Data processing terms (DPA)

Version: 2026-08-28
Effective: 28 August 2026

Who this is for

Household users. For a family using Homnest, LohiSoft s.r.o. is the controller of the personal data described in the privacy notice. You are not required to sign a processor contract to use the consumer product. This page still lists who processes data for us (Art. 13/14 transparency) and the subprocessor list.

The GDPR household exemption (Art. 2(2)(c)) may apply to your purely personal use of a Home; it does not take Homnest outside the GDPR as a provider.

Organisations. If you are a legal person and we process personal data on your documented instructions as your processor (a future or bespoke B2B arrangement), Sections 2–10 are the Art. 28 terms. They apply only when we have agreed in writing that you are the controller and we are the processor. The public B2C app is not that arrangement by default.

1. Processors acting for LohiSoft (B2C transparency)

When we are controller, the following act as processors (Art. 4(8) / 28), except as noted:

Apple Inc. (APNs) and Google LLC (FCM) deliver pushes. Apple and Google are independent controllers for in-app purchase billing. For FCM/APNs device tokens and payloads we send, they process as needed to deliver OS notifications; transfer tools are described in the privacy notice (DPF and/or SCCs).

We do not use a CDN, an SMS gateway, Stripe Checkout, or product-analytics vendors.

2. B2B processor terms (only if contracted)

If a written B2B order states that the customer is controller and LohiSoft is processor:

• We process only on documented instructions, including regarding transfers, unless Union or Member State law requires otherwise (Art. 28(3)(a)).
• Confidentiality: persons authorised to process have committed to confidentiality (Art. 28(3)(b)).
• Security: measures appropriate to the risk (Art. 32), including TLS, hashing of passwords, AES at rest for non-E2E modules, and zero-knowledge storage of E2E ciphertext we cannot read.
• Sub-processors: those in Section 1 and the public list; we will impose equivalent Art. 28 duties (Art. 28(4)). We will give the customer notice of intended changes to the list so the customer can object as agreed in the order (Art. 28(2)).
• Assistance: we assist with data-subject requests, DPIA and breach notification to the extent the data and our role allow. We cannot decrypt E2E content.
• Deletion / return: at the end of the service, we delete or return personal data as instructed, subject to statutory retention and to the 30+60 day consumer deletion timetable if that product path is used.
• Audits: we make available information necessary to demonstrate Art. 28 compliance and allow audits as agreed in the order, without exposing other customers’ data or E2E keys we do not hold.
• International transfers: EU storage for Atlas, S3 and VPS; US transfers for APNs/FCM as in the privacy notice (Art. 45 DPF and/or Art. 46 SCCs — Commission Decision (EU) 2021/914).
• Breach: we notify the customer without undue delay after becoming aware of a personal-data breach in our sphere.

Standard Contractual Clauses, where needed for a B2B transfer we control, are Module 2 (controller to processor) or Module 3 (processor to processor) as the roles require.

3. What we cannot do as processor or controller

We cannot produce a plaintext dump of messages, calls, recordings, photos, receipts, attachments or location coordinates. An export of those modules is ciphertext plus a manifest.

4. Contact

LohiSoft s.r.o., Komenského 317/135, 943 01 Štúrovo, Slovak Republic
hello@lohisoft.com

No DPO is appointed.

Version 2026-08-28.