Privacy policy — draft

Draft for legal review — updated 26 October 2026. Do not publish as final legal wording until details and implementation have been reviewed.

Before operation, identify the controller for each processing activity and the roles of the committee, management company and operator. Collection notices must explain required information, purposes, recipients and consequences of not providing it. Review the wording under Israel’s Privacy Protection Law and Amendment 13.

Planned data includes contact details and language, unit and role, payment and debt records, documents, faults and consent preferences. Purposes include service delivery, operational communication, security and enquiries. Personal debt details are not intended for public reports; access must follow role and need.

Before launch, publish the actual subprocessors, processing types and countries for hosting, authentication, messaging and analytics. Review contracts and the basis for each international transfer. Selecting an EU database region does not establish that every processing activity stays in Europe.

Cost comparisons are planned from aggregate data without building identification in the comparison table. No result is shown for fewer than five suitable buildings. Resident details must not be sold to advertisers. Validate the actual data flow and re-identification risk before operation.

Provide a channel for access and correction and requests for deletion or export, subject to applicable rights and duties; immediate deletion is not assured for every request. Proposed retention is up to 24 months for logs and seven years for financial records where justified. Counsel must approve deletion schedules, backups, exceptions and identity checks.

Final publication requires privacy contacts and a DPO where required, processing grounds, response periods, supplier details, actual retention and an incident-reporting process. This draft does not claim that security review or DPO appointment has already been completed.