Privacy Policy

This Privacy Policy explains how FortisNest, a software product developed and operated by EACT Technologies OÜ (“EACT”, “we”, “us”), handles personal data through fortisnest.com and, when launched, the FortisNest web and mobile applications.

Important: FortisNest is designed for residential associations, owners’ associations, committees and similar organizations. An organization using FortisNest generally determines why member, owner, resident and property data is entered into the platform and is therefore ordinarily the controller of that customer data. EACT generally processes that information on the organization’s behalf. EACT acts as controller for information it processes for its own purposes, including account administration, security, support, website operations, contractual administration and EACT’s own compliance obligations.

1. Information covered by this Policy

Depending on the features used, FortisNest may process:

• Account and identity information: name, email address, telephone number, user identifier, role, organization/association affiliation and authentication information.
• Property and community records: flat/unit number, floor, ownership or occupancy information, owner/member/resident contact details and information entered by authorized administrators.
• Administrative and financial records: service charges, dues, payment records, expenses, vendors/payees, payment method descriptions, balances, receipts, invoices, supporting documents and reports.
• Uploaded files: documents, identity documents where the customer elects to collect them, receipts, images and other records uploaded through the service.
• Security and audit information: login activity, timestamps, user actions, audit records, IP addresses and information necessary to investigate misuse or protect the service.
• Technical information: device type, operating system, browser/app version, diagnostics, crash information and similar service telemetry, where implemented.
• Support and communications: information contained in enquiries, support requests and other communications with us.
• Advertising and analytics information: if advertising or analytics technology is activated, identifiers, device/app information, approximate location derived from IP, ad interaction information and consent/preferences may be processed as described in this Policy and the Cookie & Tracking Technologies Policy.

2. Why information is processed

• Provide, maintain and administer FortisNest and customer accounts.
• Authenticate users, assign roles and control access.
• Store, retrieve, report and display information submitted by authorized customer users.
• Generate administrative and financial records requested by customers.
• Maintain audit, backup, integrity, fraud-prevention and security functions.
• Provide support and communicate about the service.
• Comply with legal obligations and establish, exercise or defend legal claims.
• Measure and improve the service where permitted.
• Display advertising. Where law requires consent for personalized advertising, tracking or access to device information, such processing will not be based merely on acceptance of our Terms; the required separate choice will be requested.

3. Legal bases

Where the GDPR or similar law applies and EACT acts as controller, processing may rely on: performance of a contract or steps requested before entering a contract; compliance with a legal obligation; EACT’s legitimate interests, where not overridden by individual rights; and consent where consent is the appropriate legal basis. Consent may be withdrawn prospectively at any time through the mechanism provided or by contacting us.

Acceptance of the Terms & Conditions is a contractual acknowledgement and is not treated as blanket consent to unrelated optional processing such as personalized advertising.

4. Customer organizations and individuals

If your association, building committee or property administrator created, controls or supplied your information in FortisNest, requests concerning that customer-controlled information should normally be directed to that organization. We may assist the organization with lawful requests as its processor.

5. Advertising

FortisNest may display advertisements in the web application and mobile application. Ads may be contextual or non-personalized. We may later use third-party advertising providers or personalized advertising where legally permitted. Before deploying a particular advertising SDK, network or tracking technology, we will update applicable disclosures to identify the relevant categories of recipients and processing.

Where consent is legally required for advertising identifiers, cookies, SDK storage/access, personalized advertising or similar tracking, we intend to present a separate consent choice before activating that processing. Refusing optional advertising/tracking consent will not be interpreted as refusal of the Terms. Some ads may still be displayed on a contextual or otherwise lawful non-personalized basis.

6. Cookies, SDKs and similar technologies

The website, web application and mobile application may use cookies, local storage, software development kits (“SDKs”), device identifiers and similar technologies. Strictly necessary technologies may be used to authenticate users, maintain sessions, remember essential settings, prevent fraud and secure the service. Optional analytics or advertising technologies will be handled in accordance with applicable consent requirements. See our Cookie & Tracking Technologies Policy.

7. Recipients and service providers

Information may be disclosed to infrastructure, hosting, storage, email, security, monitoring, support, analytics, advertising and other technology providers only as necessary for their services and subject to appropriate arrangements. It may also be disclosed where required by law, to protect rights or security, in connection with a corporate transaction, or at the direction of the relevant customer organization. We do not sell personal data in the ordinary meaning of selling a customer database for money.

8. International transfers

FortisNest may use service providers located in different countries. Where applicable law restricts international transfers, EACT will use an available lawful transfer mechanism and appropriate safeguards as required.

9. Retention

Retention depends on the nature of the information, customer instructions, contractual requirements, security needs and legal obligations. Customer-controlled association data is generally retained while required to provide the service and according to the applicable customer relationship. Security logs, contractual records and legally required records may be retained for appropriate periods after account termination. We will not retain personal data longer than reasonably necessary for the applicable purpose unless law requires otherwise.

10. Security

We use reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, destruction or loss. These may include access controls, authentication, logging, backups and infrastructure security. No internet-connected system can guarantee absolute security.

11. Individual rights

Depending on your jurisdiction, you may have rights concerning access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaint to a competent supervisory authority. Rights are subject to applicable conditions and exceptions. For customer-controlled association data, we may refer your request to the relevant organization.

12. Account and data deletion

Where the FortisNest mobile application permits users to create accounts directly and applicable app-store rules require an account-deletion mechanism, we will provide an accessible method for requesting account deletion. Deletion may be subject to customer-controller instructions and lawful retention obligations for association, accounting, security or legal records.

13. Children

FortisNest is an association administration product and is not directed to children. Customer organizations are responsible for ensuring that any information concerning minors entered into the service is processed lawfully. We do not intend to use children’s data for personalized advertising.

14. Changes to this Policy

We may update this Policy when the product, law, service providers or data practices change. Material changes will be communicated where required. The effective date at the top identifies the current published version.

15. Contact

EACT Technologies OÜ
Registry code: 17570948
Tornimäe tn 5, Kesklinna, Tallinn 10145, Harju County, Estonia
Email: contact@neofortistech.com