settlements and the Platform Provider's compliance with legal obligations. Refusal to provide this data will make it impossible to use this part of the service. Data provided in connection with the creation of an account on the Brokik Platform, during its use, will be processed for the duration of the performance of the contract for the provision of services by electronic means on the Platform on the Company's server. We store data entered by the User on the Account for the duration of holding the Account — also after the end of the paid period, when the Account remains in a state of Restricted Access. An Account not used for 12 consecutive months is deleted by us after prior notice, on the terms of § 10b of the Terms and Conditions. When you delete your account, we remove the account's data from Brokik, including the invoices and payment history shown in the app. Copies of accounting documents we must keep under tax law are kept outside the app — in our accounting systems and with our payment provider — for the period the law requires. After deleting the account, we also keep data necessary to establish, pursue, or defend against claims — for the period of their limitation. The Controller will store data concerning settlements for the use of the application for a period of 5 years from the end of the tax year in which the tax obligation arose.

• Electronic signature of documents

The Platform enables generated documents (agreements, handover protocols) to be provided remotely with an electronic signature. The identity of the signing person is verified by means of a one-time code (OTP) sent to their e-mail address. In connection with this functionality, we process: the signatory's first and last name and e-mail address, their role in the signing process, the date and time the signature was made, the IP address, and browser information (user agent), as well as a record of the events of the signing process (audit trail). The OTP code is stored only in encrypted form and expires after 10 minutes. This data is processed for the purpose of performing the contract and enabling the submission of a statement of intent in electronic form (Article 6(1)(b) GDPR), as well as for the purpose of confirming the authenticity and integrity of the signed document, detecting abuse, and establishing, pursuing, or defending against claims, which constitutes our legitimate interest (Article 6(1)(f) GDPR). An invitation to sign (signing session) is valid for 7 days. The signed document and the data related to it (audit trail) are stored until the account is deleted.

• Online payments for the services of the brokik.com Platform are made using payment systems integrated with the Service belonging to the following payment organizations:
• the Stripe system of Stripe Payments Europe, Limited, with its registered office in Ireland, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. https://stripe.com/ie/privacy
• With respect to the processing and settlement of payments for purchased subscriptions, making payments, and settlements between Users in connection with the performance of premises leases, the payment organization is an independent controller of the personal data of brokik.com Platform users made available for the purpose of making payment for the service, who are redirected from the brokik.com website to the payment organization's payment panel.
• For the purpose of processing payments, we make available to the payment organization the following personal data of users: first name, last name, e-mail, telephone number, address, postal code, order number, transaction amount. When handling complaints, additionally information concerning: the details of the transaction made, confirmation of delivery (performance) of the service, additional information e.g. from correspondence, confirmation of a refund or cancellation of payment, and other documents necessary to handle the complaint.
• We have access to the payment organization's Merchant panel, thanks to which we can obtain, aggregate, and manage information about the history and status of transactions.
• For the purpose of processing payment, the user is redirected to the payment organization's online platform. We do not have access to the data that the user enters for the purpose of making the payment, in particular payment card data and payment authorization data, nor do we collect any identification data related to such payments.
• We apply the necessary security measures to protect personal data on the brokik.com application website and during data transmission. These safeguards comply with the requirements imposed on payment merchants by the payment organization. Only persons authorized in accordance with the Controller's applicable Personal Data Protection Policy and the payment organization's guidelines are admitted to process the personal data of brokik.com users and to operate the payment organization's Merchant panel.
• In order to process payments, the payment organization transfers or may transfer, depending on the payment method selected, the data of the user necessary to make the payment or to fulfil the legal obligations incumbent on it: to banks, payment organizations (card issuers) and affiliated entities, credit information bureaus, fraud prevention bureaus, law enforcement authorities, tax authorities, the Polish Financial Supervision Authority (KNF), the General Inspector of Financial Information (GIIF), the National Bank of Poland (NBP), and entities acting on the instructions of the payment organization.
• Documents evidencing the performance rendered are stored for a period of 24 months,
• Before making a payment, the user is required to accept the terms and conditions of the payment organization's service and to confirm that they have read the information on the processing of personal data. The privacy policies of the payment organizations are available at the links provided above, alongside the information about each payment organization

The basis for processing the data is the performance of the contract (Article 6(1)(b) GDPR) and the fulfilment of a legal obligation in the field of accounting and taxes (Article 6(1)(c) GDPR).

• Brokik website

When using the website, we process the data necessary to log into the Service, as informed above, as well as data necessary for the proper functioning of the website www.brokik.com and related to sending requests to the server, including the IP address, server date and time, information about the operating system, web browser, its version and language settings, the pages from which redirection took place, the name of the page or file called, and the time of access. This data is stored in server logs, is not associated with a specific person, constitutes only auxiliary material used to administer the application and the server, and is not disclosed to anyone other than persons authorized to administer the server. For its efficient operation, its development, analysis of use of the website, and adaptation of its functionality to users' needs, the website uses cookies and analytical technologies and social media plug-ins, which are discussed separately. We process the personal data of persons visiting the website, persons logging into the Service, and persons contacting us via the contact form. The legal bases for processing are: Consent (Article 6(1)(a) GDPR) in the case of processing personal data as a result of saving on the user's device information collected in cookies other than those necessary for the proper functioning of the website (analytical, marketing); Legitimate interest (Article 6(1)(f) GDPR) in the case of processing your personal data for the purpose of carrying out activities promoting the Controller's business, preventing abuse, and pursuing and defending against claims. This basis for processing also serves to study statistics on website visits, the manner in which visitors use it, and to tailor its content to users' needs.

• Blog

On our website we make available blog posts with information on topics related to the Brokik application. The blog is run on Brokik's own infrastructure, and the content is published directly by the Controller. Browsing the blog only involves the processing of technical data stored in server logs (described in the "Server Logs" section), in order to ensure the proper and secure functioning of the website. The basis for processing is our legitimate interest (Article 6(1)(f) GDPR).

• Contact form

When contacting the Controller via the contact form, the user provides their first name, e-mail address, and the content of the inquiry. Providing the data is voluntary, but necessary to establish contact. Data provided via the contact form is used for the purpose of contacting the User. The legal basis for its processing is the user's consent (Article 6(1)(a) GDPR) to contact by electronic means of communication, resulting from the initiation of contact, and our legitimate interest (Article 6(1)(f) GDPR) in responding to inquiries concerning our services and products. Furthermore, depending on the purpose of the contact, the basis may be the taking of steps to conclude a contract (Article 6(1)(b) GDPR). After the contact has ended, the legal basis for processing the data is the Controller's legitimate interest (Article 6(1)(f) GDPR) in the form of archiving correspondence for the purpose of demonstrating its course in the future, in particular for the purpose of demonstrating the user's consent to contact and defending against potential claims by the user. The data will be stored for the time necessary to respond to the inquiry, to maintain a history of correspondence, where this results from its nature, and for the time necessary to ensure a defense against claims. Profiles and fan pages on social media

• In order to promote our business, inform about our activities and events organized, communicate with Users, present our opinions and positions, and enable contact and the exchange of opinions with social media users, we maintain our profiles on the Facebook social media platform.
• In order to make full use of these social media, in particular to comment on our posts, take part in discussions, share our posts, follow us, like our content, etc., it is necessary to have an account (profile) on that social media platform. With regard to the creation and functioning of such an account, the controller of personal data is, respectively, Meta Platforms. Content, including first and last name, profile photo, profile information, and information resulting from activity, is available to other users of these platforms and is also publicly available and may be viewed by persons who are not users of a given platform.
• In running the Service's social media accounts, we process data made available to us by users of that media who visit our profiles, via the providers of those social media platforms.
• As a result of the operation of our profiles, we process:
  • personal data received from social media users who directly make posts, recommend posts, etc.:
• the user's first and last name and/or online nickname,
• their profile photo or user avatar,
• other data published by the user on their profile,
• photographs or multimedia (which may contain images of other persons) posted by visitors as part of the fan-page–user relationship,
• data published by users adding comments to our posts, which may contain personal data.
• The content of communication conducted via the Messenger application, which may contain personal data such as, for example, e-mail address or telephone number
  • data obtained from the social media provider,
• the user's first and last name and/or online nickname,
• their profile photo or user avatar,
• other profile information contained in the user's profile
• IP address, information about the user's browser,
• Anonymous statistical data on visitors made available by the social media providers. We process this data mainly through accessing and reading it, commenting on it, and recommending it, in connection with using our social media accounts, managing them, and placing embedded windows of these media on the website www.brokik.com. We do not use this data, apart from information related to conducting correspondence and managing profiles, for processing for other purposes.
• The legal basis for processing data for the purposes described in point 13(a) above, informing about and promoting our business, and using statistics on how our profiles are used, and counteracting abuse, is our legitimate interest (Article 6(1)(f) GDPR).
• Information published by users adding comments to our posts, which may contain personal data, is published at the responsibility of its authors. A person who posts their personal data in comments and posts added on our profiles, by their conscious action, consents to our processing of data to that extent. If such a person posts the personal data of other persons who do not hold public functions or are not public figures, they are obliged to have the consent of such persons and do so at their own responsibility.
• We ask that you do not include in your posts information (personal data) classified as so-called "sensitive data", in particular concerning persons other than the author of the post or comment. We will consider the provision, by the person making the post, of such information about themselves, as the voluntary disclosure of that information to the public and the granting of conscious and explicit consent to the processing of that data (Article 9(2)(a) and (e) GDPR).
• At the reasonable request of the data subject, subject to persons performing public functions and information concerning their public activity, information contained in journalistic or similar materials, in the reasonable exercise of the right to freedom of expression, or in the event of a noticed breach of the terms and conditions of a given social media platform, the law, or good practice, such posts will be removed.
• Your personal data, processed in connection with the use of social media by visitors, commenters, etc., is processed for the period our profiles operate and for the period resulting from the terms and conditions and privacy policies of the providers of that media, and therefore we generally have no influence over how long it will be processed. In the case of communication via Messenger, information is stored for the period of its usefulness or until your reasonable request for erasure of the data is received. We periodically review correspondence and delete correspondence that is no longer useful.
• With regard to the processing of personal data on our social media profiles, we entrust the processing of personal data to the providers of those platforms and, to the remaining extent, to the entities listed in the general part of this Policy.
• To a certain extent, in the processing of personal data as part of the use of the Facebook service, both on the Controller's profile and as a result of the use of plug-ins such as "Like" or certain cookies installed by the provider, and the related analytics carried out by Facebook, there is joint controllership of personal data with Meta Platforms.

Joint controllership consists in the joint use, although for a different processing purpose and to a different extent for each of the joint controllers, of the results of data processing. For Meta Platforms this will involve the use of aggregated statistical data obtained through such processing of data for further use purposes, including the commercialization of the results of these analyses, e.g. in the field of targeting advertisements to its clients, while for the Brokik Service it involves obtaining statistical information showing how visitors use the Controller's websites and social media profiles. As a result of this joint controllership, we do not obtain information that could identify a specific person. The arrangements determining the scope of joint controllership, including the rules on responsibility for the processing of your personal data, can be found at: https://www.facebook.com/legal/terms/page_controller_addendum. In accordance with these rules, Facebook undertakes to assume primary responsibility for processing your data for statistical purposes and for fulfilling all relevant obligations set out in the GDPR with regard to the processing of your personal data for statistical purposes. More information about the processing of your data by Facebook can be found at: https://www.facebook.com/privacy/explanation.

• Since Meta Platforms are entities operating globally and holding servers in the USA, they may store and process part of the data outside the EEA. These companies apply measures ensuring an adequate level of protection of the rights and freedoms of EEA residents, including standard contractual clauses approved by the European Commission.
• Within the tools made available to us in the administrator panels of these platforms, we have access to anonymous statistical information about how different groups of users use them, e.g. broken down by geographic, demographic data, gender, and age. This information allows us to understand how different groups of users use our profile, which helps us improve it. More information on the processing of data by social media providers can be found at these links:
• Meta Platforms (Facebook) https://www.facebook.com/legal/FB_Work_Privacy ,

Server logs Using the Service or the website involves the transmission of technical data to the server on which the application is stored, and its storage in server logs. Logs are recorded and stored on the server. Logs contain, among other things: the time of using the Service or the website, the functions used, client station data, technical connection data, and information about errors that occurred while performing the service. The above data is used solely for the purposes of administering the Service or the website. Its content is not disclosed to anyone other than persons authorized to administer the application and the server. Recipients of data and processors User data may be processed by the Controller's subcontractors, i.e. entities whose services the Controller uses when processing data and providing services to the User, namely:

• Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland – payment services (handling of payments and subscriptions) https://stripe.com/ie/privacy
• Twilio Inc. (SendGrid service), 101 Spear Street, Suite 500, San Francisco, CA 94105, USA – sending of e-mail messages within the application; transfer of data to the USA on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses https://www.twilio.com/en-us/legal/privacy
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – server hosting and storage of files, photographs, and documents of the Brokik Platform; data is stored in data centers within the European Union and made available, among other means, via cdn.webet.pl https://www.hetzner.com/legal/privacy-policy
• Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, and Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA – provider of the language model (Claude) powering the AI assistant and the document-matching function on the Platform; transfer of data to the USA on the basis of standard contractual clauses approved by the European Commission, forming part of the data processing agreement concluded with Anthropic; details in the "AI Assistant and Processing by Anthropic" section below https://www.anthropic.com/legal/privacy https://www.anthropic.com/legal/commercial-terms https://www.anthropic.com/legal/data-processing-addendum
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – for the purpose of using Google services, as part of the G-Suite package, including e-mail,
• Meta Platforms Ireland Limited (Facebook), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland – to enable logging into the application using a Facebook account (SSO);
• contractors or subcontractors engaged to create and operate the application, provide technical or administrative support, or to provide services to the Controller.

AI Assistant and Processing by Anthropic The Platform provides an AI assistant (including the initial account-setup chat) and a function for tailoring the content of a lease agreement or handover protocol to the User's instructions. Both functions operate on the basis of the Claude language model supplied by Anthropic, indicated on the above list of processors. The assistant is labeled on the Platform as the "AI Assistant". Scope of data. The following is transmitted to the model: the content of messages entered by the User in the assistant's window, files attached by the User (photographs or PDF documents, e.g. agreements and statements), the history of the current conversation, the content of the document-matching instructions (without the content of the document itself), contextual information (account type, language, date, the name of the screen and the property the User is currently viewing), and data from the User's account read by the assistant in connection with the User's question, in particular: the list of properties and their addresses, the amount of rent and deposit, the lease status and its duration dates, information on whether the agreement and protocol have been signed, arrears, invoices, settlements and payment deadlines (in a tenant account, also the bank account number for payments indicated by the owner or manager), meter readings, fault reports, upcoming events (including tax advance deadlines, meetings, and property viewings), the subscription plan, and – with respect to a given lease – the tenant's first and last name and e-mail address or the name of the tenant's contact person, the display name of the owner or manager, and, in a manager's account, also the name of their client (the property owner) and the first and last names of persons interested in the lease. The assistant has access only to the data visible to the User in their account, including data of the other party to the lease to the extent indicated above; it does not have access to the data of other Users or other tenants. Data that is not needed to obtain an answer should not be entered into the assistant, in particular special category data (Article 9 GDPR). Purpose and legal basis. Data is processed solely for the purpose of performing the function requested by the User (Article 6(1)(b) GDPR – performance of the contract for use of the Platform). With respect to tenant data entered into the Platform by the owner or manager, the Controller acts as a processor on the instructions of that owner or manager, and Anthropic acts as a sub-processor. The tenant uses the assistant free of charge, solely with respect to the data of their own lease made available by the owner or manager. Transfer to the USA and retention period. Anthropic processes data on servers in the United States on the basis of standard contractual clauses approved by the European Commission (modules two and three), forming part of the Data Processing Addendum concluded with Anthropic. The text of these clauses is available at https://www.anthropic.com/legal/data-processing-addendum; a copy can also be obtained by writing to office@brokik.com. In doing so, Anthropic uses its own further sub-processors (providers of cloud infrastructure in the USA), the current list of which is available at https://www.anthropic.com/subprocessors. Under Anthropic's commercial terms, data submitted through the application programming interface (API) is not used to train models, and, under Anthropic's retention policy, data entered and responses generated are deleted from Anthropic's systems no later than 30 days after receipt, except where required by law and content flagged by Anthropic's automated safety systems as a potential violation of usage policies (in which case, up to 2 years). On the Controller's side, conversation history, attachments, and the assistant's proposals are stored in the User's account until the account is deleted. Independently of this, the Controller maintains a technical log of model calls, comprising the full content of the request submitted to the model (including account data read by the assistant; excluding the content of attachments), the model's response, the model name, the number of tokens, and the response time. The log is stored for billing purposes, to ensure security and detect abuse, on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR), for 12 months from the call, but no longer than until the User's account is deleted. Information about the AI system. When using the assistant, the User is communicating with an artificial intelligence system, not with a human being. The assistant's responses are informational in nature, may contain errors, and do not constitute legal, tax, or financial advice. The assistant does not, on its own, save or change data in the account and does not send messages or invitations – the User manually approves every proposal (e.g. to add a property or invite a tenant), and the document-matching function makes changes only at the User's explicit instruction, in an unsigned document which the User may continue to edit. The assistant does not make decisions concerning the User that produce legal effects or similarly significantly affect them (Article 22 GDPR). Account summary and reminders about next steps. To users who have not consented to receive commercial information, the Controller sends service messages related to using the Platform, if they are users of owner accounts with an active plan, including while it is being renewed, excluding accounts activated in the owner portal shared by a manager, provided they have not turned off such messages: no more often than once every 14 days, an account summary showing the Platform features already used in the account and the features the User has not yet used. Users who have consented to receive commercial information receive this summary in full on the basis of that consent, no more often than once every 14 days. To users of owner and manager accounts who have not added any property, the Controller sends, once, between 24 and 72 hours after registration, a reminder to add the first property, provided they have not turned off service messages. These messages do not contain commercial offers and do not require consent. The basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR), consisting of informing the User about the status of their account and making it easier for them to use the Platform. Each such message contains a link that turns off further sending with one click, and a link to the account settings where it can be turned off or turned back on. Clicking the unsubscribe link turns off the summary, reminders, and the newsletter, and also withdraws newsletter consent if it was given; messages necessary to provide the service, such as confirmations, invitations to sign documents, or settlements, are still sent. In order to prepare the content of the summary, a profile of account usage is transmitted to Anthropic, indicated above as the processor for the AI assistant, comprising: the language and country of the account, the age of the account, the addresses of the properties on the account and the start and end dates of the leases, and the list of Platform features used. No first names, last names, e-mail addresses, or any amounts are transmitted to Anthropic. The transmitted profile and the content of the message generated on its basis are stored in the account's mailing log. Newsletter and offers. The Brokik newsletter (descriptions of Platform features, new blog posts) and commercial information, such as offers and promotions, are sent electronically by the Controller only to Users who have consented to this – during registration, by ticking the optional, unchecked-by-default box, or later in the account settings. The basis for processing is the User's consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time, in the account settings or by clicking the unsubscribe link included in every message. Withdrawing consent does not affect the lawfulness of sending carried out before its withdrawal.

COOKIES, SOCIAL MEDIA TOOLS, AND SERVER LOGS

What are cookies?

• The Brokik website uses first-party and third-party cookies. These are small text files sent by the web server and stored by the browser software on the computer. When the browser reconnects to the website, the website recognizes the type of device from which the user is connecting. The parameters allow the information contained in them to be read only by the server that created them. Cookies make it easier to use previously visited websites. The information collected concerns the IP address, the type of browser used, the language, the type of operating system, the internet service provider, time and date information, approximate location, and information transmitted to the website via the contact form.
• The data collected is used to monitor and check how users use the website in order to improve the functioning of the Service, ensuring more effective and trouble-free navigation. We monitor information about users using the Google Analytics tool, which records user behavior on the website. Cookies identify the user, which allows the content of the website they are using to be tailored to their needs. By remembering their preferences, it allows advertisements directed at them to be appropriately tailored. We use cookies to guarantee the highest standard of convenience of our Service, and the data collected is used solely to optimize its operation.
• The Service uses two basic types of cookies – session and persistent. Session cookies are temporary; they are stored until the user leaves the Service's website (by going to another website, logging out, or closing the browser). Persistent cookies are stored on the user's end device until they are deleted by the user or for the period resulting from their settings.
• We use the following cookies on our websites:
• "necessary" cookies, enabling the use of services available within the Service, e.g. authentication cookies used for services requiring authentication within the Service,
• cookies used to ensure security, e.g. used to detect abuse in the field of authentication within the Service,
• "performance" cookies, enabling the collection of information about how the Service's websites are used,
• "functional" cookies, enabling the "remembering" of settings selected by the user and personalization of the user interface, e.g. with respect to the selected language or region the user is from, font size, the appearance of the website, etc.,
• "advertising" cookies, enabling advertising content to be delivered to users that is better suited to their interests.
• Before first visiting the website from a given browser, the user will be shown a banner with information about the cookies used by the website and enabling them to choose the scope of cookies saved on their device. Until the choice is confirmed (consent, refusal, or individual selection), only cookies necessary for the operation of the website's basic functions are installed on the device. Rejecting cookies other than necessary ones may result in some functionalities of the website working less well. The user may at any time change their cookie and similar-technology settings by clicking the "Cookie Settings" link located in the website's footer.
• The user may also, at any time, change the settings of their browser to block the handling of cookies, or to receive information each time about their placement on their device. Other available options can be checked in the settings of the internet browser being used. It should be remembered that most browsers are, by default, set to accept the storage of cookies on the end device.
• Changes to settings in the user's internet browser may limit access to some functions of the Service's website.
• Cookies used by the Service (placed on the user's end device) may be made available to its partners and cooperating advertisers.
• Information on internet browser settings is available in its menu (help) or on the website of its manufacturer.
• Google Chrome: https://support.google.com/chrome/answer/95647
• Internet Explorer: https://support.microsoft.com/en-ie/help/17442/windows-internet-explorer-delete-manage-cookies
• Microsoft Edge: https://support.microsoft.com/pl-pl/windows/program-microsoft-edge-i-przegl%C4%85danie-danych-a-prywatno%C5%9B%C4%87-bb8174ba-9d73-dcf2-9b4a-c582b4e640dd
• Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Safari: https://support.apple.com/en-ie/guide/safari/sfri11471/mac
• Safari Mobile: https://support.apple.com/en-us/HT201265
• Opera: https://blogs.opera.com/news/2015/08/how-to-manage-cookies-in-opera/
• More detailed information about cookies is available at aboutcookies.org
• List of cookies used on the Service and on the brokik.com websites

Other applications and plug-ins used in the Service and on the brokik.com website

• Local Storage, Session Storage

Our Service also uses a technology called Local Storage. Local Storage is a place for storing information made available by your browser. This data is saved in the browser memory of the person visiting our website. This data is retained in the browser even after it is closed. The application has access to the saved information even when the user later decides to return to our website, unless they have previously decided, from the browser settings, to clear the data. Unlike cookies, data saved in Local Storage is not transmitted by the browser with every visit to the website. For example, your searches are saved here, so that when you enter them again they appear as a suggestion, thereby making your search faster. Local Storage stores data long-term, until you restore the default settings or manually delete the data from the browser cache. Instructions can be found above or in the menu bar of each internet browser, in the "Help" section. We also use "Session Storage", which works similarly but only saves information for the duration of the session

• Analytical and advertising technologies
• Social media tools.

Our websites use plug-ins and other social media tools made available by social networking services such as Facebook. The legal basis for using the plug-ins is Article 6(1)(f) GDPR The website contains a Facebook icon with a link to our profile. Clicking it results in a direct connection to the servers of the social media service provider. If you do not click these icons, the plug-ins remain inactive and, until they are clicked, do not transmit any data to the providers of these services. The content of the plug-in is transmitted by the given service provider directly to your browser and integrated into the website. Thanks to this integration, service providers receive information that your browser displayed our website, even if you do not have a profile with the given service provider or are not currently logged into it. Such information (together with your IP address) is transmitted by your browser directly to the server of the given service provider (some servers are located in the USA) and stored there If you have logged into one of the social networking services, that service provider will be able to directly assign the visit to our website to your profile on that social networking service. If you use a given plug-in, e.g. by clicking the "Like" or "Share" button, the corresponding information will also be transmitted directly to the server of the given service provider and stored there. Furthermore, this information will be published on the given social networking service and will appear to persons added as your contacts. The purpose and scope of data collection and its further processing and use by service providers, as well as the possibility of contact and your rights in this regard and the possibility of making settings ensuring the protection of your privacy, have been described in the privacy policy of each service provider.

• Facebook – https://www.facebook.com/legal/FB_Work_Privacy,

We have no influence over the data collected or the data processing processes, nor are we aware of the full scope of data collection, processing purposes, and retention periods. We also do not have information regarding the deletion of data collected by the plug-in provider. The plug-in provider saves the collected data in the form of a usage profile and uses it for advertising purposes, market research, or optimization of its own website in line with user preferences. Such analysis (including of users not logged into the plug-in provider's service) is carried out in order to tailor advertisements to users' interests and to inform other social network users about activities on our website. The user has the right to object to the creation of such user profiles, and in order to exercise this right should contact the plug-in provider. By using plug-ins, we offer users the opportunity to interact with social networking services and other users, which allows us to improve our offer and make it more attractive to the user If you do not want social networking services to assign the data collected during your visit to our website directly to your profile on the given service, you must log out of that service before visiting our website. You can also completely prevent the plug-ins from loading on the website by using appropriate extensions for your browser, e.g. blocking scripts.

• Links to third-party websites, embedded content from other websites.

Our websites may contain links to third-party websites. Brokik does not control these websites and is not responsible for the processing of personal data on them. Please read the privacy policies on these websites before using them and providing personal data on them. On our websites we may also use embedded content from other websites, e.g. video materials. Using content embedded on the website involves the transmission of data, such as your IP address, the data of the device you are using, the operating system, internet browser, etc., to the websites of the providers of that content, just as when using such a website directly. Server logs Using the website involves sending requests to the server on which the website is stored, and storing them in server logs. Logs are recorded and stored on the server. Logs contain: the time the request was received; the time the response was sent; the name of the client station; information about errors that occurred while carrying out the http transaction; the URL address of the page previously visited by the user, in the event the transition to the website took place via a link; information about the user's browser; information about the operating system and its interface, the user's browser, its language and version; the IP address

Security of personal data

We make every effort to ensure the security of the personal data processed. Among others, we apply the following security measures:

• safeguards protecting data against disclosure to unauthorized persons,
• safeguards against removal by an unauthorized person, alteration, damage, or destruction,
• we admit to the processing of personal data only persons holding authorization issued by us,
• ensuring control over the correctness of the processing of personal data and maintaining a register of persons authorized to process personal data,
• ensuring that persons authorized to process this data, or entities carrying out processing on our behalf, keep it confidential, including after the completion of the provision of the Service,
• maintaining documentation, required by law, describing the manner in which entrusted personal data is processed and the technical and organizational measures ensuring the protection of the processing of that data,
• ensuring that the devices and IT and telecommunications systems used to process personal data are secured in accordance with industry-accepted standards. Our infrastructure is located in data processing centers applying the highest security standards, and connections with remote users, including with users' applications, are appropriately secured and encrypted.

Your data

You can download a copy of your data and delete your account in the app, under “My account” → “Profile”. To use any of the other rights described under “Rights of the data subject”, write to office@brokik.com.

Downloading a copy of your data. Owner and manager accounts have a “Data export” section on the “Profile” tab. When you click “Prepare export”, we build one ZIP file. It holds CSV tables of your properties, tenants, settlements, invoices, costs, meter readings and issue reports, the files of your agreements, protocols and signed documents, and your photos. We e-mail you a link to the file, and the link works for 7 days. Export also works while the Account is in Restricted Access.

Tenant accounts. Tenant accounts have no export in the app. To get a copy of your account data, write to office@brokik.com from the e-mail address you sign in with. The landlord keeps the agreement, protocols, meter readings and rent invoices on their own account and decides about that data, so ask your landlord for a copy or for deletion.

Deleting your account. At the bottom of the “Profile” tab, in the “Danger zone” section, there is a “Delete account” button. Once you confirm, we delete the account straight away and it cannot be undone. Deleting an owner or manager account also deletes its properties with their tenancies, documents, settlements and photos, so download the export first.

Correcting your data and newsletter consent. You can change your name and phone number on the “Profile” tab. On an owner account you withdraw newsletter consent on the same tab, in the “Emails from Brokik” section; on other accounts, write to office@brokik.com.

CHANGES TO THE PRIVACY POLICY

This Privacy Policy may be amended in the event that the need or obligation to introduce such changes results from the development of the application's functionality, technological progress, changes to relevant laws, or changes in the processing of data by the Controller.

Date of publication of the Privacy Policy: 16.10.2023. Date of last update: 29.09.2026.