Service Provider / Operator: Brillnet Piotr Adamski, ul. Henryka Sienkiewicza 73/6, 90-057 Łódź, Polska, NIP 7321779060, REGON 101551294
Service contact: kontakt@wm-admin.pl
Privacy and breach contact: privacy@brillnet-app.com
Website: wm-admin.pl
Version: 2026-10-12-beta.2
This is an informational translation. The Polish version is binding.
1. Brillnet's two roles
- Brillnet is the controller of data concerning Customer representatives, account Users, billing, security, contact, the marketing website and its own legal obligations.
- Brillnet is a processor when handling, on the Customer's behalf, data of residents, owners, tenants, suppliers, authorised agents and other people recorded in a Community. These operations are governed by the DPA; the Customer determines purposes and legal bases.
- Stripe, a bank, a public authority or Google may act as an independent controller or the Customer's processor depending on the operation and agreement. The current classification is in Subprocessors and recipients.
2. Data processed by Brillnet as controller
| Purpose | Data categories | Basis | Period |
|---|---|---|---|
| entering into and performing the Agreement | representative's identification and contact details, organisation, role, evidence of authority, acceptance events | Article 6(1)(b) GDPR; for representatives, point (f): maintaining the Customer relationship | Agreement + claims period |
| account and authentication | email, identifier, password hash, sessions, multi-factor authentication (MFA) configuration, roles | Article 6(1)(b) or (f) GDPR | account lifetime; security data according to retention rules |
| payments, tax and accounting | organisation and payer details, Stripe customer/subscription/transaction identifiers, invoices; Brillnet does not store full card numbers | Article 6(1)(b) and (c) GDPR | period required by tax and accounting rules |
| security, audit and abuse prevention | sign-ins, device/session identifiers, IP address or its limited/hashed form, audit log, correlation | Article 6(1)(f) GDPR: protecting the Service and Customers and preserving evidence | security logs at least 12 months; operational logs generally 90 days |
| support and complaints | request content, contact details, technical metadata, attachments supplied by the reporter | Article 6(1)(b) or (f) GDPR | generally 3 years after closure, longer for a dispute |
| Service communications | address, role, information about outages, security, document changes or payments | Article 6(1)(b), (c) or (f) GDPR | relationship duration and evidentiary period |
| own marketing, if launched | email, organisation, consent and objection history | consent or a legally permitted legitimate interest, taking account of the Polish Electronic Communications Law | until withdrawal/objection; evidence for the claims period |
| defending claims and compliance | data connected with an event or proceedings | Article 6(1)(c) or (f) GDPR | until the obligation ends or the limitation period expires |
3. Website data and cookies
- The landing page does not use external analytics, advertising profiling or session recording.
- The application uses cookies and mechanisms technically necessary for sessions, security and authentication. Tenant data is not stored in
localStorageorIndexedDB. - Stripe and Google may set their own cookies after the User proceeds to their service or knowingly enables an integration.
- See the Cookie Policy. If Brillnet adds analytics that are not technically required, it will implement consent before activating them.
4. Data sources
We receive data from the individual concerned; from the Customer or its administrator; from Stripe for payment status; from a sign-in or integration provider selected by the Customer; and automatically through secure use of the Service. If an organisation supplied its representative's data, that organisation is the source.
5. Recipients, subprocessors and transfers
- Data may be received by authorised Brillnet personnel, infrastructure and communications providers, Stripe, advisers bound by confidentiality, and authorities where required by law.
- The primary infrastructure uses Cloudflare. Persistent D1, R2 and Durable Objects data is configured with EU jurisdiction, but stateless Workers may execute code outside the European Economic Area (EEA). We do not claim that all processing occurs exclusively in the EEA.
- Appropriate mechanisms apply to transfers outside the EEA, particularly an adequacy decision (such as the EU–US Data Privacy Framework if the entity is certified) or standard contractual clauses, with an assessment of supplementary measures.
- The current list and scope are in Subprocessors.
6. Product analytics and diagnostics
- Brillnet may calculate aggregate or pseudonymised product performance metrics in its own infrastructure.
- Document, message, form and financial data content is not sent to analytics; we do not use screen or session recording.
- Production tracing is disabled by default. It may be enabled temporarily for diagnostics or sampled at no more than 1%, with content minimisation and access controls.
7. Automated decisions
Brillnet does not make decisions about individuals with legal effects solely by automated means and does not profile them for marketing. Optical character recognition (OCR) proposes extracted data; a person approves it. Business rules configured by the Customer remain under its control.
8. Individual rights
- For data controlled by Brillnet, an individual may request access, rectification, deletion, restriction and portability where applicable, and may object. Consent may be withdrawn without affecting earlier processing.
- For Customer Data, contact the relevant residential community or management company first. Brillnet will forward the request to the Customer and assist under the DPA.
- Requests may be sent to
privacy@brillnet-app.com. We may ask for reasonable identity confirmation. - Individuals may complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl.
9. Security
We use tenant separation, encrypted transmission, provider encryption of persistent data, role controls, mandatory MFA for privileged roles, audit logs, short-lived controlled support access, backups and an incident procedure. The full measures are described in the technical and organisational measures annex to the DPA.
10. Children and special categories of data
The Service is not directed at children. The Customer should enter children's data and special categories of data only where necessary, with a legal basis and appropriately restricted access. Brillnet does not use such data for its own purposes.
11. Changes and contact
Material changes are communicated according to the document change rules. Questions and requests: privacy@brillnet-app.com. No data protection officer has been appointed; contact is handled by Brillnet's privacy process owner.
Contact, content notices and content decisions
For illegal-content notices, decisions and complaints, the Operator is controller of the notifier’s, decision recipient’s and necessary content data. Processing serves DSA legal duties (GDPR Article 6(1)(c)) and, outside legal duties, service and rights protection and voluntary complaint review (point (f)). Data come from the notifier, recipient and relevant content. Authorised staff, the mailbox provider and competent authorities where legally required may receive them. Retention lasts for case handling and necessary verification or legal claims, with review of continued need. We do not publish notifier data or disclose them to the recipient without necessity and a basis. Unnecessary data are not requested; the DSA identity exception remains available. This Policy’s recipient, transfer and rights provisions also apply.
> Contact details and domains in this presentation were updated on 2026-09-08. The original document and previous acceptances remain unchanged.